The Update BureauKB5068400: Security update for SQL Server 2016, Azure Connect Feature Pack branch, November 2025. Backup procedure access restricted to reduce SQL injection risk
The update addresses CVE-2025-59499, an elevation-of-privilege vulnerability, and restricts access to an internal backup procedure to reduce SQL injection risk.
Does it affect you? Applies to: Installations of SQL Server 2016 SP3 with the Azure Connect Feature Pack. The update package is for x64 systems; it is optional on computers that do not host SQL Server Reporting Services.
For servers on the Azure Connect Feature Pack of Service Pack 3, the branch with fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?
What changes
Fix 1 change
Management Services
-
Access to an internal backup procedure is restricted, and its inputs are sanitized to reduce SQL injection risk.1
Bug 4711207 addresses an internal backup stored procedure that was inadvertently exposed to all users. The hotfix restricts unauthorized access and sanitizes input parameters.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-11-11
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- Azure Connect Feature Pack
- Restart
- Required
- Replaces
- KB5065227, KB5063761, KB5058717, KB5046856
- Replaced by
- KB5077473
| Version | Build | Channel |
|---|---|---|
| 2016 | 13.0.7070.1 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
Downloads (Microsoft Update Catalog)
Updated components
518 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| SQL Server Engine | 77 |
Sources
Cited passages from Microsoft's official notes (1)
-
1.
This hotfix addresses a SQL injection vulnerability in an internal backup stored procedure that was inadvertently exposed to all users.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 4/5, clarity 5/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake