The Update BureauKB5065223: Security update for SQL Server 2019, GDR branch, September 2025. DMV data exposure and temporal cleanup flaws fixed
Fixes three vulnerabilities: CVE-2025-47997 (information disclosure), CVE-2025-55227 (elevation of privilege), and publicly disclosed CVE-2024-21907 in Newtonsoft.Json.
Does it affect you? Applies to: SQL Server 2019 installations on the GDR branch. The listed update package is for x64 systems; the fixes table lists Windows and Linux for the SQL Server Engine changes.
Review notes Additional details from the official release notes (1) Read note
- What changes Microsoft's table lists this fix under Master Data Services, but its description says the upgrade is on SSIS. The page does not resolve this mismatch.
The official sources are linked at the end of the page.
For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?
What changes
Fixes 4 changes
Integration Services
-
SSIS uses an updated Newtonsoft.Json component to address CVE-2024-21907.1
Updates
Newtonsoft.json.dllto version 13.0.1 on SSIS.
Master Data Services
-
The Newtonsoft.Json vulnerability is addressed for Master Data Services.1
Updates
Newtonsoft.json.dllto version 13.0.1 on SSIS.
Programmability
-
Fixes a case where statement text inspected through DMVs might contain sensitive data from other sessions.2
Addresses issue 4519083 in specific scenarios involving DMVs used to inspect the text of statements running in other sessions.
Temporal
-
Fixes improper input validation during internal temporal history table cleanup. The flaw enables attackers to run SQL code by having elevated privileges.3
Addresses issue 4537468 in temporal history table cleanup.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-09-09
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- GDR
- Restart
- Required
- Replaces
- KB5063758, KB5058713, KB5046859, KB5046056
- Replaced by
- KB5068405
| Version | Build | Channel |
|---|---|---|
| 2019 | 15.0.2145.1 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Information Disclosure Vulnerability
|
Important | 6.5 |
|
VulnCheck: CVE-2024-21907 Improper Handling of Exceptional Conditions in Newtonsoft.Json
|
Not rated | — |
Downloads (Microsoft Update Catalog)
Updated components
159 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| SQL Server Engine | 121 |
| SQL Server PolyBase | 5 |
Sources
Cited passages from Microsoft's official notes (3)
-
1.
Upgrade Newtonsoft.json.dll version to 13.0.1 on SSIS to fix vulnerability (CVE-2024-21907)
support.microsoft.com -
2.
Fixes an issue in which DMVs are used in specific scenarios to inspect the text of statements that are running in other sessions and might contain sensitive data.
support.microsoft.com -
3.
Fixes improper input validation that occurs during internal temporal history table cleanup and that enables attackers to run SQL code by having elevated privileges.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 4/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake