An Old SQL Server Bug Resurfaces
CISA has added CVE-2019-1068, a Microsoft SQL Server remote code execution vulnerability originally patched in July 2019, to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft's original advisory rated exploitation as "less likely," but the KEV addition confirms attackers are now actively using it — seven years after the fix shipped.
The flaw is a reminder that patched-but-unapplied vulnerabilities don't expire. Any SQL Server instance still missing the July 2019 update remains exposed today.
Vulnerability Details
| Detail | Value |
|---|---|
| CVE | CVE-2019-1068 |
| CVSS Score | 8.8 (High) |
| Type | Remote Code Execution — memory corruption |
| Attack Vector | Network — requires authentication |
| Affected Product | Microsoft SQL Server |
| Patch Released | July 9, 2019 |
| KEV Addition | August 26, 2026 |
How the Vulnerability Works
CVE-2019-1068 stems from how the SQL Server Database Engine processes certain internal functions. An authenticated attacker who can submit a specially crafted query to a vulnerable instance can trigger a stack-based memory corruption condition. Independent research tracing the issue to svl.dll found it could be leveraged for both denial of service and remote code execution, running in the context of the SQL Server Database Engine service account.
Because authentication is required, this isn't an internet-wide unauthenticated RCE — but any environment where database credentials are shared, weak, or exposed to a broader user base than intended (application service accounts, third-party integrations, contractors) effectively lowers that bar.
Why This Matters Now
- Public PoC exploit code exists, making weaponization straightforward for anyone who identifies an unpatched, reachable instance.
- Authenticated attackers with limited database access can escalate to code execution at the database engine's service-account privilege level — a meaningful jump for lateral movement.
- Legacy SQL Server deployments — especially long-lived line-of-business databases that are rarely patched outside of major version upgrades — are the likely targets.
- Federal deadline applies. FCEB agencies must remediate per CISA's published KEV timeline.
Remediation
Patching
The fix has been available since July 2019. Apply the relevant cumulative update for your SQL Server version immediately if it hasn't already been installed — there is no reason for a modern, maintained instance to still be exposed.
Compensating Controls
If immediate patching isn't possible:
- Restrict database credentials to the minimum set of accounts and applications that actually need them.
- Segment SQL Server instances from broader network access; limit query access to trusted application tiers only.
- Audit for legacy or forgotten SQL Server instances — this is exactly the class of system where a seven-year-old patch gap survives unnoticed.
Detection
- Monitor SQL Server error logs and crash dumps for repeated engine crashes, which can indicate exploitation attempts.
- Watch for unexpected child processes spawned by the SQL Server service account.
- Flag anomalous queries containing malformed or unusually structured function calls.
Key Takeaways
- CVE-2019-1068 is proof that "exploitation less likely" doesn't mean "exploitation never" — seven years later, it's confirmed exploited.
- Authentication requirements reduce but don't eliminate risk — shared or over-provisioned database credentials close that gap fast.
- Patch availability since 2019 makes this an inventory problem, not a research problem — find the unpatched instances.
- Legacy database infrastructure deserves the same KEV-driven urgency as freshly disclosed zero-days.