The Update BureauKB5063759: Security update for SQL Server 2017, CU branch, August 2025. SQL injection and SQL Agent privilege-escalation flaws blocked
The update addresses four Important SQL Server vulnerabilities, including SQL injection and privilege-escalation flaws. It also includes the Azure Connect feature pack for SQL Server 2017.
Does it affect you? Applies to: SQL Server 2017 installations. You must have SQL Server 2017 or a SQL Server 2017 CU through CU31 GDR installed. Installing the update is optional on computers that do not host Microsoft SQL Server Reporting Services.
For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?
What changes
Fixes 4 changes
High Availability and Disaster Recovery
-
SQL injection through a system stored procedure is addressed.1
Fixes a SQL injection vulnerability in a system stored procedure.
Security Infrastructure
-
A login with ALTER ANY LOGIN permission can no longer reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions.2
Prevents elevation of privilege by blocking the specified password resets.
SQL Agent
-
Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.3
Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions.
SQL Server Engine
-
Users with access to certain stored procedures can no longer use SQL injection to run arbitrary code with elevated privileges.4
Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-08-12
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- CU
- Restart
- Required
- Replaces
- KB5058714, KB5050533, KB5046858, KB5046061
- Replaced by
- KB5065225
| Version | Build | Channel |
|---|---|---|
| 2017 | 14.0.3500.1 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
Downloads (Microsoft Update Catalog)
Sources
Cited passages from Microsoft's official notes (4)
-
1.
Fixes a SQL injection vulnerability in a system stored procedure.
support.microsoft.com -
2.
Prevents logins with the ALTER ANY LOGIN permission from resetting the passwords of logins that have ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions to avoid elevation of privilege.
support.microsoft.com -
3.
Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions.
support.microsoft.com -
4.
Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake