KB5063761: Security update for SQL Server 2016, Azure Connect Feature Pack branch, August 2025. SQL injection and privilege-escalation flaws addressed in the engine

Four Important SQL Server vulnerabilities are addressed, including SQL injection and elevation-of-privilege risks. The fixes also restrict login password resets and reduce permissions for built-in SQL Agent jobs.

Does it affect you? Applies to: Supported x64 devices running SQL Server 2016 SP3 Azure Connect Feature Pack. Installing the update is optional on computers that do not host Microsoft SQL Server Reporting Services.

For servers on the Azure Connect Feature Pack of Service Pack 3, the branch with fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 4 changes

High Availability and Disaster Recovery

A SQL injection vulnerability in a system stored procedure is addressed.¹
Bug reference 4424551.

Security Infrastructure

Logins with ALTER ANY LOGIN can no longer use that permission to reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions.²
Prevents elevation of privilege by restricting password resets involving logins with these permissions. Bug reference 4432606.

SQL Agent

Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.³
Bug reference 4435176.

SQL Server Engine

A vulnerability that could let users with access to certain stored procedures run SQL injection and arbitrary code with elevated privileges is addressed.⁴
Bug reference 4286285.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-08-12
Classification: Security Updates
Type: Cumulative update
Servicing branch: Azure Connect Feature Pack
Restart: Required
Replaces: KB5058717, KB5046856, KB5046062, KB5042209, KB5040944
Replaced by: KB5065227

Version	Build	Channel
2016	13.0.7060.1	General availability

Security

4 vulnerabilities fixed

4 important

Vulnerability	Severity	CVSS
CVE-2025-24999 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2025-49758 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2025-49759 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2025-53727 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8

Downloads (Microsoft Update Catalog)

Package 2016

482.5 MB

sqlserver2016-kb5063761-x64.exe Main update · KB5063761 SHA-1: 776524b8…65a200

Sources

Microsoft Support: KB5063761

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (4)

1. Fixes a SQL injection vulnerability in a system stored procedure. support.microsoft.com
2. Prevents logins with the ALTER ANY LOGIN permission from resetting the passwords of logins that have ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions to avoid elevation of privilege. support.microsoft.com
3. Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions. support.microsoft.com
4. Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake