Skip to the content
The Update Bureau
SQL Server 2022 CU21 SQL Server 2022 CU21 Cumulative update

KB5065865

KB5065865: Cumulative update for SQL Server 2022, CU branch, September 2025. SQL injection protections added; parallel SESSION_CONTEXT issue remains

In short

Includes SQL injection and privilege-escalation protections, along with fixes for SQL Server Engine problems. Queries using SESSION_CONTEXT in parallel plans might still return incorrect results or trigger access violation dumps.

Does it affect you? Applies to: SQL Server 2022 instances. The update package is for x64, and the update applies to all supported languages.

Build
16.0.4215.2
Servicing branch
CU
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What changes CU21 fixes a bug where TRUNCATE TABLE WITH PARTITIONS could unexpectedly succeed on a table with nonaligned partitions and cause corruption.

The official sources are linked at the end of the page.

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 17 changes

DB Management

2 items

For: SQL Server 2022 instances

  • Truncating a table with nonaligned partitions no longer succeeds unexpectedly and causes corruption.1
    Fixes the behavior of TRUNCATE TABLE WITH PARTITIONS on a table with nonaligned partitions.
  • DBCC CHECKDB no longer reports the described inconsistency after an index or table is dropped from a database originating from Azure SQL Managed Instance.17
    Fixes the known issue involving DBCC CHECKDB after dropping an index or a table that includes an index from a database that originated from Azure SQL Managed Instance.

High Availability and Disaster Recovery

2 items
  • The primary replica of an availability group no longer encounters this assertion dump issue.2
    Fixes an assertion dump related to the expression shown in the description.
  • A SQL injection vulnerability in a system stored procedure is fixed.3
    Fixes a SQL injection vulnerability in a system stored procedure.

Linux

For: SQL Server 2022 on Linux

  • SQL Server on Linux no longer terminates in the described encrypted TLS/SSL communication scenario.4
    Fixes termination when sending encrypted TLS/SSL data to a peer after receiving an alert such as bad_record_mac.

Metadata

For: SQL Server 2022 instances

  • A SQL injection vulnerability in a system stored procedure is fixed.5
    Fixes a SQL injection vulnerability in a system stored procedure.

Programmability

2 items

For: SQL Server 2022 instances

  • Inspecting statements running in other sessions no longer exposes sensitive data in the described scenarios.6
    Fixes scenarios in which DMVs are used to inspect text of statements running in other sessions that might contain sensitive data.
  • Queries that use TRIM no longer encounter the described access violation dump.7
    Fixes ACCESS_VIOLATION_c0000005_sqllang.dll!CScaOp_Intrinsic::FConvertToText_Intrinsic when queries use the TRIM intrinsic.

Query Optimizer

For: SQL Server 2022 instances

  • TRY_CONVERT no longer returns invalid results in the described query-plan scenario.8
    Fixes invalid results from TRY_CONVERT when the plan uses the Clustered Index Seek operator.

Replication

2 items
  • Change tracking cleanup no longer blocks user-triggered column changes to a table.9
    Fixes the change tracking auto cleanup process blocking user-triggered ALTER TABLE column-level DDL operations (ADD/DROP/ALTER COLUMN).
  • Adding a merge agent works when a subscription uses a nondefault port.10
    Fixes merge agent creation failing with Msg 2560 when the subscription uses a nondefault port.

Security Infrastructure

2 items

For: SQL Server 2022 instances

  • Logins with ALTER ANY LOGIN can no longer reset passwords for logins with the listed permissions to elevate privileges.11
    Prevents password resets for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions by logins that have ALTER ANY LOGIN permission.
  • Running sp_describe_first_result_set on the ledger digest locations view no longer causes the described access violation.12
    Fixes an access violation when running sp_describe_first_result_set on sys.database_ledger_digest_locations.

SQL Agent

For: SQL Server 2022 instances using SQL Agent

  • Built-in SQL Agent jobs with reduced permissions no longer allow elevation of privilege through their job steps.13
    Prevents elevation of privilege by running SQL Agent job steps for built-in jobs that have reduced permissions.

SQL Server Engine

2 items

For: SQL Server 2022 instances

  • A vulnerability that could let users run SQL injection and arbitrary code with elevated privileges is fixed.14
    Fixes a vulnerability involving access to certain stored procedures and elevated privileges.
  • URLs in certain error messages are corrected.15
    Fixes URLs in certain error messages, including errors 14130 and 14131.

Storage Management

For: SQL Server 2022 instances

  • Log files no longer shrink below the specified target size in the described scenarios.16
    Fixes log files shrinking beyond the specified target size under certain operations when running DBCC SHRINKFILE.

Known issues

  1. Open Affects: Everyone

    Incorrect behavior of SESSION_CONTEXT in parallel plans

    Queries that use SESSION_CONTEXT might return incorrect results or trigger access violation dumps when run in parallel query plans, particularly if the session is reset for reuse.18

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-09-11
Classification
Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5059390, KB5054531, KB5050771, KB5048038
+6 earlier KB5048033, KB5041321, KB5038325, KB5036432, KB5033663, KB5032679
Replaced by
KB5068406
VersionBuildChannel
2022 16.0.4215.2 General availability

Security

No vulnerabilities are listed for this update.

Downloads (Microsoft Update Catalog)

Package 2022
462.6 MB
sqlserver2022-kb5065865-x64.exe Main update · KB5065865 SHA-1: d3f857bf…f394e0

Sources

Updated
Cited passages from Microsoft's official notes (18)
  1. 1. Fixes an issue in which running the TRUNCATE TABLE WITH PARTITIONS statement on a table that has nonaligned partitions succeeds unexpectedly and causes corruption. support.microsoft.com
  2. 2. Fixes an assertion dump issue on the primary replica of an availability group that's related to the expression support.microsoft.com
  3. 3. Fixes a SQL injection vulnerability in a system stored procedure. support.microsoft.com
  4. 4. Fixes a SQL Server on Linux termination issue that you might encounter when you try to send encrypted TLS/SSL data to a peer after receiving an alert such as bad_record_mac from the peer. support.microsoft.com
  5. 5. Fixes a SQL injection vulnerability in a system stored procedure. support.microsoft.com
  6. 6. Fixes an issue in which DMVs are used in specific scenarios to inspect the text of statements that are running in other sessions and might contain sensitive data. support.microsoft.com
  7. 7. Fixes an access violation dump issue that you encounter in ACCESS_VIOLATION_c0000005_sqllang.dll!CScaOp_Intrinsic::FConvertToText_Intrinsic when you run queries that use the TRIM intrinsic. support.microsoft.com
  8. 8. Fixes an issue in which the TRY_CONVERT function might cause invalid results when the plan uses the Clustered Index Seek operator. support.microsoft.com
  9. 9. Fixes an issue in which the change tracking auto cleanup process blocks the user triggered ALTER TABLE column-level DDL (ADD/DROP/ALTER COLUMN) operations. support.microsoft.com
  10. 10. Fixes an issue in which adding a merge agent fails and generates the following error message if the subscription uses a nondefault port support.microsoft.com
  11. 11. Prevents logons that have the ALTER ANY LOGIN permission from resetting the passwords of logons that have ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions to avoid elevation of privilege. support.microsoft.com
  12. 12. Fixes an access violation that you encounter when you run sp_describe_first_result_set on sys.database_ledger_digest_locations. support.microsoft.com
  13. 13. Prevents elevation of privilege by running SQL Agent job steps for built-in jobs that have reduced permissions. support.microsoft.com
  14. 14. Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges. support.microsoft.com
  15. 15. Fixes URLs in certain error messages (for example, error 14130 and error 14131). support.microsoft.com
  16. 16. Fixes an issue in which the log files shrink beyond the specified target size under certain operations when you run the DBCC SHRINKFILE command. support.microsoft.com
  17. 17. Fixes a known issue that causes the DBCC CHECKDB command to report an inconsistency after you drop an index or a table that includes an index from a database that originated from Azure SQL Managed Instance. support.microsoft.com
  18. 18. Queries that use the built-in SESSION_CONTEXT function might return incorrect results or trigger access violation (AV) dump files when run in parallel query plans. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 18 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake