[HIGH PRIORITY] Microsoft SQL Server Remote Code Execution (CVE-2019-1068)

⚠ HIGH PRIORITY — CISA KEV (Aug 26, 2026). CVE-2019-1068 is a remote code execution vulnerability in Microsoft SQL Server. Attackers target legacy SQL Server 2014/2016 instances still exposed on port 1433 — active exploitation confirmed years after original patch availability.

Affected SQL Server

• Microsoft SQL Server 2014 SP2 and earlier unpatched builds
• SQL Server 2016 before cumulative updates addressing CVE-2019-1068
• Internet-exposed SQL on Windows Server (port 1433/TCP)

Check version

SELECT @@VERSION;
Get-Service MSSQLSERVER | Select Name, Status
netstat -an | findstr ":1433"

Patching Method

1. Identify SQL Server version and edition via SSMS or @@VERSION.
2. Download applicable cumulative update from Microsoft Update Catalog.
3. Schedule maintenance window — stop dependent applications first.
4. Install CU via Windows Update, WSUS, or SCCM.
5. Restart SQL Server service; verify build in SSMS → Server Properties.
6. Disable xp_cmdshell if not required: EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;
7. Review SQL error logs for exploitation indicators before patch date.

SELECT SERVERPROPERTY('ProductVersion');
EXEC xp_readerrorlog 0, 1, N'failed', N'login'

Until patched

• Block port 1433 at perimeter firewall — allow only app-server IPs
• Enable SQL Server authentication auditing and failed-login alerts
• Consider upgrading EOL SQL Server 2014 to supported release

CVSS: 8.8 High. Patch available since 2019 — unpatched = actively hunted.