[Vulnerability Alert] Microsoft SQL Server has a Critical Security Vulnerability (CVE-2025-59499)

Posted Date: 2025/11/18

Subject: [Vulnerability Alert] Microsoft SQL Server has a Critical Security Vulnerability (CVE-2025-59499)
Content:
- Forwarded from Taiwan Computer Emergency Response Team/Coordination Center Security Alert TWCERTCC-200-202511-00000010
- Microsoft issued a major security vulnerability advisory for its product SQL Server (CVE-2025-59499, CVSS: 8.8). This vulnerability is an SQL injection vulnerability that allows an authenticated attacker to inject specially crafted SQL commands over the network and escalate privileges.
Affected Platforms:
- Microsoft SQL Server 2019 (GDR) versions 15.0.0 to 15.0.21552
- Microsoft SQL Server 2016 Service Pack 3 (GDR) versions 13.0.0 to 130.6475.1
- Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack versions 13.0.0 to 13.0.7070.1
- Microsoft SQL Server 2017 (CU 31) versions 14.0.0 to 14.0.3515.1
- Microsoft SQL Server 2022 (GDR) versions 16.0.0 to 16.0.1160.1
- Microsoft SQL Server 2019 (CU 32) versions 15.0.0.0 to 15.0.4455.2
- Microsoft SQL Server 2022 (CU 21) versions 16.0.0.0 to 16.0.4222.2
- Microsoft SQL Server 2017 (GDR) versions 14.0.0 to 14.0.2095.1
Recommended Measures:
- Apply the fix released on the official website: https://msrc.microsoft.com/update-guide/zh-tw/vulnerability/CVE-2025-59499
References:
- https://www.twcert.org.tw/tw/cp-169-10506-e0a1e-1.html

Computer and Communications Center
Network Systems Group