Skip to the content
The Update Bureau
SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update
Patch Tuesday

KB5042209

KB5042209: Security update for SQL Server 2016, Azure Connect Feature Pack branch, September 2024. SQL privilege flaws addressed; CDC upgrades may drop columns

In short

Addresses three SQL Server elevation-of-privilege vulnerabilities and adds a CDC metadata safeguard. CDC jobs or upgrade and restore steps might still fail when CDC tracking columns have certain names.

Does it affect you? Applies to: Devices running SQL Server 2016 SP3 with the Azure Connect Feature Pack installed. The package is for x64 systems; the known issue applies to databases with CDC enabled.

Build
13.0.7040.1
Servicing branch
Azure Connect Feature Pack
Security
3 fixed
Restart
Required
Review notes Additional details from the official release notes (3) Read notes
  • In detail The update adds a CDC metadata-lockdown capability that can block DDL operations; the official page does not say that all DDL operations are now blocked.
  • In detail The KB associates missing or dropped columns with names containing commas. Other symbols or certain control characters can cause the CDC upgrade process to fail.
  • Known issues The KB associates missing or dropped columns with names containing commas. Other symbols or certain control characters can cause the CDC upgrade process to fail.

The official sources are linked at the end of the page.

For servers on the Azure Connect Feature Pack of Service Pack 3, the branch with fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fix 1 change

Temporal

  • Table and column names are quoted correctly in internal batches used by stored procedures that manage temporal tables.1
    Fixes cases where names read from database metadata were not correctly quoted when building internal SQL Server batches.

Improvement 1 change

Replication

  • CDC metadata has an added safeguard against changes that could affect its definitions.2
    Adds metadata definition lockdown capability to block DDL operations for the change data capture feature.

Known issues

  1. Open Affects: Organizations and IT administrators

    CDC capture job might fail if columns are missing in CDC change tables

    In databases with CDC enabled, capture jobs or related upgrade and restore steps might fail, and columns might be missing or dropped from CDC tracking tables when their names contain commas, other symbols, or certain control characters. Only columns matching the described conditions are affected.3

    How to apply the workaround SQL Trace Flag

    Use trace flag T15006 before upgrading and restart the SQL Server service. If the GDR is already applied and columns were dropped, add the flag and restart; repeat an affected restore or disable and reenable CDC on the affected table. Disabling and reenabling CDC causes change data loss.3

    Step-by-step workaround instructions
    6 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Before upgrading, open the SQL Server instance Properties in SQL Server Configuration Manager and go to the Startup Parameters tab.
    2. Add trace flag T15006, select Add and Apply, then restart the SQL Server service.
    3. Perform the upgrade while the trace flag is active.
    4. If the GDR is already applied and columns were dropped, add T15006 and restart the SQL Server service.
    5. If a database restore was affected, perform the restore again.
    6. If the GDR caused columns to be dropped, disable and reenable CDC on the affected table with sp_cdc_disable_table and sp_cdc_enable_table; this causes change data to be lost.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-09-10
Classification
Security Updates
Type
Cumulative update
Servicing branch
Azure Connect Feature Pack
Restart
Required
Replaces
KB5040944
Replaced by
KB5046062
VersionBuildChannel
2016 13.0.7040.1 General availability

Security

3 vulnerabilities fixed
2 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2024-37965
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-37980
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-37341
Microsoft SQL Server Elevation of Privilege Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

Package 2016
471.6 MB
sqlserver2016-kb5042209-x64.exe Main update · KB5042209 SHA-1: e47d1c55…199b05

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. Fixes an issue in which table and column names that are read from database metadata aren't correctly quoted in some cases when building internal SQL Server batches in stored procedures that manage temporal tables. support.microsoft.com
  2. 2. Improves security for the change data capture (CDC) feature by adding metadata definition lockdown capability to block data definition language (DDL) operations. support.microsoft.com
  3. 3. has columns whose name contains any symbol, such as &, <, >, or characters whose ASCII decimal code is less than 32 support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake