Skip to the content
The Update Bureau
SQL Server 2022 CU26 + GDR SQL Server 2022 CU26 + GDR Security update
Patch Tuesday

KB5122768

KB5122768: Security update for SQL Server 2022, CU branch, September 2026. Remote-code flaws patched; two issues remain open

In short

The update fixes 52 vulnerabilities, including four critical remote-code-execution flaws. KB5126934 supersedes it, so use the newer update rather than installing this package.

Does it affect you? Applies to: SQL Server 2022 installations. You must have SQL Server 2022 or a SQL Server 2022 cumulative update through CU26 GDR installed first; the update is available for Windows and Linux.

Build
16.0.4275.2
Servicing branch
CU
Security
52 fixed · 4 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • This page The dossier records KB5126934 as superseding KB5122768. The official page lists ways to obtain KB5122768 but does not say to use the newer update instead.
  • What changes These fixes apply to SQL Server components on the platforms listed for each fix; the platform labels do not identify a reader group.

The official sources are linked at the end of the page.

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 40 changes

SQL Agent

3 items
  • Addresses a security validation issue when SQL Server Agent loads task-agent components.1
    Strengthens security validation for task-agent components loaded by SQL Server Agent.
  • Addresses reliability and security issues when SQL Server Agent processes specific input.2
    The fix applies to SQL Server Agent on Linux and Windows.
  • Addresses security and reliability issues affecting SQL Server Agent under specific operating conditions.4
    Applies to SQL Server Agent on Linux and Windows.

WMI Management Provider (SqlMgmProvider)

For: Windows

  • Addresses incorrect handling of malformed input while preserving the existing behavior for valid input.3
    Applies to the SQL WMI Provider on Windows.

Replication

15 items
  • Addresses identifier handling and input validation in replication stored procedures.5
    Ensures supplied and stored values are processed correctly on Linux and Windows.
  • Addresses incorrect processing of identifiers containing longer or special characters in replication stored procedures.6
  • Addresses incorrect processing of identifiers containing special characters in replication stored procedures.7
  • Addresses input validation for a merge replication metadata stored procedure.8
    Ensures supplied values are processed reliably.
  • Addresses a replication stored procedure that handles a caller-supplied path value.9
  • Addresses input validation for parameters used by replication stored procedures.10
    Ensures supplied values are processed reliably.
  • Addresses a class ID lookup call that reads arbitrary memory.28
  • Adds bounds validation for embedded attestation fields.29
  • Strengthens Object Store Format deserialization against malformed or malicious stream data.30
  • Strengthens buffer length validation checks within enclave code.31
  • Addresses an issue affecting the protection of internal replication data during processing.36
  • Addresses handling of text data during Merge Replication processing.37
  • Improves validation and handling in replication operations for security and reliability.38
  • Includes security and reliability improvements for Queued Updating Subscriptions in Transactional Replication.39
  • Includes security and reliability improvements for Queued Updating Subscriptions in Transactional Replication.40

In-Memory OLTP

3 items

For: Linux and Windows

  • Addresses a problem where SUBSTRING can read beyond its allocated buffer when processing malformed DBCS varchar input.11
    Occurs in a natively compiled In-Memory OLTP procedure.
  • Addresses an access violation that can make the server stop responding when an NVARCHAR value with an Ideographic Variation Sequence is converted or truncated under a _VSS collation.12
    Occurs in a natively compiled In-Memory OLTP procedure.
  • Addresses a heap buffer overwrite or server hang when streaming NVARCHAR(MAX) data with TEXTSIZE truncation under a _VSS collation.13
    Occurs in a natively compiled In-Memory OLTP procedure using small TDS packet sizes.

PolyBase

3 items

For: Linux and Windows

  • Improves validation of responses from S3-compatible external storage endpoints.14
    Applies during external data access.
  • Prevents PolyBase services from opening raw TCP listeners for the DW Engine and DMS control and data channels when started with modified command-line parameters.21
    Addresses a remote-code-execution vulnerability involving an administrator activating a deprecated feature through modified PolyBase service command-line parameters.
  • Addresses a security vulnerability in configuration processing.23

Security Infrastructure

2 items

For: Linux and Windows

  • Addresses a security vulnerability in Microsoft Entra authentication login handling.15
  • Ensures sensitivity information is consistently included in applicable audit records.27
    Fixes inconsistent population of data_sensitivity_information in records generated by SCHEMA_OBJECT_ACCESS_GROUP.

Backup Restore

2 items
  • Improves the handling of malformed or undersized backup metadata by safely rejecting it.16
    The SQL Server Volume Shadow Copy Service (VSS) Writer processes this metadata.
  • Addresses a vulnerability in the SQL Server managed backup stored procedures.19
    Applies to managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup; customers using managed backup should apply the update through standard SQL Server servicing.

Query Execution

4 items

For: Linux and Windows

  • Addresses arithmetic overflow and out-of-bounds memory access in the LEFT_SHIFT and RIGHT_SHIFT functions, which can terminate SQL Server unexpectedly.17
    The issue occurs with specially crafted shift values or binary inputs.
  • Strengthens input validation to address an issue that could let an authenticated user disclose a limited amount of memory.24
  • Strengthens input validation to address an issue that could let an authenticated user disclose in-memory information.32
  • Strengthens input validation for a case where an authenticated user could provide a pointer that SQL Server reads, potentially causing a dump file or out-of-memory condition.33
    SQL Server dereferences and reads the pointer but does not execute it.

Programmability

2 items
  • Addresses a security issue involving the processing and output of certain internal event data to help protect information.18
  • Addresses improper field offset validation in SqlDataRecord.SetBytes for sql_variant values.34
    Prevents an out-of-bounds heap write that can cause denial of service or elevation of privilege on SQL Server installations and Azure SQL Managed Instances with CLR enabled.

Extended Events

For: Linux and Windows

  • Addresses a security issue where insufficient validation in Extended Events can cause memory corruption.20

XML

3 items

For: Linux and Windows

  • Addresses an XML data type handling bug in DTD attribute lists.22
  • Addresses an integer overflow in the XML reader that can make SQL Server stop responding or terminate unexpectedly.25
    Can occur when processing a specially crafted XML format file through OPENROWSET(BULK...) or BULK INSERT.
  • Addresses an access violation that can terminate SQL Server unexpectedly when processing a query with an extremely large OPTION (USE PLAN) XML declaration.26

Query Store

For: Windows

  • Improves the handling of input to Showplan for security and reliability.35

Known issues

  1. Open Affects: Organizations and IT administrators

    Linked server queries that use MSDASQL fail with error 7416

    Linked server queries using the MSDASQL provider and a provider string (@provstr) fail with error 7416, saying no login mapping exists.41

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Access violation when you query sys.dm_exec_requests during database recovery

    Queries against sys.dm_exec_requests might cause an access violation and generate a dump file if they run while a database is recovering, during RESTORE, startup recovery, or before an availability group replica comes online.42

    How to apply the workaround SQL Trace Flag

    Enable trace flag 4696, avoid querying sys.dm_exec_requests for databases that are recovering, or uninstall this update. With the trace flag enabled, monitoring queries against sys.dm_exec_requests or sys.sysprocesses on secondary replicas might return error 976 or 978, as before the update.42

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5093420, KB5101347, KB5081477, KB5089900
+27 earlier KB5083252, KB5080999, KB5077464, KB5078297, KB5072936, KB5068450, KB5068406, KB5065865, KB5065220, KB5063814, KB5059390, KB5058721, KB5054531, KB5050771, KB5048038, KB5048033, KB5046862, KB5046059, KB5041321, KB5042578, KB5038325, KB5040939, KB5036432, KB5036343, KB5033663, KB5032679, KB5033592
Replaced by
KB5126934
VersionBuildChannel
2022 16.0.4275.2 General availability

Security

52 vulnerabilities fixed
4 critical 48 important
VulnerabilitySeverityCVSS
CVE-2026-67631
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-67643
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-67378
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.0
CVE-2026-67636
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.0

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 52 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package 2022
467.7 MB
sqlserver2022-kb5122768-x64.exe Main update · KB5122768 SHA-1: f78587f6…dc4ba0

Updated components

162 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine126
SQL Server PolyBase3

Sources

Updated
Cited passages from Microsoft's official notes (42)
  1. 1. This fix addresses a security validation issue in SQL Server Agent if SQL Server Agent loads task-agent components. This fix strengthens security validation. support.microsoft.com
  2. 2. This fix addresses reliability and security issues in SQL Server Agent if it processes specific input. support.microsoft.com
  3. 3. This fix addresses an issue in which the SQL WMI Provider processes malformed input incorrectly while preserving existing behavior for valid input. support.microsoft.com
  4. 4. This fix addresses an issue that affects the security and reliability of SQL Server Agent under specific operating conditions. support.microsoft.com
  5. 5. This fix addresses identifier handling and input validation in replication stored procedures to ensure that supplied and stored values are processed correctly. support.microsoft.com
  6. 6. This fix addresses replication stored procedures that incorrectly process identifiers that contains longer or special characters. support.microsoft.com
  7. 7. This fix addresses replication stored procedures that incorrectly process identifiers that contain special characters. support.microsoft.com
  8. 8. This fix addresses input validation for a merge replication metadata stored procedure to ensure that supplied values are processed reliably. support.microsoft.com
  9. 9. This fix addresses a replication stored procedure that handles a caller-supplied path value. support.microsoft.com
  10. 10. This fix addresses input validation for parameters used by replication stored procedures to ensure that supplied values are processed reliably. support.microsoft.com
  11. 11. This fix addresses an issue in which the SUBSTRING function reads beyond the allocated buffer if it processes malformed double-byte character set (DBCS) varchar input. support.microsoft.com
  12. 12. This fix addresses an issue in which converting or truncating an NVARCHAR value that contains an Ideographic Variation Sequence (IVS) under a Variation Selector Sensitive (_VSS) collation causes an access violation. support.microsoft.com
  13. 13. This fix addresses an issue in which streaming NVARCHAR(MAX) data with TEXTSIZE truncation under a Variation Selector Sensitive (_VSS) collation causes a heap buffer overwrite or a server to stop responding. support.microsoft.com
  14. 14. This fix improves the validation of responses from S3-compatible external storage endpoints during external data access. support.microsoft.com
  15. 15. This fix addresses a security vulnerability in Microsoft Entra authentication login handling in SQL Server. support.microsoft.com
  16. 16. This fix addresses the internal validation of backup metadata that's processed by the SQL Server Volume Shadow Copy Service (VSS) Writer to improve the handling of malformed or undersized metadata and ensure that it's rejected safely. support.microsoft.com
  17. 17. This fix addresses arithmetic overflow and out-of-bounds memory access issues in the SQL Server LEFT_SHIFT and RIGHT_SHIFT functions if these functions process specially crafted shift values or binary inputs. support.microsoft.com
  18. 18. This fix addresses a security issue in SQL Server by updating how SQL Server processes and outputs certain internal event data to help protect information. support.microsoft.com
  19. 19. This fix addresses a vulnerability that affects the SQL Server managed backup to the Microsoft Azure stored procedures, managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup. support.microsoft.com
  20. 20. This fix addresses a security issue in SQL Server in which insufficient validation in Extended Events can cause memory corruption. support.microsoft.com
  21. 21. This fix addresses a remote code execution vulnerability in which a user with administrative permissions modifies PolyBase service command-line parameters to activate a deprecated feature support.microsoft.com
  22. 22. This fix addresses an XML data type handling bug in Document Type Definition (DTD) attribute lists. support.microsoft.com
  23. 23. This fix addresses a security vulnerability in configuration processing. support.microsoft.com
  24. 24. This fix addresses an improper input validation issue in SQL Server that allows an authenticated user to disclose a limited amount of memory. support.microsoft.com
  25. 25. This fix addresses an integer overflow in the SQL Server XML reader that occurs if SQL Server processes a specially crafted XML format file through OPENROWSET(BULK...) or BULK INSERT. support.microsoft.com
  26. 26. This fix addresses an access violation that occurs if SQL Server processes a query with an extremely large OPTION (USE PLAN) XML declaration. support.microsoft.com
  27. 27. Fixes an issue where the data_sensitivity_information field is not consistently populated in audit records generated by SCHEMA_OBJECT_ACCESS_GROUP. support.microsoft.com
  28. 28. This fix addresses an issue in which the class ID lookup call reads arbitrary memory. support.microsoft.com
  29. 29. This fix adds bounds validation for embedded attestation fields. support.microsoft.com
  30. 30. This fix strengthens Object Store Format (OSF) deserialization against malformed or malicious stream data. support.microsoft.com
  31. 31. This fix strengthens buffer length validation checks within the enclave code. support.microsoft.com
  32. 32. This fix addresses an improper input validation issue in SQL Server that allows an authenticated user to disclose in‑memory information. support.microsoft.com
  33. 33. This fix addresses an improper input validation issue in SQL Server in which an authenticated user can provide a pointer that SQL Server dereferences and reads but does not execute. support.microsoft.com
  34. 34. This fix addresses improper field offset validation in the SqlDataRecord.SetBytes API for sql_variant values. support.microsoft.com
  35. 35. This fix improves the handling of input to Showplan to enhance security and reliability. support.microsoft.com
  36. 36. This fix addresses an issue that affects the protection of internal replication data during processing operations. support.microsoft.com
  37. 37. This fix addresses an issue in Merge Replication that affects the handling of text data during processing operations. support.microsoft.com
  38. 38. This fix addresses an issue in replication operations that affects validation and handling to enhance security and reliability. support.microsoft.com
  39. 39. This update includes security and reliability improvements for the Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  40. 40. This update includes security and reliability improvements for the Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  41. 41. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com
  42. 42. Enable trace flag 4696 to opt out of the code change that causes this issue. If you enable this trace flag, monitoring queries that query sys.dm_exec_requests or sys.sysprocesses on secondary replicas might return error "976" or error "978" as they did before you installed this update. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 42 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake