KB5065227: Security update for SQL Server 2016, Azure Connect Feature Pack branch, September 2025. DMV data exposure and temporal cleanup flaws fixed

The update fixes SQL Server vulnerabilities involving sensitive statement text, temporal-table cleanup and Newtonsoft.Json. One vulnerability, CVE-2024-21907, is publicly disclosed.

Does it affect you? Applies to: SQL Server 2016 SP3 systems with the Azure Connect Feature Pack installed. The update package is for x64-based versions.

For servers on the Azure Connect Feature Pack of Service Pack 3, the branch with fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 4 changes

Integration Services

Integration Services uses an updated Newtonsoft.Json component to address a vulnerability.¹
Upgrades Newtonsoft.json.dll to version 13.0.1 to fix CVE-2024-21907.

Master Data Services

Master Data Services uses an updated Newtonsoft.Json component to address a vulnerability.²
Upgrades Newtonsoft.json.dll to version 13.0.1 to fix CVE-2024-21907.

Programmability

In specific scenarios, sensitive data in statements running in other sessions is protected from inspection.³
Fixes scenarios in which DMVs are used to inspect the text of statements running in other sessions that might contain sensitive data.

Temporal

Input validation during temporal history table cleanup is fixed, closing a path that could let attackers with elevated privileges run SQL code.⁴
Fixes improper input validation during internal temporal history table cleanup.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-09-09
Classification: Security Updates
Type: Cumulative update
Servicing branch: Azure Connect Feature Pack
Restart: Required
Replaces: KB5063761, KB5058717, KB5046856, KB5046062

+2 earlier
KB5042209, KB5040944
Replaced by: KB5068400

Version	Build	Channel
2016	13.0.7065.1	General availability

Security

3 vulnerabilities fixed

2 important 1 not rated

Vulnerability	Severity	CVSS
CVE-2025-55227 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2025-47997 Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5
CVE-2024-21907 VulnCheck: CVE-2024-21907 Improper Handling of Exceptional Conditions in Newtonsoft.Json	Not rated	—

Downloads (Microsoft Update Catalog)

Package 2016

507.8 MB

sqlserver2016-kb5065227-x64.exe Main update · KB5065227 SHA-1: 981cfebc…6c6a0d

Updated components

512 files changed since the previous update for the same versions.

Top changed components	Files
SQL Server Engine	77
SQL Server PolyBase	1

Sources

Microsoft Support: KB5065227

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (4)

1. Upgrade Newtonsoft.json.dll version to 13.0.1 on SSIS to fix vulnerability (CVE-2024-21907). support.microsoft.com
2. Upgrade Newtonsoft.json.dll version to 13.0.1 on MDS to fix vulnerability (CVE-2024-21907). support.microsoft.com
3. Fixes an issue in which DMVs are used in specific scenarios to inspect the text of statements that are running in other sessions and might contain sensitive data. support.microsoft.com
4. Fixes improper input validation that occurs during internal temporal history table cleanup and that enables attackers to run SQL code by having elevated privileges. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake