The Update BureauKB5084818: Security update for SQL Server 2017, CU branch, April 2026. Linked-server privilege flaws addressed; MSDASQL queries can fail
Two Important SQL Server elevation-of-privilege vulnerabilities are addressed, including flaws in linked servers and SQL Agent. A known issue can make MSDASQL linked-server queries fail with error 7416.
Does it affect you? Applies to: SQL Server 2017 installations on supported x64 systems, with SQL Server 2017 or a CU release through CU31 GDR installed. The update is offered to servers running SQL Server; it is optional on computers that do not host SQL Server Reporting Services.
For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?
What changes
Fixes 2 changes
Linked Server
-
The fix addresses a flaw that could let a low-privileged SQL Server user gain sysadmin permissions.1
Elevation-of-privilege vulnerability in SQL Server linked servers; the table lists Linux and Windows.
SQL Agent
-
The fix resolves a SQL injection issue that could let an authorized attacker elevate privileges over a network.2
The issue involves improper neutralization of special elements in SQL commands; the table lists Windows.
Known issues
-
Linked server queries that use MSDASQL fail with error 7416
Linked-server queries using
MSDASQL(the OLE DB Provider for ODBC Drivers) and a provider string (@provstr) can fail with error 7416. Stricter connection validation can reject certain configurations that worked in earlier builds.3Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-04-14
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- CU
- Restart
- Required
- Replaces
- KB5077471, KB5068402, KB5065225, KB5063759
- Replaced by
- KB5090354
| Version | Build | Channel |
|---|---|---|
| 2017 | 14.0.3525.1 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
SQL Server Elevation of Privilege Vulnerability
|
Important | 6.7 |
|
SQL Server Elevation of Privilege Vulnerability
|
Important | 6.7 |
Downloads (Microsoft Update Catalog)
Updated components
120 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| SQL Server Engine | 94 |
| SQL Server PolyBase | 2 |
Sources
Cited passages from Microsoft's official notes (3)
-
1.
This fix addresses an elevation of privilege vulnerability in SQL Server linked servers that allows a low-privileged SQL Server user to gain sysadmin permissions.
support.microsoft.com -
2.
This fix resolves an issue in SQL Server in which improper neutralization of special elements in SQL commands (SQL injection) allows an authorized attacker to elevate privileges over a network.
support.microsoft.com -
3.
Linked server queries that use the
support.microsoft.comMSDASQL(OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message:
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Sep 26, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake