The Update BureauKB5068402: Security update for SQL Server 2017, CU branch, November 2025. SQL injection protection for backup procedure; RLS filters fixed
The update reduces SQL injection risk in an exposed backup procedure and fixes cases where row-level security filters could be skipped in certain multi-role configurations.
Does it affect you? Applies to: SQL Server 2017 installations on supported x64-based systems, with SQL Server 2017 or a CU through CU31 GDR installed. The update is listed in the Microsoft Update Catalog for servers running SQL Server; installation is optional on computers that do not host Reporting Services.
For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?
What changes
Fixes 2 changes
Analysis Services
-
Row-level security filters are applied consistently in certain multi-role setups where users could otherwise see rows those filters were meant to restrict.1
Resolves bug 4653617. In rare, contradictory configurations, such as a role granting table-level read permission while restricting all columns combined with similarly restrictive roles, RLS filters could be skipped.
Management Services
-
The internal backup procedure sanitizes input and restricts unauthorized access, reducing SQL injection risk.2
Resolves bug 4711201. The hotfix addresses a SQL injection vulnerability in an internal backup stored procedure that was inadvertently exposed to all users. The table lists Linux and Windows platforms.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-11-11
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- CU
- Restart
- Required
- Replaces
- KB5065225, KB5063759, KB5058714, KB5050533
- Replaced by
- KB5077471
| Version | Build | Channel |
|---|---|---|
| 2017 | 14.0.3515.1 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
Downloads (Microsoft Update Catalog)
Updated components
129 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| SQL Server Engine | 94 |
| SQL Server Analysis Services | 5 |
| SQL Server PolyBase | 3 |
Sources
Cited passages from Microsoft's official notes (2)
-
1.
This update resolves an issue in SQL Server Analysis Services where Row-Level Security (RLS) filters could be skipped when combined with Object-Level Security (OLS) and Column-Level Security (CLS) in certain multi-role configurations.
support.microsoft.com -
2.
This hotfix addresses a SQL injection vulnerability in an internal backup stored procedure that was inadvertently exposed to all users.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake