CVE-2019-1068

Published: Jul 15, 2019Modified: Aug 27, 2026CISA KEV

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.

Affected (8)

Products: Microsoft: Sql Server, Sql Server 2016, Sql Server 2017

3 products

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Microsoft Sql Server	Version 2014 sp2
Microsoft Sql Server	Version 2014 sp3
Microsoft Sql Server 2016	13.0.4001.0 ≤ version < 13.0.4259.0
Microsoft Sql Server 2016	13.0.4411.0 ≤ version < 13.0.4604.0
Microsoft Sql Server 2016	13.0.5026.0 ≤ version < 13.0.5101.9
Microsoft Sql Server 2016	13.0.5149.0 ≤ version < 13.0.5366.0
Microsoft Sql Server 2017	14.0.1000.169 ≤ version < 14.0.2027.2
Microsoft Sql Server 2017	14.0.3006.16 ≤ version < 14.0.3192.2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068

Source: secure@microsoft.com

PatchVendor Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.