{
  "document" : {
    "aggregate_severity" : {
      "text" : "hoch"
    },
    "category" : "csaf_base",
    "csaf_version" : "2.0",
    "distribution" : {
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "de-DE",
    "notes" : [ {
      "category" : "legal_disclaimer",
      "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen."
    }, {
      "category" : "description",
      "text" : "Der Microsoft SQL Server ist ein relationales Datenbankmanagementsystem von Microsoft.",
      "title" : "Produktbeschreibung"
    }, {
      "category" : "summary",
      "text" : "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Microsoft SQL Server 2014, Microsoft SQL Server 2016 und Microsoft SQL Server 2017 ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.",
      "title" : "Angriff"
    }, {
      "category" : "general",
      "text" : "- Windows",
      "title" : "Betroffene Betriebssysteme"
    } ],
    "publisher" : {
      "category" : "other",
      "contact_details" : "csaf-provider@cert-bund.de",
      "name" : "Bundesamt für Sicherheit in der Informationstechnik",
      "namespace" : "https://www.bsi.bund.de"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "WID-SEC-W-2026-3035 - CSAF Version",
      "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2019/wid-sec-w-2026-3035.json"
    }, {
      "category" : "self",
      "summary" : "WID-SEC-2026-3035 - Portal Version",
      "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3035"
    }, {
      "category" : "external",
      "summary" : "Microsoft Leitfaden für Sicherheitsupdates vom 2019-07-09",
      "url" : "https://portal.msrc.microsoft.com/de-de/security-guidance"
    }, {
      "category" : "external",
      "summary" : "CISA KEV CVE-2019-1068 vom 2026-08-26",
      "url" : "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2019-1068&field_date_added_wrapper=all&field_cve=&sort_by=field_date_added&items_per_page=20&url"
    } ],
    "source_lang" : "en-US",
    "title" : "Microsoft SQL Server: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes",
    "tracking" : {
      "current_release_date" : "2026-08-26T22:00:00.000+00:00",
      "generator" : {
        "date" : "2026-08-27T05:56:10.626+00:00",
        "engine" : {
          "name" : "BSI-WID",
          "version" : "1.6.0"
        }
      },
      "id" : "WID-SEC-W-2026-3035",
      "initial_release_date" : "2019-07-09T22:00:00.000+00:00",
      "revision_history" : [ {
        "date" : "2019-07-09T22:00:00.000+00:00",
        "number" : "1",
        "summary" : "Initiale Fassung"
      }, {
        "date" : "2026-08-26T22:00:00.000+00:00",
        "number" : "2",
        "summary" : "Schwachstelle wird ausgenutzt"
      } ],
      "status" : "final",
      "version" : "2"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_version",
          "name" : "for x64-based Systems Service Pack 2 (CU+GDR)",
          "product" : {
            "name" : "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (CU+GDR)",
            "product_id" : "T014497",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:microsoft:sql_server_2016:f"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "for x64-based Systems Service Pack 2 (GDR)",
          "product" : {
            "name" : "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
            "product_id" : "T014498",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:microsoft:sql_server_2016:f"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "for x64-based Systems Service Pack 1 (CU+GDR)",
          "product" : {
            "name" : "Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (CU+GDR)",
            "product_id" : "T014500",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:microsoft:sql_server_2016:f"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "for x64-based Systems Service Pack 1 (GDR)",
          "product" : {
            "name" : "Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR)",
            "product_id" : "T014501",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:microsoft:sql_server_2016:f"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "SQL Server 2016"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "for x64-based Systems (GDR)",
          "product" : {
            "name" : "Microsoft SQL Server 2017 for x64-based Systems (GDR)",
            "product_id" : "T014493",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:microsoft:sql_server_2017:f"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "for x64-based Systems (CU+GDR)",
          "product" : {
            "name" : "Microsoft SQL Server 2017 for x64-based Systems (CU+GDR)",
            "product_id" : "T014494",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:microsoft:sql_server_2017:f"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "SQL Server 2017"
      } ],
      "category" : "vendor",
      "name" : "Microsoft"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2019-1068",
    "product_status" : {
      "known_affected" : [ "T014493", "T014500", "T014501", "T014498", "T014497", "T014494" ]
    },
    "release_date" : "2019-07-09T22:00:00.000+00:00",
    "title" : "CVE-2019-1068"
  } ]
}