Crafted-query code execution in Microsoft SQL Server Database Engine (CVE-2019-1068)
CISA added this CVE to KEV on 2026-08-26 with a remediation deadline of today, and Mallox ransomware operators are documented using it, so teams still running unpatched SQL Server instances remain live ransomware targets.
An authenticated attacker who can submit a specially crafted query to an affected SQL Server can execute code in the context of the SQL Server Database Engine service account. Securelist documents its use in Mallox ransomware intrusions against exposed SQL Server instances.
Affected: Microsoft SQL Server 2014 SP2 (32-bit and x64, GDR/CU); Microsoft SQL Server 2014 SP3; Microsoft SQL Server 2016 SP1 (x64); Microsoft SQL Server 2016 SP2 (x64); Microsoft SQL Server 2017 (x64)
How to Test
Determine the SQL Server version number (per Microsoft KB321185); instances in the ranges 12.0.5000.0–12.0.5214.6 (2014 SP2 GDR) or 12.0.5511.0–12.0.5632.1 (2014 SP2 CU), or unpatched 2014 SP3 / 2016 SP1 / 2016 SP2 / 2017 builds, are vulnerable. Also verify whether the instance is reachable from the internet and review authentication logs for brute-force or unexpected logins.
How to Patch
Apply the June 2019 security updates for your branch — KB4505217 (2014 SP2 GDR), KB4505419 (2014 SP2 CU, includes servicing through SP2 CU17/KB4491540), KB4505218 (2014 SP3 GDR), KB4505422 (2014 SP3 CU) and the corresponding updates for 2016/2017 per the MSRC guide. If your version number is no longer in Microsoft's supported table, upgrade to a supported Service Pack or SQL Server release; remove direct internet exposure of the SQL listener where possible.