Forwarded from Taiwan Computer Network Crisis Management and Coordination Center: Cybersecurity Alert TWCERTCC-200-202511-00000010

[Content Description]
Microsoft has released a critical cybersecurity vulnerability bulletin for its SQL Server product (CVE-2025-59499, CVSS: 8.8). This vulnerability is an SQL injection vulnerability, allowing authorized attackers to inject carefully crafted SQL commands over a network and escalate privileges.

[Affected Platforms]
● Microsoft SQL Server 2019 (GDR) versions 15.0.0 to 15.0.21552
● Microsoft SQL Server 2016 Service Pack 3 (GDR) versions 13.0.0 to 130.6475.1
● Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack versions 13.0.0 to 13.0.7070.1
● Microsoft SQL Server 2017 (CU 31) versions 14.0.0 to 14.0.3515.1
● Microsoft SQL Server 2022 (GDR) versions 16.0.0 to 16.0.1160.1
● Microsoft SQL Server 2019 (CU 32) versions 15.0.0.0 to 15.0.4455.2
● Microsoft SQL Server Versions 2022 (CU 21) 16.0.0.0 to 16.0.4222.2
● Microsoft SQL Server 2017 (GDR) Versions 14.0.0 to 14.0.2095.1

[Recommended Action]
Patch according to the solutions released on the official website:
https://msrc.microsoft.com/update-guide/zh-tw/vulnerability/CVE-2025-59499

[Reference]
https://www.twcert.org.tw/tw/cp-169-10506-e0a1e-1.html