KB5102335: Security update for SQL Server 2019, CU branch, July 2026. Critical remote-code flaw fixed; MSDASQL linked queries still fail

Fixes a critical remote-code execution vulnerability and three other security vulnerabilities. Linked server queries using MSDASQL can still fail with error 7416.

Does it affect you? Applies to: SQL Server 2019 installations with SQL Server 2019 or a CU release through CU32 GDR installed. The listed update package is for x64.

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 4 changes

Integration Services

Integration Services blocks remote code execution from untrusted MSMQ messages by restricting how it processes serialized data.¹
Restricts SoapFormatter deserialization in MessageQueueTask by using an allow list binder.

Query Execution

A memory leak that can occur when querying the input buffer is fixed.²
Affects the sys.dm_exec_input_buffer dynamic management function and the DBCC INPUTBUFFER command.

Replication

Input passed to an internal replication procedure is validated and sanitized before use.³

SQL Agent

A SQL injection vulnerability that could allow an authenticated attacker to elevate privileges over a network is fixed.⁴
The vulnerability involved improper neutralization of special elements in SQL Server commands.

Known issues

Open Affects: Not stated by the source

Linked server queries that use MSDASQL fail with error 7416

Linked server queries that use the MSDASQL provider and specify a provider string (@provstr) can fail with error 7416, even if the same configuration worked on earlier builds.⁵

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-07-14
Classification: Security Updates
Type: Cumulative update
Servicing branch: CU
Restart: Required
Replaces: KB5090407, KB5084816, KB5077469, KB5068404

+16 earlier
KB5065222, KB5063757, KB5058722, KB5054833, KB5049296, KB5049235, KB5046860, KB5046365, KB5046060, KB5042749, KB5039747, KB5040948, KB5037331, KB5035123, KB5036335, KB5033688
Replaced by: KB5122772

Version	Build	Channel
2019	15.0.4480.2	General availability

Security

4 vulnerabilities fixed

1 critical 3 important

Vulnerability	Severity	CVSS
CVE-2026-54118 Microsoft SQL Server Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-47295 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2026-55002 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2026-47296 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.5

Downloads (Microsoft Update Catalog)

Package 2019

888.8 MB

sqlserver2019-kb5102335-x64.exe Main update · KB5102335 SHA-1: 521bcd69…5b9eb7

Updated components

158 files changed since the previous update for the same versions.

Top changed components	Files
SQL Server Engine	121
SQL Server PolyBase	4

Sources

Microsoft Support: KB5102335

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (5)

1. This resolves an insecure deserialization vulnerability in MessageQueueTask by restricting SoapFormatter deserialization that uses an allow list binder. support.microsoft.com
2. This fix resolves a memory leak that occurs if the sys.dm_exec_input_buffer dynamic management function (DMF) or the DBCC INPUTBUFFER command is used. support.microsoft.com
3. This fix addresses input validation and sanitization of user input for a parameter that's passed to an internal replication stored procedure by validating and sanitizing the input before the stored procedure uses it. support.microsoft.com
4. This fix resolves an SQL injection vulnerability in SQL Server in which improper neutralization of special elements in SQL Server commands allows an authenticated attacker to elevate privileges over a network. support.microsoft.com
5. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com

Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 16, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake