KB5084819: Security update for SQL Server 2017, GDR branch, April 2026. Linked-server privilege flaw addressed; MSDASQL queries fail

Fixes two Important elevation-of-privilege vulnerabilities. Linked server queries using MSDASQL with a provider string fail with error 7416.

Does it affect you? Applies to: Devices running SQL Server 2017 with a GDR release; the listed package is for x64-based versions. Installing the update is optional on computers that do not host Microsoft SQL Server Reporting Services.

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fixes 2 changes

Linked Server

The fix addresses a flaw that lets a low-privileged SQL Server user gain sysadmin permissions through a linked server.¹
The listed platform scope is Linux and Windows.

SQL Agent

The fix resolves a SQL injection issue that allows an authorized attacker to elevate privileges over a network.²
The listed platform scope is Windows.

Known issues

Open Affects: Organizations and IT administrators

Linked server queries that use MSDASQL fail with error 7416

Linked server queries that use the MSDASQL provider and specify a provider string (@provstr) fail with error 7416: access to the remote server is denied because no login-mapping exists. The Database Engine's stricter connection validation can reject certain configurations, even if earlier builds allowed them.³

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-04-14
Classification: Security Updates
Type: Cumulative update
Servicing branch: GDR
Restart: Required
Replaces: KB5077472, KB5068403, KB5065224, KB5063760

+5 earlier
KB5058716, KB5046857, KB5046058, KB5042217, KB5040942
Replaced by: KB5090347

Version	Build	Channel
2017	14.0.2105.1	General availability

Security

2 vulnerabilities fixed

2 important

Vulnerability	Severity	CVSS
CVE-2026-32167 SQL Server Elevation of Privilege Vulnerability	Important	6.7
CVE-2026-32176 SQL Server Elevation of Privilege Vulnerability	Important	6.7

Downloads (Microsoft Update Catalog)

Package 2017

452.4 MB

sqlserver2017-kb5084819-x64.exe Main update · KB5084819 SHA-1: 3204aff2…b71ca5

Updated components

118 files changed since the previous update for the same versions.

Top changed components	Files
SQL Server Engine	91

Sources

Microsoft Support: KB5084819

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (3)

1. This fix addresses an elevation of privilege vulnerability in SQL Server linked servers that allows a low-privileged SQL Server user to gain sysadmin permissions. support.microsoft.com
2. This fix resolves an issue in SQL Server in which improper neutralization of special elements in SQL commands (SQL injection) allows an authorized attacker to elevate privileges over a network. support.microsoft.com
3. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com

Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Sep 26, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake