Skip to the content
The Update Bureau
SQL Server 2022 CU22 SQL Server 2022 CU22 Security update

KB5068450

KB5068450: Cumulative update for SQL Server 2022, CU branch, November 2025. Integration Services vulnerability fixed; parallel SESSION_CONTEXT issue remains

In short

CU22 updates SQL Server 2022 to build 16.0.4225.2 with 20 fixes, including a fix for CVE-2022-26907 in Integration Services. Queries using SESSION_CONTEXT can still return incorrect results or trigger access violations in parallel plans.

Does it affect you? Applies to: Devices running SQL Server 2022. This CU updates installed SQL Server components; the package is available for Windows and Linux.

Build
16.0.4225.2
Servicing branch
CU
Security
1 fixed
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 18 changes

Backup Restore

4 items
  • Differential backups with compression no longer hit an assertion failure on databases with large amounts of FILESTREAM records.1
    Fixes the assertion failure in writeEncoded.cpp during compressed differential backups of databases containing large volumes of FILESTREAM records.
  • Write errors during a seeding restore are handled correctly.6
    Fixes write-error handling during a seeding restore when system error codes are misinterpreted.
  • Data-copy dump files no longer occur in the described versioned Managed Instance restore scenario.9
    Fixes dump files during data copy from the I/O pipeline when restoring a versioned MI with the worker.cl.wcow.sql22 app type.
  • The program no longer risks becoming unresponsive because of incorrect error handling when running DBCC checks.10
    Fixes incorrect error handling that could cause the program not to respond when running DBCC CHECKDB, CHECKTABLE, or CHECKFILEGROUP.

Log Management

For: All platforms

  • Non-yielding scheduler dumps no longer occur in the described Availability Group secondary-replica scenario.2
    Fixes dump generation in PmmLogAcceptBlock when persistent log buffer is enabled and the database log cache contains primarily tiny log records.

Programmability

For: All platforms

  • DBCC CHECKDB no longer fails with an exception in the described computed-column configuration.3
    Fixes failure of DBCC CHECKDB with EXTENDED_LOGICAL_CHECKS when a table has persisted and non-persisted computed columns and trace flag 176 is enabled.

High Availability and Disaster Recovery

2 items

For: All platforms

  • When an offline replica is removed from an availability group or the group is dropped, affected databases enter the expected resolving state instead of the suspect state.4
    Fixes the database state when a replica is removed from an availability group, or the group is dropped, while the associated replica is offline.
  • Data movement on a secondary availability-group replica no longer pauses because of transient negative elapsed-time values.12
    Fixes transient negative elapsed-time values on a secondary replica that cause data movement to pause.

SQL Server Configuration Manager

  • Instant File Initialization and Lock Pages in Memory fields show the correct values in SQL Server Configuration Manager.5

Integration Services

  • Integration Services receives an updated client runtime to fix CVE-2022-26907.7
    Upgrades Microsoft.Rest.ClientRuntime to version 2.3.24 on SSIS to fix CVE-2022-26907.

SQL Connectivity

  • Certificate imports work consistently from the drop-down menu and import button, and certificate selection by thumbprint works when its letter case differs.8
    Fixes inconsistent certificate import behavior and thumbprint selection failures caused by a case mismatch.

Analysis Services

  • Row-level security filters are no longer skipped in the described multi-role security configuration.11
    Fixes Analysis Services configurations where Row-Level Security (RLS) filters could be skipped when combined with Object-Level Security (OLS) and Column-Level Security (CLS).

Management Services

For: All platforms

  • The internal sp_do_backup stored procedure no longer has the SQL injection vulnerability described in the update.13
    Fixes the SQL injection vulnerability in sp_do_backup under the managed_backup view; the stored procedure is for internal use only.

Security Infrastructure

2 items

For: All platforms

  • OLEDB calls no longer produce access violation dumps in the described scenario where the Service Principal Name is missing.14
    Fixes access violation dump files during OLEDB calls if the Service Principal Name is missing.
  • Fetching AAD authentication certificates no longer produces the described access violation dump when memory is exhausted.15
    Fixes an access violation dump file caused by an out-of-memory condition when fetching AAD authentication certificates.

SQL Agent for Managed Instance

  • SQL Agent reads feature switches for Managed Instances correctly.16

Database Automatic Tuning

For: All platforms

  • A query reading sys.database_automatic_tuning_mode no longer encounters an access violation during a database state transition.17
    Fixes access violations when database state transitions occur while a query is running sys.database_automatic_tuning_mode.

SQL OS

For: All platforms

  • Error codes are captured before they can be overwritten, so retry checks work correctly after the described function calls.18
    Fixes error codes not being captured immediately after certain function calls, which could cause the code to be overwritten and retry checks to behave incorrectly.

Improvement 1 change

SQL OS

  • CacheStore PHDR usage is capped when queries consume too much server memory.19
    Enables caps for CacheStore PHDR usage when queries consume too much of the server's memory.

New feature 1 change

Cleanup service

  • Stale Log-Replay Service metadata is cleaned up automatically after it is more than 36 days old.20
    Introduces automatic cleanup of stale Log-Replay Service (LRS) metadata older than 36 days.

Known issues

  1. Open Affects: Everyone

    Incorrect behavior of SESSION_CONTEXT in parallel plans

    Queries that use SESSION_CONTEXT might return incorrect results or trigger access violation dump files in parallel query plans, particularly if the session is reset for reuse.21

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-11-13
Classification
Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5065865, KB5059390, KB5054531, KB5050771
+7 earlier KB5048038, KB5048033, KB5041321, KB5038325, KB5036432, KB5033663, KB5032679
Replaced by
KB5072936
VersionBuildChannel
2022 16.0.4225.2 General availability

Security

1 vulnerability fixed
1 not rated
VulnerabilitySeverityCVSS
CVE-2022-26907
Not rated —

Downloads (Microsoft Update Catalog)

Package 2022
463.1 MB
sqlserver2022-kb5068450-x64.exe Main update · KB5068450 SHA-1: 70c032e1…a1b8c7

Sources

Updated
Cited passages from Microsoft's official notes (21)
  1. 1. Fixed an assertion failure File: <writeEncoded.cpp>, line='' Failed Assertion = 'pCurTargetBuf == pSource->m_pDirectEncodeTarget' during a differential backup that uses compression on databases that contain large volumes of FILESTREAM records. support.microsoft.com
  2. 2. Fixes an issue in which non-yielding scheduler dump files are generated in PmmLogAcceptBlock on the Availability Group secondary replica if persistent log buffer is enabled and the database's log cache contains primarily tiny log records. support.microsoft.com
  3. 3. Fixes an issue in which DBCC CHECKDB with EXTENDED_LOGICAL_CHECKS fails and returns an exception if there are both persisted and non-persisted computed columns in a table while trace flag 176 is enabled. support.microsoft.com
  4. 4. Fixes an issue in which one or more databases enter the suspect state instead of the expected resolving state when a replica is removed from an availability group or the availability group is dropped while the associated replica is offline. support.microsoft.com
  5. 5. Fixes incorrect display values of the Instant File Initialization and Lock Pages in Memory fields in SQL Server Configuration Manager. support.microsoft.com
  6. 6. Fixes incorrect handling of write errors during a seeding restore process that's caused by misinterpretation of system error codes. support.microsoft.com
  7. 7. Upgrade Microsoft.Rest.ClientRuntime version to 2.3.24 on SSIS to fix vulnerability (CVE-2022-26907). support.microsoft.com
  8. 8. Fixes an issue that causes inconsistent behavior when you import a certificate by using the drop-down menu or when you use the import button in the Configuration Manager. Also fixes an issue in which selecting a certificate by using the thumbprint fails if the case doesn't match. support.microsoft.com
  9. 9. Fixes dump files during data copy from I/O pipeline when you perform a database restore process on versioned MI that has the worker.cl.wcow.sql22 app type. support.microsoft.com
  10. 10. Fixes incorrect error handling that could cause the program not to respond when you run DBCC CHECKDB, CHECKTABLE, or CHECKFILEGROUP. support.microsoft.com
  11. 11. Fixes an issue in SQL Server Analysis Services in which Row-Level Security (RLS) filters could be skipped when combined with Object-Level Security (OLS) and Column-Level Security (CLS) in certain multi-role configurations. support.microsoft.com
  12. 12. Fixes an issue in which transient negative elapsed time values on a secondary replica of an availability group causes data movement to pause. support.microsoft.com
  13. 13. Fixes the sp_do_backup stored procedure under the managed_backupview to remove a SQL injection vulnerability. This stored procedure is for internal use only. support.microsoft.com
  14. 14. Fixes access violation dump files during OLEDB calls if the Service Principal Name is missing. support.microsoft.com
  15. 15. Fixes an access violation dump file caused by an out-of-memory condition when fetching AAD authentication certificates. support.microsoft.com
  16. 16. Fixes an issue when the SQL Agent reads feature switches for Managed Instances (MI). support.microsoft.com
  17. 17. Fixes an issue in sys.database_automatic_tuning_mode in which database state transitions can cause access violations while a query is running this DMV. support.microsoft.com
  18. 18. Fixes an issue in which error codes aren't captured immediately after certain function calls. This condition causes the code to be overwritten and retry checks to behave incorrectly. support.microsoft.com
  19. 19. Enables caps for CacheStore PHDR usage when queries consume too much of the server's memory. support.microsoft.com
  20. 20. Introduces automatic cleanup of stale Log-Replay Service (LRS) metadata (older than 36 days) support.microsoft.com
  21. 21. Queries that use the built-in SESSION_CONTEXT function might return incorrect results or trigger access violation (AV) dump files when run in parallel query plans. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 21 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake