The Update BureauKB5063757: Security update for SQL Server 2019, CU branch, August 2025. Stored procedures and SQL Agent jobs get privilege protections
The update fixes four Important SQL Server vulnerabilities, including SQL injection and elevation-of-privilege flaws involving stored procedures, logins, and SQL Agent jobs.
Does it affect you? Applies to: Systems running SQL Server 2019. The listed security update package is for supported x64-based versions.
For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?
What changes
Fixes 4 changes
High Availability and Disaster Recovery
-
A SQL injection vulnerability in a system stored procedure is fixed.1
Fixes the SQL injection vulnerability listed under the SQL Server Engine fix area.
Security Infrastructure
-
Logins with certain permissions can no longer reset passwords for other logins that have powerful login-management or impersonation permissions.2
Prevents logins with
ALTER ANY LOGINfrom resetting passwords for logins withALTER ANY LOGINorIMPERSONATE ANY LOGINpermissions.
SQL Agent
-
Built-in SQL Agent jobs run with reduced permissions to help prevent privilege escalation.3
Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions.
SQL Server Engine
-
A vulnerability that could let users run arbitrary code with elevated privileges through certain stored procedures is fixed.4
Fixes a vulnerability that lets users with access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-08-12
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- CU
- Restart
- Required
- Replaces
- KB5058722, KB5054833, KB5049296, KB5049235
- Replaced by
- KB5065222
| Version | Build | Channel |
|---|---|---|
| 2019 | 15.0.4440.1 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
Downloads (Microsoft Update Catalog)
Sources
Cited passages from Microsoft's official notes (4)
-
1.
Fixes a SQL injection vulnerability in a system stored procedure.
support.microsoft.com -
2.
Prevents logins with the ALTER ANY LOGIN permission from resetting the passwords of logins that have ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions to avoid elevation of privilege.
support.microsoft.com -
3.
Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions.
support.microsoft.com -
4.
Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake