KB5063756: Fixes a vulnerability that lets users who have access to certain stored procedures

KB5063756 - Description of the security update for SQL Server 2022 GDR: August 12, 2025

Summary
This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories:

• CVE-2025-47954 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2025-49758 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2025-24999 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2025-49759 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2025-53727 - Microsoft SQL Server Elevation of Privilege Vulnerability

The Microsoft SQL Server components are updated to the following builds in this security update.

• SQL Server - Product version: 16.0.1145.1, file version: 2022.160.1145.1

Improvements and fixes included in this update

• Bug reference: 4429104
  Description: Fixes a SQL injection vulnerability in a system stored procedure.
  Fix area: SQL Server Engine
  Component: High Availability and Disaster Recovery
  Platform: All

- Bug reference: 4419952
Description: Fixes a SQL injection vulnerability in a system stored procedure.
Fix area: SQL Server Engine
Component: Metadata
Platform: All

• Bug reference: 4285841
  Description: Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges.
  Fix area: SQL Server Engine
  Component: Security Infrastructure
  Platform: Windows
• Bug reference: 4424585
  Description: Prevents logins with the ALTER ANY LOGIN permission from resetting the passwords of logins that have ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissions to avoid elevation of privilege.
  Fix area: SQL Server Engine
  Component: Security Infrastructure
  Platform: All
• Bug reference: 4437707
  Description: Prevents elevation of privilege by running SQL Agent job steps for built-in jobs with reduced permissions.
  Fix area: SQL Server Engine
  Component: SQL Agent
  Platform: All
• Bug reference: 4285506
  Description: Fixes a vulnerability that lets users who have access to certain stored procedures perform SQL injection and run arbitrary code by using elevated privileges.
  Fix area: SQL Server Engine
  Component: SQL Server Engine
  Platform: All