Skip to the content
The Update Bureau
SQL Server 2022 CU25 SQL Server 2022 CU25 Cumulative update

KB5081477

KB5081477: Cumulative update for SQL Server 2022, CU branch, May 2026. Web Service Task blocks file access through WSDL endpoints

In short

Includes 12 fixes for SQL Server 2022, including a Web Service Task fix that blocks unauthorized file access through WSDL endpoints. It also leaves two known issues open.

Does it affect you? Applies to: SQL Server 2022 on Windows and Linux. The package updates only the SQL Server components that are installed on the instance.

Build
16.0.4255.1
Servicing branch
CU
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • What changes The fix addresses XML corruption from a self-assignment update on a small off-row XML column when compression is enabled, and the resulting transport-level error when selecting the data.
  • Known issues Linked server queries that use MSDASQL and specify a provider string fail with error 7416.

The official sources are linked at the end of the page.

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 12 changes

Database Mail

  • Database Mail sends email attachments again in Contained Availability Groups.1
    Fixes the issue in which DatabaseMail sent messages without attachments in Contained Availability Groups.

Management Services

  • Granted permissions on stored procedures and other msdb objects are no longer lost during a SQL Server upgrade.2
    Addresses loss of permissions on stored procedures and other objects in msdb during the upgrade process.

SQL OS

For: SQL Server instances on Windows Server 2025

  • Querying sys.dm_xe_session_targets no longer causes an access violation on affected SQL Server instances.3
    Fixes an access violation when querying sys.dm_xe_session_targets on SQL Server instances running on Windows Server 2025.

High Availability and Disaster Recovery

For: Contained Availability Group users

  • T-SQL can add a database to a Contained Availability Group without being limited to the group currently connected, and DBCreator roles face fewer restrictions.4
    Fixes the T-SQL restriction that allowed adding a database only to the currently connected Contained Availability Group, along with additional restrictions for DBCreator roles.

Query Optimizer

For: Graph database users

  • Parallel SHORTEST_PATH queries no longer cause persistent memory growth in Graph databases.5
    Fixes persistent OBJECTSTORE_SOSTASK growth during parallel execution of SHORTEST_PATH queries.

Access Methods

For: Databases with compressed off-row XML columns

  • Updating a compressed XML value no longer corrupts the data and cause a transport-level error when it is read.6
    Fixes corruption from a self-assignment update on a small off-row XML column with compression enabled, and the subsequent transport-level error when selecting the data.

Integration Services

3 items
  • Using the Oracle ODBC driver with the ODBC connector in SSIS packages no longer risks heap corruption and data loss.7
    Fixes heap corruption and data loss that might occur with the Oracle ODBC driver and the ODBC connector in SSIS packages.
  • The generic ODBC connector no longer causes heap corruption when used with the Oracle ODBC driver.8
    Fixes heap corruption in the generic ODBC connector when using the Oracle ODBC driver.
  • Web Service Task blocks the file:// protocol in WSDL service endpoints to prevent unauthorized file access and denial-of-service attacks.9
    Fixes an XML External Entity (XXE) vulnerability by blocking the file:// protocol in WSDL service endpoints. Windows only.

In-Memory OLTP

For: In-memory OLTP users

  • In-memory OLTP garbage collection yields CPU time regularly while scanning hash indexes, addressing CPU starvation.10
    Adds yields at regular intervals during in-memory OLTP garbage collection scans of hash indexes.

Storage Engine

For: Databases with Change Data Capture enabled

  • An online index operation no longer causes an error when it runs alongside data changes in a database with Change Data Capture enabled.11
    Fixes an error when an online index operation runs concurrently with data manipulation language (DML) operations in a database with Change Data Capture (CDC) enabled.

Linux

For: SQL Server on Linux using network shares

  • On Linux, backup cleanup no longer causes SQL Server to stop responding when a network share becomes full or unreachable.12
    Fixes a backup cleanup issue that could cause SQL Server to stop responding when a network share becomes full or unreachable.

Known issues

  1. Open Affects: Everyone

    Linked server queries that use MSDASQL fail with error 7416

    Linked server queries using the MSDASQL provider and a provider string (@provstr) might fail with error 7416, reporting that no login mapping exists.13

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Everyone

    Incorrect behavior of SESSION_CONTEXT in parallel plans

    Queries using SESSION_CONTEXT might return incorrect results or produce access violation dump files when run in parallel query plans, particularly if the session is reset for reuse.14

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-05-20
Classification
Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5080999, KB5078297, KB5068450, KB5065865
+10 earlier KB5059390, KB5054531, KB5050771, KB5048038, KB5048033, KB5041321, KB5038325, KB5036432, KB5033663, KB5032679
Replaced by
KB5101347
VersionBuildChannel
2022 16.0.4255.1 General availability

Security

No vulnerabilities are listed for this update.

Downloads (Microsoft Update Catalog)

Package 2022
464.6 MB
sqlserver2022-kb5081477-x64.exe Main update · KB5081477 SHA-1: d6b081c5…508abe

Updated components

196 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine31
SQL Server Replication12
SQL Server Integration Services10
SQL Server Agent5
SQL Server Machine Learning Services4
SQL Server Full-Text Search2
SQL Server PolyBase2

Sources

Updated
Cited passages from Microsoft's official notes (14)
  1. 1. Fixes an issue in Contained Availability Groups in which DatabaseMail sends email messages without attachments. learn.microsoft.com
  2. 2. Fixes an issue in which permissions on stored procedures and other objects in msdb are lost during the SQL Server upgrade process. This issue causes users to lose granted permissions. learn.microsoft.com
  3. 3. Fixes an access violation error that occurs when querying sys.dm_xe_session_targets on SQL Server instances that are running on Windows Server 2025. learn.microsoft.com
  4. 4. Fixes an issue in Contained Availability Group connections in which T-SQL allows only adding a database to the currently connected Contained Availability Group, and also causes additional restrictions for DBCreator roles. learn.microsoft.com
  5. 5. Fixes a memory leak issue in which parallel execution of SHORTEST_PATH queries in Graph databases causes persistent OBJECTSTORE_SOSTASK growth. learn.microsoft.com
  6. 6. Fixes an issue in which a self-assignment update on a small off-row XML column by having compression enabled causes XML data corruption and a subsequent transport-level error when selecting the data. learn.microsoft.com
  7. 7. Fixes an issue in which using the Oracle ODBC driver together with the ODBC connector in SSIS packages might cause heap corruption and data loss. learn.microsoft.com
  8. 8. Fixes a heap corruption issue in the generic ODBC connector when using the Oracle ODBC driver. learn.microsoft.com
  9. 9. Fixes an XML External Entity (XXE) vulnerability in the Web Service Task by blocking the file:// protocol in WSDL service endpoints to prevent unauthorized file access and denial-of-service attacks. learn.microsoft.com
  10. 10. Fixes CPU starvation issues by adding yields at regular intervals during in-memory OLTP garbage collection scan of hash indexes. learn.microsoft.com
  11. 11. Fixes an error that occurs when an online index operation runs concurrently with data manipulation language (DML) operations in a database that has Change Data Capture (CDC) enabled. learn.microsoft.com
  12. 12. Fixes a back-up cleanup issue on Linux that could cause SQL Server to stop responding when a network share becomes full or unreachable. learn.microsoft.com
  13. 13. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: learn.microsoft.com
  14. 14. Queries that use the built-in SESSION_CONTEXT function might return incorrect results or trigger access violation (AV) dump files when run in parallel query plans. learn.microsoft.com
Checked automatically: 8 of 8 checks passed, 14 quoted passages · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake