Skip to the content
The Update Bureau
SQL Server 2019 CU28 + GDR SQL Server 2019 CU28 + GDR Security update
Patch Tuesday

KB5042749

KB5042749: Security update for SQL Server 2019, CU branch, September 2024. Twelve vulnerabilities patched; CDC and VSS backup issues remain

In short

Fixes 12 vulnerabilities, including 11 rated Important. After installing it, CDC capture jobs might fail and SQL Server VSS Writer might fail to create application-consistent backups.

Does it affect you? Applies to: SQL Server 2019 installations that meet the update prerequisite: SQL Server 2019 or a SQL Server 2019 CU release through CU28 GDR.

Build
15.0.4390.2
Servicing branch
CU
Security
12 fixed
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Improvements 2 changes

Query Execution

  • PREDICT checks the MODEL parameter to help avoid errors caused by an incorrect model.1
    Adds validation for the MODEL parameter when running PREDICT.

Replication

  • CDC can lock down metadata definitions to block changes to data definitions.1
    Adds metadata definition lockdown capability for change data capture (CDC) to block data definition language (DDL) operations.

Fix 1 change

Temporal

  • Stored procedures that manage temporal tables correctly quote table and column names read from database metadata.2
    Fixes incorrect quoting when internal SQL Server batches are built in stored procedures that manage temporal tables.

Known issues

  1. Open Affects: Organizations and IT administrators

    Issue two: SQL Server VSS Writer might fail to perform a backup because no database is available to freeze

    SQL Server VSS Writer might enter a non-retryable error state and fail to make an application-consistent snapshot backup because no database is available to freeze. Backup tools such as Azure Recovery Vault might be affected.3

    How to apply the workaround Workaround

    Roll back to SQL Server 2019 CU27, then perform the snapshot backup.3

    Step-by-step workaround instructions
    2 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Roll back the package to SQL Server 2019 CU27.
    2. Perform the snapshot backup.
  2. Open Affects: Organizations and IT administrators

    CDC capture job might fail if columns are missing in CDC change tables

    After the update, CDC tracking tables might be missing columns whose names contain commas. This can cause the CDC capture job or applications that use those tables to fail; CDC restore or upgrade operations can also be affected by certain special characters in column names.4

    How to apply the workaround SQL Trace Flag

    Use trace flag T15006 before upgrading and restart the SQL Server service. If the update is already applied and columns were dropped, add the flag and restart; restore the database again if a restore was affected, or disable and reenable CDC on the affected table if the upgrade dropped columns. Disabling and reenabling CDC causes change data to be lost.4

    Step-by-step workaround instructions
    5 steps
    Show steps Hide steps
    Step-by-step procedure
    1. In SQL Server Configuration Manager, open the SQL Server instance properties and go to the Startup Parameters tab.
    2. Add TF T15006, select Add, then select Apply and restart the SQL Server service.
    3. If preparing for an upgrade, perform the upgrade after restarting.
    4. If a restore was affected, repeat the database restore after adding the flag and restarting.
    5. If the GDR upgrade dropped columns, disable and reenable CDC on the affected table with sp_cdc_disable_table and sp_cdc_enable_table; this causes change data to be lost.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-09-10
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5039747, KB5040948, KB5037331, KB5035123
+2 earlier KB5036335, KB5033688
Replaced by
KB5046060
VersionBuildChannel
2019 15.0.4390.2 General availability

Security

12 vulnerabilities fixed
11 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2024-26186
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-26191
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37335
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37338
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37339
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37340
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37965
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-37980
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-37337
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1
CVE-2024-37342
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1
CVE-2024-37966
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1
CVE-2024-37341
Microsoft SQL Server Elevation of Privilege Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

Package 2019
880.6 MB
sqlserver2019-kb5042749-x64.exe Main update · KB5042749 SHA-1: 2c0838a3…d6401d

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. Improves security for the change data capture (CDC) feature by adding metadata definition lockdown capability to block data definition language (DDL) operations. support.microsoft.com
  2. 2. Fixes an issue in which table and column names that are read from database metadata aren't correctly quoted in some cases when building internal SQL Server batches in stored procedures that manage temporal tables. support.microsoft.com
  3. 3. The current solution is to roll back to SQL Server 2019 CU27 and perform the snapshot backup. support.microsoft.com
  4. 4. To prevent columns from being dropped and causing the failure of a CDC restoration or upgrade, you can use trace flag (TF) T15006 before you upgrade the GDR build: support.microsoft.com
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake