CISA Warns of Actively Exploited Microsoft SQL Server RCE Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2019-1068, a remote code execution vulnerability affecting Microsoft SQL Server, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation.

This vulnerability allows an attacker to execute code in the security context of the SQL Server Database Engine service account.

Microsoft SQL Server RCE Vulnerability

CISA added this flaw on August 26, 2026, and set a remediation deadline of August 29, 2026, for organizations under Binding Operational Directive (BOD) 26-04. The agency did not identify any ransomware campaigns associated with this vulnerability, marking that status as unknown.

SQL Server instances are often prime targets because they host critical business databases and may operate under privileged service accounts.

If successfully exploited, an attacker could run arbitrary code on the affected server, steal or modify database content, establish persistence, or move laterally within an enterprise environment.

The extent of the impact depends on the permissions assigned to the SQL Server Database Engine service account. Environments that use highly privileged accounts may be at greater risk of host-level compromise and subsequent access to connected systems.

CISA has instructed affected organizations to implement mitigations in accordance with Microsoft’s vendor guidance and comply with BOD 26-04 risk-based update requirements. The agency also mandates forensic triage for this vulnerability, indicating that patching should not be the only response.

Security teams should prioritize the following actions:

• Identify all on-premises and internet-facing Microsoft SQL Server deployments.
• Apply Microsoft’s security update or approved mitigation for CVE-2019-1068.
• Review SQL Server and Windows logs for suspicious execution, unusual service-account activity, and anomalous database access.
• Check for unauthorized scheduled tasks, new services, web shells, or unexpected administrative accounts on database servers.
• Restrict database-server exposure, segment SQL infrastructure, and ensure service accounts operate with least privilege.

Organizations unable to implement effective mitigation measures should discontinue use of the affected product, per CISA’s KEV guidance.

The inclusion of CVE-2019-1068 in CISA’s KEV Catalog makes remediation urgent, especially for exposed SQL Server systems and environments where database services have elevated permissions.

Teams should combine patch deployment with incident-hunting activities to check for any exploitation that may have occurred before the update was installed.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC