CVE-2019-1068: A remote code execution vulnerability exists in ...
Found by web discovery while looking for coverage of CVE-2019-1068
CISA added CVE-2019-1068, a high-severity remote code execution flaw in Microsoft SQL Server, to its KEV catalog after confirming exploitation in the wild.
CVE-2019-1068 (CVSS 8.8, CWE-20) is an improper input validation flaw allowing unauthenticated RCE in Microsoft SQL Server 2014 SP2/SP3, 2016, and 2017 on 32-bit and x64 builds. Exploitation requires low complexity and low privileges with no user interaction, and CISA formally added it to the KEV catalog on August 26, 2026. The CVE was originally published on July 15, 2019 and carries an EPSS score of 52.8%. Administrators must inventory affected SQL Server assets and apply vendor patches on an accelerated timeline.
- CISA added CVE-2019-1068 to the KEV catalog on August 26, 2026.
- The flaw enables RCE with low complexity and no user interaction.
- EPSS score of 52.8% indicates significant exploitation probability.
- Affected versions span SQL Server 2014 SP2/SP3, 2016, and 2017.
- CVEs
- CVE-2019-1068
- Products
- Microsoft SQL Server
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-1068 | Remote Code Execution in Microsoft SQL Server 2016 and 2017 | 8.8 | 57% | KEV | KEV |
From the original article
1 min read at hazetec.comCVE-2019-1068 is a high-severity remote code execution vulnerability (CVSS 8. 8) affecting multiple Microsoft SQL Server versions. Caused by improper input validation of internal functions, this flaw is confirmed as exploited in the wild and listed in the CISA KEV catalog.
By HazeTec · hazetec.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.