NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Microsoft SQL Server flaw CVE-2019-1068 exploited in attacks; July 2019 fixes available

Attackers are exploiting CVE-2019-1068 in unpatched Microsoft SQL Server databases. Fixes for affected SQL Server 2014, 2016 and 2017 branches date to July 2019. Ask your IT provider to verify every instance is patched and check for compromise.

What to do

If your business or family office uses SQL Server, ask its IT provider to verify every database instance has the applicable Microsoft security update or a later update that includes it, including instances bundled with business software. Ask them to check for prior compromise as well as patching.

What’s happening

CVE-2019-1068 is a flaw in how Microsoft SQL Server processes internal functions. An attacker with database access can use it to run code with the permissions of the database service account. It affects unpatched SQL Server 2014 SP2/SP3, 2016 SP1/SP2 and 2017 installations, including databases supporting business applications. Microsoft released updates for the affected security-only and cumulative-update branches on 9 July 2019. CISA confirmed exploitation by adding the flaw to its catalogue on 26 August 2026. The following day, The Hacker News reported that exploitation details were not public. CERT Vanuatu gives a July 2026 fix date in its advisory, but Microsoft's release records establish July 2019. As at 3 November 2026, fixes are available; the sources reviewed do not establish the attackers, victims, scale of attacks or whether exploitation has stopped.

What
Flaw
Affects
Microsoft SQL Server 2014, 2016 and 2017
Affected
SQL Server 2014 SP2, x86 and x64, GDR and CU branches without the applicable security update
SQL Server 2014 SP3, x86 and x64, GDR and CU branches without the applicable security update
SQL Server 2016 SP1, x64, GDR and CU branches without the applicable security update
SQL Server 2016 SP2, x64, GDR and CU branches without the applicable security update
SQL Server 2017, GDR and CU branches without the applicable security update
Fixed in
SQL Server 2014 SP2 GDR: KB4505217
SQL Server 2014 SP2 CU+GDR: KB4505419
SQL Server 2014 SP3 GDR: KB4505218
SQL Server 2014 SP3 CU+GDR: KB4505422
SQL Server 2016 SP1 GDR: KB4505219
SQL Server 2016 SP1 CU+GDR: KB4505221
SQL Server 2016 SP2 GDR: KB4505220
SQL Server 2016 SP2 CU+GDR: KB4505222
SQL Server 2017 GDR: KB4505224, build 14.0.2027.2
SQL Server 2017 CU+GDR: KB4505225
CVE
CVE-2019-1068
Since
26 Aug 2026
Closed
27 Aug 2026

Timeline

  1. Update

    The Hacker News reported that details of how attackers were exploiting the SQL Server flaw had not been made public.

  2. CISA added

    CISA added CVE-2019-1068 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. It set 29 August as the remediation deadline for affected US federal civilian agencies.

  3. New fixFixed

    Microsoft released security updates for affected SQL Server 2014, 2016 and 2017 branches. The flaw lets attackers run code with the permissions of the database service account.

Sources

  1. KB4505224 — Security update for SQL Server 2017 GDR: July 9, 2019Microsoft · 9 July 2019
  2. Security update deployment information: July 9, 2019Microsoft · 9 July 2019
  3. Advisory 203: CVE-2019-1068 — Microsoft SQL Server Remote Code Execution VulnerabilityCERT Vanuatu · 26 Aug 2026
  4. CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server BugsThe Hacker News · 27 Aug 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS