[KEV] CVE-2019-1068 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2019-1068 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2019-1068 is a remote code execution vulnerability in Microsoft SQL Server that affects the SQL Server Database Engine.

Technical Detail

The vulnerability could allow an attacker to execute code through the SQL Server Database Engine. Successful exploitation results in remote code execution in the security context of the SQL Server Database Engine service account. The available information does not specify the precise vulnerable input, authentication requirements, or exploitation sequence.

Exploitation Status

Exploit maturity is assessed as Operational, meaning exploitation methods are usable in real-world environments rather than remaining limited to a proof of concept. CISA has confirmed active exploitation in the wild. This vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on August 26, 2026.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Prioritize installation of the applicable Microsoft SQL Server security updates and verify that all SQL Server instances, including legacy and externally accessible deployments, are covered. As this vulnerability is KEV-listed, organizations subject to CISA binding operational directives should patch by August 26, 2026 or apply mitigations; that deadline has passed as of August 27, 2026. Restrict network access to SQL Server services, run the Database Engine under a least-privileged service account, and investigate unexpected processes, command execution, or outbound network connections originating from the SQL Server Database Engine service.