Microsoft SQL Server remote code execution (CVE-2019-1068) — what running in the database "service account context" means
Microsoft SQL Server contains a remote code execution vulnerability that lets an attacker execute code in the context of the SQL Server Database Engine service account. CISA added it to the KEV catalog on 2026-08-26 with a due date of 2026-08-29 — three days after listing.
Key facts
- CVE IDCVE-2019-1068
- Affected (vendor / product)Microsoft SQL Server
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-08-29 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is Microsoft SQL Server; the name is "Microsoft SQL Server Remote Code Execution Vulnerability."
- An attacker can execute code in the context of the SQL Server Database Engine service account.
- That account holds rights over database files, backups, logs, and configuration.
- Added to KEV 2026-08-26 with a due date of 2026-08-29 — three days.
- Other entries on this site added around the same time carry two-week dates; urgency now varies per entry under BOD 26-04.
- A database layer is assumed safe because it is inside, and downtime is hard to arrange, so updates fall behind.
1What "the service account context" means
When reading a remote code execution entry, the privilege the code runs with is the central piece of information about impact. Here it is the account under which the SQL Server Database Engine runs. That account holds rights over the database files, the backups, the logs, and the configuration.
The attacker therefore lands not merely with access to what is stored in the database, but in a position to alter how the database itself operates.
2Why database servers become the target
A typical business system puts the application at the edge and the database behind it. That placement makes reaching the database directly harder, with the side effect that defenses tend to be thinner once something does reach it. Updates get deferred on the assumption that being on the inside is protection enough. An addition to KEV is evidence that the assumption failed somewhere in the real world.
3A three-day remediation date
KEV listing was 2026-08-26 and the due date is 2026-08-29 — three days. Other KEV entries this site holds as of 2026-08-28, added around the same time, carry two-week dates. Because deadlines under BOD 26-04 are set according to risk, a single catalog now contains different levels of urgency side by side. The number of days is itself information about how heavily an entry is being treated.
4The layer facing outward, and the layer placed inside
In a business system the application faces outward while the database sits inside. That arrangement thickens the defence and produces a different weakness.
Addition to KEV shows that the assumption of inner safety was actually observed failing. Added on 26 August 2026 with a remediation date of 29 August, the grace period is three days. A database server is the layer where downtime is hardest to arrange and updates fall furthest behind, and three days means that unless the patching procedure is settled in peacetime it physically cannot be met.
Why it matters
Database servers are hard to schedule downtime for, so updates slip, while the value of what they hold is the highest in the estate. With remediation deadlines now measured in days, meeting one requires that ownership, approval, downtime coordination, and rollback steps are agreed before the event. Taking inventory of what privileges service accounts have been granted is equally practical for estimating blast radius.
FAQ
What is "the service account context"?
Is a database on the internal network not safe?
Why is the deadline three days?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).