SQL Server, WordPress Avada, and Gitea Under Active Exploitation

Three critical vulnerabilities are being actively exploited in the wild, all with patches available. Microsoft SQL Server’s CVE-2019-1068, a remote code execution flaw first patched in 2019, remains weaponised against unpatched systems seven years later. WordPress sites running the Avada theme and Fusion Builder plugin face a 9.8-rated vulnerability (CVE-2026-18431) allowing unauthenticated attackers to achieve full site compromise. Gitea, the self-hosted Git service, is being targeted via CVE-2026-60004, enabling arbitrary code execution through malicious Git hooks. CISA has confirmed all three as actively exploited. This episode explains the technical impact of each vulnerability, identifies the patched versions required, and sets out immediate actions for UK small businesses: verifying SQL Server patch status with IT providers, updating WordPress components to Avada 7.17 and Fusion Builder 3.17, auditing Gitea instances, and formalising patch management processes to meet Cyber Essentials requirements and avoid ICO enforcement action.

Chapters

• Intro Corrine introduces today’s briefing on three actively exploited vulnerabilities from CISA’s Known Exploited Vulnerabilities catalogue, highlighting a troubling pattern: attackers still successfully exploit a seven-year-old SQL Server flaw because patch management remains broken across organisations.
• SQL Server: A Seven-Year-Old Wound That’s Still Bleeding CVE-2019-1068 allows remote code execution on Microsoft SQL Server instances. Despite a patch being available since 2019, CISA confirms active exploitation in 2026. Businesses must verify patch status immediately with IT providers and document responses in writing.
• CTA Corrine asks listeners to follow, rate, review, and share the show, especially with those managing WordPress sites or SQL Server instances who need to act today.
• WordPress: Avada, Fusion Builder, and a 9.8 You Can’t Ignore CVE-2026-18431 affects the widely used Avada theme and Fusion Builder plugin, scoring 9.8 on CVSS. Unauthenticated attackers can achieve remote code execution. Both Avada 7.17 and Fusion Builder 3.17 must be installed. TranslatePress CVE-2026-19632 is also flagged. Automated scanners are already probing for these flaws at scale.
• Gitea: The Developer Tool That’s Now a Target CVE-2026-60004 allows arbitrary code execution on self-hosted Gitea instances via malicious Git hooks. If open registration is enabled, unauthenticated visitors can achieve full compromise. Businesses should audit whether development partners use Gitea and confirm patching status.
• Making the Practical Case Corrine outlines three arguments for prioritising patches: exploitation costs exceed patching costs, CISA’s KEV catalogue confirms real attacks not theoretical risk, and patch management is auditable under Cyber Essentials. The ICO treats unpatched known vulnerabilities as negligence.
• What to Do Before Friday Specific actions: check WordPress installations for Avada, Fusion Builder, and TranslatePress versions; verify SQL Server patch status in writing; audit Gitea exposure with development partners; enable automatic updates where practical; request patch status reports from MSPs.
• Outro Corrine closes with the core message: patch management is the most impactful, accessible action small businesses can take. All three vulnerabilities are fixable before Friday if action is taken today.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068
• https://nvd.nist.gov/vuln/detail/CVE-2026-18431
• https://nvd.nist.gov/vuln/detail/CVE-2026-60004
• https://nvd.nist.gov/vuln/detail/CVE-2026-19632
• https://www.ncsc.gov.uk/cyberessentials/overview
• https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/