The Update BureauKB5065222: Security update for SQL Server 2019, CU branch, September 2025. Temporal cleanup flaw and sensitive DMV data exposure fixed
The update addresses three vulnerabilities and four SQL Server issues, including a temporal-cleanup flaw that could let attackers with elevated privileges run SQL code. CVE-2024-21907 is publicly disclosed.
Does it affect you? Applies to: SQL Server 2019 installations on Windows and Linux, with SQL Server 2019 or a SQL Server 2019 CU release through CU32 GDR installed.
For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?
What changes
Fixes 4 changes
Integration Services
-
Integration Services updates Newtonsoft.Json to version 13.0.1 to address a vulnerability.1
Upgrades
Newtonsoft.json.dllto version 13.0.1 in SSIS to address CVE-2024-21907.
Master Data Services
-
Master Data Services updates Newtonsoft.Json to version 13.0.1 to address a vulnerability.2
Upgrades
Newtonsoft.json.dllto version 13.0.1 in MDS to address CVE-2024-21907.
Programmability
-
In specific scenarios, inspecting statements running in other sessions through DMVs might reveal sensitive data; this issue is fixed.3
Fixes bug 4519081 involving DMVs used to inspect the text of statements running in other sessions.
Temporal
-
A validation flaw during temporal history table cleanup that could let attackers with elevated privileges run SQL code is fixed.4
Fixes improper input validation during internal temporal history table cleanup (bug 4537457).
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-09-09
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- CU
- Restart
- Required
- Replaces
- KB5063757, KB5058722, KB5054833, KB5049296
- Replaced by
- KB5068404
| Version | Build | Channel |
|---|---|---|
| 2019 | 15.0.4445.1 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Information Disclosure Vulnerability
|
Important | 6.5 |
|
VulnCheck: CVE-2024-21907 Improper Handling of Exceptional Conditions in Newtonsoft.Json
|
Not rated | — |
Downloads (Microsoft Update Catalog)
Updated components
161 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| SQL Server Engine | 120 |
| SQL Server PolyBase | 5 |
Sources
Cited passages from Microsoft's official notes (4)
-
1.
Upgrade Newtonsoft.json.dll version to 13.0.1 on SSIS to fix vulnerability (CVE-2024-21907).
support.microsoft.com -
2.
Upgrade Newtonsoft.json.dll version to 13.0.1 on MDS to fix vulnerability (CVE-2024-21907).
support.microsoft.com -
3.
Fixes an issue in which DMVs are used in specific scenarios to inspect the text of statements that are running in other sessions and might contain sensitive data.
support.microsoft.com -
4.
Fixes improper input validation that occurs during internal temporal history table cleanup and that enables attackers to run SQL code by having elevated privileges.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake