Skip to the content
The Update Bureau
SQL Server 2022 CU20 + GDR SQL Server 2022 CU20 + GDR Security update
Patch Tuesday

KB5063814

KB5063814: Security update for SQL Server 2022, CU branch, August 2025. SQL injection flaws and login-permission escalation blocked

In short

The update addresses five Important SQL Server vulnerabilities, all involving elevation of privilege. It also changes protections for SQL injection, login password resets, and SQL Agent job steps.

Does it affect you? Applies to: SQL Server 2022 installations. The security update package is for supported x64-based versions; SQL Server 2022 or a CU through CU20 GDR must already be installed.

Build
16.0.4210.1
Servicing branch
CU
Security
5 fixed
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 6 changes

High Availability and Disaster Recovery

For: SQL Server 2022 instances

  • SQL injection through a system stored procedure is blocked.1
    Fixes a SQL injection vulnerability in a system stored procedure.

Metadata

For: SQL Server 2022 instances

  • SQL injection through a system stored procedure is blocked.2
    Fixes a SQL injection vulnerability in a system stored procedure.

Security Infrastructure

2 items
  • Users with access to certain stored procedures can no longer use them to run arbitrary code with elevated privileges.3
    Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges. Applies to Windows.
  • A login with ALTER ANY LOGIN permission can no longer reset the passwords of logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions.4
    Prevents elevation of privilege by restricting password resets involving logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions.

SQL Agent

For: SQL Server 2022 instances

  • Built-in SQL Agent jobs run with reduced permissions, limiting the chance that their job steps can be used to gain privileges.5
    Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions.

SQL Server Engine

For: SQL Server 2022 instances

  • Users with access to certain stored procedures can no longer use them to run arbitrary code with elevated privileges.6
    Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-08-12
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5059390, KB5058721, KB5054531, KB5050771
+13 earlier KB5048038, KB5048033, KB5046862, KB5046059, KB5041321, KB5042578, KB5038325, KB5040939, KB5036432, KB5036343, KB5033663, KB5032679, KB5033592
Replaced by
KB5065220
VersionBuildChannel
2022 16.0.4210.1 General availability

Security

5 vulnerabilities fixed
5 important
VulnerabilitySeverityCVSS
CVE-2025-24999
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2025-47954
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2025-49758
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2025-49759
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2025-53727
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8

Downloads (Microsoft Update Catalog)

Package 2022
461.5 MB
sqlserver2022-kb5063814-x64.exe Main update · KB5063814 SHA-1: 313d8d9a…223e32

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. Fixes a SQL injection vulnerability in a system stored procedure. support.microsoft.com
  2. 2. Fixes a SQL injection vulnerability in a system stored procedure. support.microsoft.com
  3. 3. Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges. support.microsoft.com
  4. 4. Prevents logins with the ALTER ANY LOGIN permission from resetting the passwords of logins that have ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions to avoid elevation of privilege. support.microsoft.com
  5. 5. Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions. support.microsoft.com
  6. 6. Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake