Microsoft SQL Server zero-day lets attackers run code

Published August 26, 2026 CVE-2019-1068

A security flaw in Microsoft SQL Server lets an attacker who can already run queries against a database trick it into running their own code. That code runs with the same permissions as the SQL Server database engine itself, not just inside the database.

Severity
HighCVSS 3.1 · 8.8
Fix
Update availableFix recorded on Aug 26, 2026
Affected versions
unspecified; 2014 Service Pack 2 for 32-bit Systems (CU); 2014 Service Pack 2 for x64-based Systems (CU)+11 more
Weakness
CWE-20Improper Input Validation
Exploit likelihood
53% in 30 daysEPSS, higher than 99% of known flaws
Affects
Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)+9 more
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 26, 2026
Federal fix deadline
Aug 29, 2026

How it works

SQL Server mishandles how it processes certain built-in internal functions, so a specially crafted query can push the engine outside its normal bounds and make it execute attacker-supplied code.

What to do

Check the build number of your SQL Server instance and compare it against Microsoft's July 9, 2019 security update KB articles for your version, such as KB4505224 for SQL Server 2017 GDR.

Install the July 2019 cumulative or GDR security update for your specific SQL Server version through Windows Update, SQL Server Update Center, or the Microsoft Update Catalog, then confirm the new build number matches Microsoft's advisory.

Technical details

Affected software: Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)by Microsoft, Microsoft SQL Serverby Microsoft, Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR)by Microsoft, Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR)by Microsoft, Microsoft SQL Server 2017 for x64-based Systems (GDR)by Microsoft, Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)by Microsoft, Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)by Microsoft, Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)by Microsoft, Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)by Microsoft, Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)by Microsoft

CVE-2019-1068 is a remote code execution flaw in Microsoft SQL Server caused by incorrect handling of internal function processing (CWE-20, improper input validation). A user able to submit queries can trigger execution of arbitrary code in the context of the SQL Server Database Engine service account. It carries a CVSS score of the latest version (high) and is listed in CISA's Known Exploited Vulnerabilities catalog, with an EPSS score of about 0.45, indicating a meaningfully elevated real-world exploitation likelihood among scored CVEs. Microsoft fixed it in the July 9, 2019 security updates across supported SQL Server versions, each shipped as version-specific GDR and cumulative update packages.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source