[Vulnerability Alert] Microsoft SQL Server has a Critical Security Vulnerability (CVE-2025-59499)

• Subject: [Vulnerability Alert] Microsoft SQL Server has a Critical Security Vulnerability (CVE-2025-59499)
• Content:
  • Forwarded from Taiwan Computer Emergency Response Team/Coordination Center Security Alert TWCERTCC-200-202511-00000010
  • Microsoft issued a major security vulnerability advisory for its product SQL Server (CVE-2025-59499, CVSS: 8.8). This vulnerability is an SQL injection vulnerability that allows an authenticated attacker to inject specially crafted SQL commands over the network and escalate privileges.
• Affected Platforms:
  • Microsoft SQL Server 2019 (GDR) versions 15.0.0 to 15.0.21552
  • Microsoft SQL Server 2016 Service Pack 3 (GDR) versions 13.0.0 to 130.6475.1
  • Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack versions 13.0.0 to 13.0.7070.1
  • Microsoft SQL Server 2017 (CU 31) versions 14.0.0 to 14.0.3515.1
  • Microsoft SQL Server 2022 (GDR) versions 16.0.0 to 16.0.1160.1
  • Microsoft SQL Server 2019 (CU 32) versions 15.0.0.0 to 15.0.4455.2
  • Microsoft SQL Server 2022 (CU 21) versions 16.0.0.0 to 16.0.4222.2
  • Microsoft SQL Server 2017 (GDR) versions 14.0.0 to 14.0.2095.1
• Recommended Measures:
  • Apply the fix released on the official website: https://msrc.microsoft.com/update-guide/zh-tw/vulnerability/CVE-2025-59499
• References:
  • https://www.twcert.org.tw/tw/cp-169-10506-e0a1e-1.html

Computer and Communications Center
Network Systems Group