CVE-2019-1068 Microsoft SQL Server Remote Code Execution

Exploited in the wild High 8.8 Published 15 Jul 2019 Updated 27 Aug 2026

Attackers can execute arbitrary code remotely by exploiting improper handling of internal functions in Microsoft SQL Server.

Exploited in the wild: Since 26 Aug 2026
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-1068?

CVE-2019-1068 is a high-severity code injection vulnerability in Microsoft Sql Server, published on 15 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.

Weakness: CWE-20

Which versions are affected by CVE-2019-1068?

It affects 3 products.

Products include Microsoft Sql Server, Microsoft Sql Server 2016, Microsoft Sql Server 2017.

How do I fix CVE-2019-1068?

No fix has been published for CVE-2019-1068 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 29 Aug 2026.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-1068 being exploited?

Yes. Attackers have exploited CVE-2019-1068 in the wild since at least 26 Aug 2026.

Public exploit code: 1 proofs of concept on GitHub.

All Microsoft Sql Server vulnerabilities

Sources

Also known as GHSA-62pw-5pr4-ghr5.