SQL Server RCE exploited in the wild (CVE-2019-1068)

Actively exploited in the wild - CVE-2019-1068 is a high-severity remote code execution vulnerability in Microsoft SQL Server that lets an authenticated attacker execute arbitrary code on the database server. Microsoft has released patches across all supported versions; update immediately.

Overview

CVE-2019-1068 is a remote code execution vulnerability in Microsoft SQL Server that stems from improper handling of internal functions during query processing. An attacker who can authenticate to the database can exploit this flaw to run arbitrary code in the context of the SQL Server service account. With a CVSS score of 8.8 and a low attack complexity, the vulnerability is straightforward to exploit once the attacker has valid credentials.

The flaw affects all supported versions of Microsoft SQL Server at the time of disclosure, including 2012, 2014, 2016, and 2017. The issue was resolved in the July 2019 Update for each affected version. Confirmation by CISA in the Known Exploited Vulnerabilities (KEV) catalog indicates that threat actors have successfully leveraged this issue in real-world attacks, making patching a priority for anyone running affected database instances.

Impact

Successful exploitation grants the attacker the same privileges as the SQL Server service account, which commonly runs with elevated Windows permissions. From this position, an attacker can:

• Read, modify, or delete data across all databases on the server
• Execute operating system commands if the service account has sufficient rights
• Move laterally across the network using compromised database credentials
• Disrupt availability by halting critical database services

Because SQL Server often sits in trusted network segments with broad access to application servers, the blast radius of a successful exploit can extend well beyond the database layer.

Remediation

Microsoft addressed CVE-2019-1068 in the July 2019 Security Update for all affected SQL Server versions. If you have not yet applied this update:

1. Install the latest cumulative update for your SQL Server version from the Microsoft Update Catalog
2. Review any SQL Server instances that may have been compromised prior to patching, checking for rogue accounts or suspicious stored procedures
3. Enforce the principle of least privilege for SQL Server service accounts to limit post-exploitation impact
4. Restrict network access to database ports (default 1433) to trusted application servers only

Related Reading: Weekly Threat Roundup: Orkes Conductor RCE (June 29-July 5), SharePoint RCE CVE-2026-45659 added to CISA KEV, Weekly Threat Roundup: APT28 DNS Hijacking (Apr 6-12

Security Insight

CVE-2019-1068 remains a recurring pain point for database administrators, often lingering on unpatched legacy instances that predate modern patch management. Its persistence in CISA KEV years after disclosure shows that attackers continue to scan for outdated SQL Server deployments, and that authenticated RCE in database platforms remains a reliable foothold for network intrusion. Treat database servers as high-value targets in any patch priority framework, not as backend infrastructure that can wait for quarterly maintenance windows.

Further Reading

• Weekly Threat Roundup: Orkes Conductor RCE (June 29–July 5)
• SharePoint RCE CVE-2026-45659 added to CISA KEV
• Weekly Threat Roundup: APT28 DNS Hijacking (Apr 6-12
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs