KB5065225: Security update for SQL Server 2017, CU branch, September 2025. Sensitive SQL statement text and temporal cleanup flaws fixed

Fixes three SQL Server vulnerabilities, including issues that could expose sensitive statement text or let attackers with elevated privileges run SQL code during temporal-history cleanup. CVE-2024-21907 is publicly disclosed.

Does it affect you? Applies to: SQL Server 2017 instances with SQL Server 2017 or a CU release through CU31 GDR installed. The listed package is for x64; the fixes cover Windows and Linux as indicated in the fix list.

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 4 changes

Integration Services

Integration Services gets an updated Newtonsoft.Json library to fix a vulnerability.¹
Updates Newtonsoft.json.dll to version 13.0.1 to fix CVE-2024-21907.

Master Data Services

Master Data Services gets an updated Newtonsoft.Json library to fix a vulnerability.²
Updates Newtonsoft.json.dll to version 13.0.1 to fix CVE-2024-21907.

Programmability

Fixes the issue that let DMVs inspect statement text running in other sessions in specific scenarios, where that text might contain sensitive data.³
Applies to Linux and Windows.

Temporal

Fixes improper input validation during temporal history table cleanup that could let attackers with elevated privileges run SQL code.⁴
Applies to Linux and Windows.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-09-09
Classification: Security Updates
Type: Cumulative update
Servicing branch: CU
Restart: Required
Replaces: KB5063759, KB5058714, KB5050533, KB5046858

+3 earlier
KB5046061, KB5042215, KB5040940
Replaced by: KB5068402

Version	Build	Channel
2017	14.0.3505.1	General availability

Security

3 vulnerabilities fixed

2 important 1 not rated

Vulnerability	Severity	CVSS
CVE-2025-55227 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2025-47997 Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5
CVE-2024-21907 VulnCheck: CVE-2024-21907 Improper Handling of Exceptional Conditions in Newtonsoft.Json	Not rated	—

Downloads (Microsoft Update Catalog)

Package 2017

542.9 MB

sqlserver2017-kb5065225-x64.exe Main update · KB5065225 SHA-1: d30d387b…74e8ae

Updated components

126 files changed since the previous update for the same versions.

Top changed components	Files
SQL Server Engine	94
SQL Server PolyBase	2

Sources

Microsoft Support: KB5065225

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (4)

1. Upgrade Newtonsoft.json.dll version to 13.0.1 on SSIS to fix vulnerability (CVE-2024-21907) support.microsoft.com
2. Upgrade Newtonsoft.json.dll version to 13.0.1 on MDS to fix vulnerability (CVE-2024-21907). support.microsoft.com
3. Fixes an issue in which DMVs are used in specific scenarios to inspect the text of statements that are running in other sessions and might contain sensitive data. support.microsoft.com
4. Fixes improper input validation that occurs during internal temporal history table cleanup and that enables attackers to run SQL code by having elevated privileges. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake