SMBs Urged to Address Newly Exploited SQL Server Vulnerability

A newly exploited vulnerability in Microsoft SQL Server is a concern for SMBs. Here's what to know and do.

The short version

CVE-2019-1068 is a remote code execution flaw in Microsoft SQL Server.
SMBs using SQL Server should check if they are patched.
Apply the available patch and review configurations.
Monitor for signs of compromise if unpatched.

What is CVE-2019-1068 and Why Should SMBs Care?

CVE-2019-1068 is a flaw in Microsoft SQL Server that could allow an attacker to run code remotely on a vulnerable system. This means if your SQL Server is not patched, an attacker could potentially take control of it.

The vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) list on August 26, 2026, indicating it is being actively exploited. This means attackers are currently using this flaw to target unpatched systems.

SMBs that use SQL Server for managing data like customer records, financial information, or internal operations should be especially cautious. If your SQL Server is accessible from the internet or within your network, it could be a target.

How Does This Vulnerability Affect SMBs?

If your business uses Microsoft SQL Server and has not applied the latest security updates, you are at risk. Attackers could exploit this flaw to gain access to your database systems and potentially steal or manipulate data.

SQL Server is commonly used to store sensitive information, so a breach could lead to data loss, compliance issues, and damage to your business reputation.

Even if your SQL Server is not directly exposed to the internet, it could still be exploited through internal vulnerabilities or compromised devices on your network. It's important to patch all SQL Server instances, regardless of their exposure.

What Should You Do This Week?

The first step is to apply the patch from Microsoft. Microsoft released a fix for this vulnerability in their 2019 security updates. If you haven’t applied it yet, install the latest security update for SQL Server immediately.

Next, scan your network to identify any other unpatched systems. This will help you understand your exposure and prioritize remediation. If you're unsure how to do this, consider working with a managed security provider.

Review your SQL Server configurations to improve security. Disable unnecessary services, restrict access to authorized users, and enable logging to detect unusual activity.

How Can You Tell if You've Already Been Hit?

If your SQL Server was unpatched and accessible to the internet, it may already be compromised. Look for signs like unusual login attempts, unexpected processes running on the server, or unauthorized changes to database files.

Check your server logs for suspicious activity. Look for failed login attempts, unexpected queries, or connections from unfamiliar IP addresses.

If you suspect a breach, isolate the affected system immediately and contact a cybersecurity professional for help. They can help you investigate and contain the issue.

Not sure whether your environment is exposed? That is exactly what our Vulnerability Management service is built to surface. Talk to us.

Frequently asked questions

What is a remote code execution vulnerability?

A remote code execution (RCE) vulnerability allows an attacker to run arbitrary code on a target system from a remote location. This can give the attacker control of the system, making it a serious security risk.

Do I need to patch this if I'm not using SQL Server?

If your business isn’t using SQL Server, you don’t need to patch for this specific vulnerability. However, always ensure you’re up to date with security patches for any software you use.

What if I can't patch right away?

If you can’t patch immediately, consider workarounds like restricting access to SQL Server or placing it behind a firewall. These steps can help reduce the risk of exploitation until you can apply the patch.

How can I check if my SQL Server is patched?

You can check your SQL Server version and installed updates using SQL Server Management Studio. Confirm that the latest security update from Microsoft is installed.

Is this vulnerability being used in ransomware attacks?

As of now, there is no evidence that this vulnerability is being used in ransomware attacks. However, it is being actively exploited, so it’s important to patch it as soon as possible.

What should I do if I suspect a breach?

If you suspect a breach, isolate the affected system immediately and contact a cybersecurity professional for assistance. They can help you investigate and contain the issue.

Source (public domain): CISA