Actively exploited in the wild
Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft - SQL Server · Listed in the CISA KEV since 2026-08-26. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2019-1068
HighCVSS 8.8KEVExploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
A remote code execution vulnerability exists in Microsoft SQL Server due to improper handling of internal functions. An attacker could exploit it to execute arbitrary code on the server.
Risk Assessment
The organization risks full compromise of the database server, potentially leading to data breaches and integrity loss.
Recommendation
Apply security updates provided by Microsoft for SQL Server. Restrict network access to the server to trusted hosts only.
Other vulnerabilities in Microsoft SQL Server
See all- CVE-2016-7249High
Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, allowing remote authenticated users to gain privileges via unknown vectors.
- CVE-2026-67643Critical
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
- CVE-2026-67631Critical
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
- CVE-2000-0402Low
The vulnerability in Microsoft SQL Server 7.0 allows the Mixed Mode authentication mechanism to store the System Administrator (sa) account password in plaintext in a log file, which is accessible to any user.
- CVE-1999-0999Medium
Microsoft SQL 7.0 server allows a remote attacker to cause a denial of service via a malformed TDS packet.
- CVE-2024-43474High
Information disclosure vulnerability in Microsoft SQL Server. Could allow an attacker to gain access to sensitive data.
- CVE-2024-37980High
Elevation of privilege vulnerability in Microsoft SQL Server. It allows an attacker to gain higher privileges on the system.
- CVE-2024-37966High
Information disclosure vulnerability in Microsoft SQL Server Native Scoring. It may allow an attacker to gain unauthorized access to data.
- CVE-2024-37965High
A vulnerability in Microsoft SQL Server allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges in the database.
- CVE-2024-37341High
Elevation of privilege vulnerability in Microsoft SQL Server. It allows an attacker to gain higher privileges on the system.
Original NVD description (English source)
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS