Skip to the content
The Update Bureau
SQL Server 2022 GDR SQL Server 2022 GDR Security update
Patch Tuesday

KB5063756

KB5063756: Security update for SQL Server 2022, GDR branch, August 2025. Stored procedure and SQL Agent privilege flaws fixed

In short

The update fixes five Important-severity SQL Server vulnerabilities, including flaws involving SQL injection and elevation of privilege.

Does it affect you? Applies to: SQL Server 2022 GDR installations are affected. The update package is for x64 systems; the listed fixes apply to all platforms except one Security Infrastructure fix that applies to Windows.

Build
16.0.1145.1
Servicing branch
GDR
Security
5 fixed
Restart
Required

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fixes 6 changes

High Availability and Disaster Recovery

  • A SQL injection vulnerability in a system stored procedure is fixed.1
    Fix area: SQL Server Engine. Platform: All.

Metadata

  • A SQL injection vulnerability in a system stored procedure is fixed.2
    Fix area: SQL Server Engine. Platform: All.

Security Infrastructure

2 items
  • A vulnerability in certain stored procedures that could let users run arbitrary code with elevated privileges is fixed.3
    Fix area: SQL Server Engine. Platform: Windows.
  • Logins with ALTER ANY LOGIN permission can no longer reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions.4
    Prevents elevation of privilege. Platform: All.

SQL Agent

  • Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.5
    Platform: All.

SQL Server Engine

  • A vulnerability in certain stored procedures that could let users run arbitrary code with elevated privileges is fixed.6
    Fix area: SQL Server Engine. Platform: All.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-08-12
Classification
Security Updates
Type
Cumulative update
Servicing branch
GDR
Restart
Required
Replaces
KB5058712, KB5046861, KB5046057, KB5042211
+3 earlier KB5040936, KB5035432, KB5032968
Replaced by
KB5065221
VersionBuildChannel
2022 16.0.1145.1 General availability

Security

5 vulnerabilities fixed
5 important
VulnerabilitySeverityCVSS
CVE-2025-24999
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2025-47954
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2025-49758
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2025-49759
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2025-53727
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8

Downloads (Microsoft Update Catalog)

Package 2022
331.6 MB
sqlserver2022-kb5063756-x64.exe Main update · KB5063756 SHA-1: 76edab13…20c0df

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. Fixes a SQL injection vulnerability in a system stored procedure. support.microsoft.com
  2. 2. Fixes a SQL injection vulnerability in a system stored procedure. support.microsoft.com
  3. 3. Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges. support.microsoft.com
  4. 4. Prevents logins with the ALTER ANY LOGIN permission from resetting the passwords of logins that have ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions to avoid elevation of privilege. support.microsoft.com
  5. 5. Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions. support.microsoft.com
  6. 6. Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake