Skip to the content
The Update Bureau
SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update
Patch Tuesday

KB5063762

KB5063762: Security update for SQL Server 2016, GDR branch, August 2025. Stored-procedure SQL injection and login privilege flaws blocked

In short

Fixes four Important SQL Server vulnerabilities, including flaws that could allow SQL injection or elevation of privilege.

Does it affect you? Applies to: Devices running SQL Server 2016 SP3 GDR, including x64 installations. SQL Server 2016 SP3 or a SQL Server 2016 SP3 GDR release is required.

Build
13.0.6465.1
Servicing branch
GDR
Security
4 fixed
Restart
Required

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fixes 4 changes

High Availability and Disaster Recovery

  • A SQL injection vulnerability in a system stored procedure is fixed.1
    Bug reference 4424552.

Security Infrastructure

  • Logins with ALTER ANY LOGIN permission can no longer reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions in a way that could lead to elevation of privilege.2
    Bug reference 4432610.

SQL Agent

  • Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.3
    Bug reference 4435177.

SQL Server Engine

  • A vulnerability that could let users with access to certain stored procedures perform SQL injection and run arbitrary code with elevated privileges is fixed.4
    Bug reference 4286296.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-08-12
Classification
Security Updates
Type
Cumulative update
Servicing branch
GDR
Restart
Required
Replaces
KB5058718, KB5046855, KB5046063, KB5042207, KB5040946
Replaced by
KB5065226
VersionBuildChannel
2016 13.0.6465.1 General availability

Security

4 vulnerabilities fixed
4 important
VulnerabilitySeverityCVSS
CVE-2025-24999
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2025-49758
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2025-49759
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2025-53727
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8

Downloads (Microsoft Update Catalog)

Package 2016
485.4 MB
sqlserver2016-kb5063762-x64.exe Main update · KB5063762 SHA-1: 114d95bf…8b100f

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. Fixes a SQL injection vulnerability in a system stored procedure. support.microsoft.com
  2. 2. Prevents logins with the ALTER ANY LOGIN permission from resetting the passwords of logins that have ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions to avoid elevation of privilege. support.microsoft.com
  3. 3. Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions. support.microsoft.com
  4. 4. Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake