A 2019 Bug on CISA's 2026 KEV: NC SMB Legacy Server Risk

The short version: On August 26, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, and five of them are between four and eleven years old. One is CVE-2019-1068, a Microsoft SQL Server remote code execution flaw rated CVSS 8.8 that has had a patch available for roughly seven years, per Infosecurity Magazine. If your North Carolina company runs an old SQL Server behind its ERP or line-of-business app, that server just became a documented, actively exploited target, and the fix was sitting in a Microsoft update the whole time.

The uncomfortable part is not that a new zero-day dropped. It is that the bug getting you was patchable in 2019.

Key takeaway: Attackers are working a backlog, not a frontier. CISA said the same week that threat actors are exploiting "simple, known software vulnerabilities that remain persistent in exposed assets," now with AI automating the hunt, per The Hacker News. Automated scanning finds that forgotten SQL box first. CVE-2019-1068 then turns valid database credentials or an existing application foothold into code execution on it.

Not sure what is running on the server that keeps your plant floor moving? Preferred Data Corporation has kept North Carolina manufacturers and distributors running since 1987. Call (336) 886-3282 or request a server and vulnerability review.

What did CISA add to the KEV catalog on August 26, 2026?

CISA added six vulnerabilities, and the age spread is the story. The catalog exists to force a fix: when CISA lists a CVE, it is confirming real-world exploitation, and federal civilian agencies get a hard remediation deadline. On this batch, CVE-2019-1068 (SQL Server) and CVE-2026-8452 (Citrix NetScaler) carried an August 29, 2026 deadline, with the other four due September 9, per The Hacker News.

Here is the batch in full, with the disclosure year that should make any owner uneasy:

CVE	Product	Flaw	CVSS	First disclosed
CVE-2019-1068	Microsoft SQL Server	Remote code execution	8.8	2019
CVE-2026-8452	Citrix NetScaler ADC/Gateway	Memory buffer overflow	8.8	2026
CVE-2021-23758	Ajax.NET Professional	Deserialization	8.1	2021
CVE-2022-0995	Linux kernel	Out-of-bounds write	7.8	2022
CVE-2015-5287	Red Hat ABRT	Privilege escalation	7.8	2015
CVE-2015-3246	Red Hat libuser	Race condition	5.1	2015

CVSS values are from Infosecurity Magazine. Only one of the six was disclosed in 2026. Two date to 2015. For a Piedmont Triad shop that thinks "we patch Windows every month, we are fine," that table is the counterargument: monthly Windows updates do nothing for a decade-old Linux appliance or a SQL Server instance nobody logs into.

Why is a seven-year-old SQL Server bug dangerous now?

Because the server is probably still on, still reachable, and still unpatched, and CVE-2019-1068 lets an attacker who can already authenticate to the database run code as the SQL Server service account. Microsoft shipped the fix in July 2019 and described the flaw as improper handling of internal function processing, per Microsoft's advisory. Seven years later, CISA is listing it as actively exploited, which means unpatched instances are being hit in the wild, not theoretically at risk.

Three things make this land harder for a small NC manufacturer than for a Fortune 500:

The SQL Server behind an ERP, an MRP system, or a shop-floor scheduling app is often the least-touched server you own. It works, so nobody reboots it, and "do not touch the production database" quietly becomes "do not patch the production database."
Older SQL Server builds (2014, 2016, 2017-era) are common in industrial environments where the line-of-business vendor certified one version and never re-certified. A version freeze is not the same thing as being unpatchable: Microsoft shipped the CVE-2019-1068 fix as a servicing update inside those major versions, so a server pinned to SQL Server 2016 can usually take the patch without the upgrade your vendor never certified. Check the installed build number before you conclude you are stuck on an unfixable version.
An attacker running code as the database service account is one hop from your customer records, your pricing, your BOMs, and, if that account is over-privileged, the rest of the domain.

CISA does not mince words about the pattern. Its August advisory tied this batch to threat actors "exploiting simple, known software vulnerabilities that remain persistent in exposed assets," with AI now automating exploitation, per The Hacker News. Automation is why a bug from 2019 is being exploited again in 2026: the cost of finding your forgotten server dropped to near zero.

Key takeaway: An old patch does not mean an old risk. CVE-2019-1068 is on CISA's 2026 KEV catalog because it is being exploited now, seven years after the fix shipped, and a server that never took that update is exactly as exposed today as it was the day the update was skipped.

Does a CISA deadline apply to a private North Carolina business?

No, and that is the trap. The August 29 deadline attached to CVE-2019-1068 binds federal civilian agencies under Binding Operational Directive 26-04, not private companies, per BleepingComputer. A machine shop in Thomasville or a distributor in Winston-Salem has no legal obligation to patch by any date.

The attackers do not read the directive either. The KEV catalog is the closest thing the industry has to a "criminals are using this right now" list, and treating it as an optional government checklist is where small firms get hurt. When CISA lists a CVE, it is not paperwork; it is confirmation that the flaw is being used against real organizations today.

The federal deadline is a floor for agencies, not a ceiling for you. The U.S. government decided its own agencies had to fix CVE-2019-1068 within days because it is being exploited. A 60-person manufacturer with a fraction of that security staff faces the same attackers and should move faster, not assume the rule leaves it out. This is where a local managed IT partner earns its keep: someone whose actual job is to watch the KEV catalog against your specific inventory and act, rather than hoping the box in the closet is not the one being scanned.

Want the KEV catalog checked against your real environment, not a generic list? Call Preferred Data Corporation at (336) 886-3282 to scope a vulnerability management engagement.

How does a small business find the servers it forgot it owns?

You inventory first, then patch, because you cannot protect an asset you cannot see, and a server missing from the spreadsheet is a server nobody is patching. That gap is what makes a seven-year-old patch relevant: the fix existed, but the asset was unmanaged, so nobody applied it. CISA's own framing points the same way, warning that these are "simple, known" flaws "persistent in exposed assets," per The Hacker News. Practical order of operations for an NC SMB:

Discover. Run an actual network scan, not a memory exercise. Every device with an IP, every server, every appliance, physical and virtual. The goal is a list nobody can argue with.
Identify the line-of-business core. Find the SQL Server, the Pervasive/Actian database, the ERP host, the file server the whole company depends on. These are your crown jewels and usually your oldest software.
Cross-reference against the KEV catalog. For each asset, ask a specific question: is anything it runs on the CISA list, and what is its version.
Patch or isolate. Where a patch exists, apply it in a maintenance window. Where the vendor froze you on an unsupported version, segment that server off the flat network so a compromise has far less room to spread, and plan the migration.
Back it up so recovery is real. A tested, offline-capable backup of that database is what turns a breach into an incident instead of a closure. A modern backup and data protection setup is the difference.

The manufacturing reality in the Piedmont Triad is that step 2 keeps finding servers running software the current staff never installed. That is what a 20 or 30-year-old business looks like, and it is exactly why manufacturing IT support has to start with discovery rather than assuming the documentation is right.

Key takeaway: An undocumented server is a server nobody is patching, which is exactly the gap ransomware operators look for. Get the inventory right and every other control finally has something real to protect.

What does Preferred Data Corporation do about legacy server risk?

We treat the KEV catalog as an operational feed, not a news headline, and we map it against what is actually running on a client's network. Since 1987, Preferred Data Corporation has supported manufacturers, distributors, and industrial firms across High Point, Greensboro, Winston-Salem, Charlotte, and the wider 200-mile radius around High Point, and legacy servers are not an edge case in that work, they are the norm.

That means proactive patch management for the systems that can be patched, network segmentation and monitoring for the ones that cannot, and honest migration planning for the SQL Server or application host that a vendor has frozen in place. It also means being local: when a server needs hands-on attention in Kernersville or Lexington, an on-site response inside the Triad beats a national provider routing a ticket. Our managed IT services and cybersecurity work are built for the shop that cannot afford a full-time security team but cannot afford to be the next KEV statistic either.

Ready to find out what is really on your network? Preferred Data Corporation, High Point since 1987. Call (336) 886-3282 or book a server and vulnerability review.

Straight answers for NC business owners

Is my SQL Server definitely compromised if I have not patched CVE-2019-1068?

No, listing on the KEV catalog means the flaw is being exploited in the wild, not that every unpatched server is already breached. It means the probability is now high enough that CISA ordered federal agencies to fix it within days, per The Hacker News. Treat an unpatched, internet-reachable SQL Server as presumed-targeted and check it for unusual activity while you patch.

We run our ERP on an old SQL Server the vendor will not let us upgrade. What now?

Isolate and monitor while you plan. If the line-of-business vendor certified only an old SQL Server version, segment that server off your flat network so a compromise has far less room to spread laterally, restrict which accounts and machines can reach it, and put it under active monitoring. Then start a migration conversation with the vendor, because "frozen forever on an exploited version" is a business risk, not a technical footnote.

How is this different from the AI-found-old-bugs news earlier this year?

Those stories were about AI discovering new, previously unknown flaws hiding in old code. This is the opposite and arguably worse: attackers exploiting flaws that were found and fixed years ago, on servers that never got the fix. We covered the AI-discovery angle separately in our piece on AI-discovered legacy vulnerabilities; this post is about the patch that already exists and was never applied.

Does patching Windows every month cover this?

No. Monthly Windows Update covers the operating system and some Microsoft products, but a SQL Server instance, a Linux appliance, a firewall, or a third-party application often patches on its own separate track or not at all. Five of the six CVEs in this batch were Linux, Red Hat, Citrix, or a .NET library, and only the SQL Server bug was a Microsoft product, per Infosecurity Magazine. Patch coverage has to span every asset, and the desktops are the easy part.

We are a 70-person shop with no full-time IT. Where do we even start?

Start with a network discovery scan and an honest inventory, then have someone map that inventory against the KEV catalog. When a 50 to 100-person Triad manufacturer comes to us without a dedicated IT person, the first thing we run is exactly that discovery scan, and it is a defined, affordable engagement rather than an open-ended project. The KEV additions themselves are public and dated, so this is checkable work, per BleepingComputer. Call (336) 886-3282 and ask for a server and vulnerability review.