KB5063760: Security update for SQL Server 2017, GDR branch, August 2025. SQL injection and login privilege-escalation flaws addressed

Addresses four Important vulnerabilities in SQL Server 2017, including SQL injection and elevation-of-privilege flaws.

Does it affect you? Applies to: SQL Server 2017 installations on supported x64 systems. The update applies to SQL Server 2017 or a SQL Server 2017 GDR release through this update.

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fixes 4 changes

High Availability and Disaster Recovery

For: All SQL Server platforms

A system stored procedure can no longer be used for SQL injection.¹
Fixes a SQL injection vulnerability in a system stored procedure.

Security Infrastructure

For: All SQL Server platforms

Certain logins can no longer reset passwords in a way that could lead to elevated privileges.²
Logins with ALTER ANY LOGIN permission cannot reset the passwords of logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions.

SQL Agent

For: All SQL Server platforms

Built-in SQL Agent job steps run with reduced permissions to help prevent elevated access.³
Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions.

SQL Server Engine

For: All SQL Server platforms

Access to certain stored procedures no longer enables SQL injection and arbitrary code execution with elevated privileges.⁴
Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-08-12
Classification: Security Updates
Type: Cumulative update
Servicing branch: GDR
Restart: Required
Replaces: KB5058716, KB5046857, KB5046058, KB5042217, KB5040942
Replaced by: KB5065224

Version	Build	Channel
2017	14.0.2080.1	General availability

Security

4 vulnerabilities fixed

4 important

Vulnerability	Severity	CVSS
CVE-2025-24999 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2025-49758 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2025-49759 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2025-53727 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8

Downloads (Microsoft Update Catalog)

Package 2017

450.9 MB

sqlserver2017-kb5063760-x64.exe Main update · KB5063760 SHA-1: 9e35296a…0e9d79

Sources

Microsoft Support: KB5063760

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (4)

1. Fixes a SQL injection vulnerability in a system stored procedure. support.microsoft.com
2. Prevents logins with the ALTER ANY LOGIN permission from resetting the passwords of logins that have ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions to avoid elevation of privilege. support.microsoft.com
3. Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions. support.microsoft.com
4. Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake