The Update BureauKB5063758: Security update for SQL Server 2019, GDR branch, August 2025. Stored procedure, login, and SQL Agent privilege flaws blocked
In short
The update fixes four Important SQL Server vulnerabilities involving SQL injection and elevation of privilege. None is listed as critical, exploited, or publicly disclosed.
Does it affect you? Applies to: SQL Server 2019 systems running a GDR release through this update. The package is for x64-based systems.
For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?
What changes
Fixes 4 changes
High Availability and Disaster Recovery
-
A system stored procedure no longer has the SQL injection vulnerability addressed by this fix.1
Fixes a SQL injection vulnerability in a system stored procedure.
Security Infrastructure
-
Logins with ALTER ANY LOGIN permission can no longer reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions.2
Prevents elevation of privilege by blocking these password resets.
SQL Agent
-
Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.3
Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions.
SQL Server Engine
-
Users with access to certain stored procedures can no longer use them to run arbitrary code with elevated privileges.4
Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-08-12
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- GDR
- Restart
- Required
- Replaces
- KB5058713, KB5046859, KB5046056, KB5042214
- Replaced by
- KB5065223
| Version | Build | Channel |
|---|---|---|
| 2019 | 15.0.2140.1 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
Downloads (Microsoft Update Catalog)
Package
2019
506.5 MB
Sources
Updated
Cited passages from Microsoft's official notes (4)
-
1.
Fixes a SQL injection vulnerability in a system stored procedure.
support.microsoft.com -
2.
Prevents logins with the ALTER ANY LOGIN permission from resetting the passwords of logins that have ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions to avoid elevation of privilege.
support.microsoft.com -
3.
Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions.
support.microsoft.com -
4.
Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake