Skip to the content
The Update Bureau
SQL Server 2022 GDR SQL Server 2022 GDR Security update
Patch Tuesday

KB5122771

KB5122771: Security update for SQL Server 2022, GDR branch, September 2026. Four critical database code-execution flaws patched

In short

Fixes 52 vulnerabilities, including four critical remote code execution flaws. Some linked server queries using MSDASQL can still fail with error 7416.

Does it affect you? Applies to: Servers running SQL Server 2022 or an applicable SQL Server 2022 GDR release. The update package is for x64 systems; installing it is optional on computers that do not host SQL Server Reporting Services.

Build
16.0.1200.5
Servicing branch
GDR
Security
52 fixed · 4 critical
Restart
Required

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fixes 36 changes

PolyBase

Verified in package 4 items
  • Addresses unsafe deserialization in the SQL Server PolyBase Engine.1
    Bug reference 5370351; SQL Server Engine, Linux and Windows.
  • Prevents PolyBase services from opening raw TCP listeners when modified command-line parameters activate a deprecated feature.3
    Bug reference 5406202; applies to the DW Engine and DMS control and data channels on Linux and Windows.
  • Prevents PolyBase services from opening raw TCP listeners when modified command-line parameters activate a deprecated feature.19
    Bug reference 5493865; applies to the DW Engine and DMS control and data channels; Linux and Windows.
  • Addresses a security vulnerability in configuration processing.27
    Bug reference 5502228; Linux and Windows.

Backup Restore

2 items
  • Addresses a vulnerability in SQL Server managed backup procedures for Microsoft Azure.2
    Bug reference 5383381; affects managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup. Customers using managed backup should apply this update through the standard SQL Server servicing process.
  • Improves safe handling of malformed or undersized backup metadata processed by the SQL Server VSS Writer.4
    Bug reference 5434229; Windows.

SQL Agent

3 items
  • Strengthens security validation when SQL Server Agent loads task-agent components.5
    Bug reference 5442245; Windows.
  • Addresses reliability and security issues when SQL Server Agent processes specific input.6
    Bug reference 5456056; Linux and Windows.
  • Addresses a security and reliability issue in SQL Server Agent under specific operating conditions.15
    Bug reference 5481780; Linux and Windows.

WMI Management Provider (SqlMgmProvider)

  • Corrects how the SQL WMI Provider processes malformed input while preserving behavior for valid input.7
    Bug reference 5459625; Windows.

Security Infrastructure

2 items
  • Addresses a security vulnerability in SQL Server's Microsoft Entra authentication login handling.8
    Bug reference 5462845; Linux and Windows.
  • Ensures sensitivity information is included consistently in applicable audit records.29
    Bug reference 5504609; the data_sensitivity_information field in records generated by SCHEMA_OBJECT_ACCESS_GROUP; Windows.

Replication

10 items
  • Corrects identifier handling and input validation in replication stored procedures.9
    Bug reference 5475786; Linux and Windows.
  • Corrects how replication stored procedures process identifiers containing longer or special characters.10
    Bug reference 5475787; Linux and Windows.
  • Corrects how replication stored procedures process identifiers containing special characters.11
    Bug reference 5475788; Linux and Windows.
  • Improves input validation for a merge replication metadata stored procedure.12
    Bug reference 5475789; Linux and Windows.
  • Addresses a replication stored procedure that handles a caller-supplied path value.13
    Bug reference 5475790; Linux and Windows.
  • Improves input validation for parameters used by replication stored procedures.14
    Bug reference 5475791; Linux and Windows.
  • Addresses a class ID lookup call that reads arbitrary memory.30
    Bug reference 5505125; Windows.
  • Addresses an issue affecting protection of internal replication data during processing.34
    Bug reference 5529341; Linux and Windows.
  • Addresses an issue with handling text data during Merge Replication processing.35
    Bug reference 5529354; Linux and Windows.
  • Addresses an issue with validation and handling in replication operations to improve security and reliability.36
    Bug reference 5529365; Linux and Windows.

In-Memory OLTP

3 items
  • Prevents the SUBSTRING function from reading beyond its allocated buffer when a natively compiled procedure processes malformed DBCS varchar input.16
    Bug reference 5482771; Windows.
  • Prevents an access violation, which can stop the server responding, when a natively compiled procedure converts or truncates certain NVARCHAR values.17
    Bug reference 5482826; occurs with an Ideographic Variation Sequence under a Variation Selector Sensitive (_VSS) collation; Windows.
  • Prevents a heap buffer overwrite that can stop the server responding in certain natively compiled procedures.18
    Bug reference 5482832; involves streaming nvarchar(max) data with SET TEXTSIZE truncation under a _VSS collation and small TDS packet sizes; Windows.

XML

3 items
  • Addresses an XML data type handling bug in DTD attribute lists.20
    Bug reference 5495417; Linux and Windows.
  • Prevents an access violation that can unexpectedly terminate SQL Server when a query has an extremely large OPTION (USE PLAN) XML declaration.21
    Bug reference 5495726; Windows.
  • Addresses an integer overflow in the SQL Server XML reader that can make the process stop responding or terminate unexpectedly.25
    Bug reference 5499866; occurs when processing a specially crafted XML format file through OPENROWSET(BULK...) or BULK INSERT; Linux and Windows.

Query Execution

4 items
  • Addresses arithmetic overflow and out-of-bounds memory access in the LEFT_SHIFT- and RIGHT_SHIFT functions, which can unexpectedly terminate SQL Server.22
    Bug reference 5496450; occurs with specially crafted shift values or binary inputs; Windows.
  • Strengthens input validation to address an issue that could let an authenticated user disclose a limited amount of memory.28
    Bug reference 5502652; Linux and Windows.
  • Strengthens input validation to address an issue that could let an authenticated user disclose in-memory information.31
    Bug reference 5506055; Linux and Windows.
  • Strengthens input validation for a pointer an authenticated user can supply, addressing possible dump-file generation or out-of-memory conditions.32
    Bug reference 5506115; SQL Server dereferences and reads the pointer but does not execute it; Linux and Windows.

Programmability

2 items
  • Changes how SQL Server processes and outputs certain internal event data to help protect information.23
    Bug reference 5496500; Windows.
  • Prevents an out-of-bounds heap write involving SqlDataRecord.SetBytes and sql_variant values.33
    Bug reference 5529185; can cause denial of service or elevation of privilege when CLR is enabled, including in SQL Server installations and Azure SQL Managed Instances; Windows.

Extended Events

2 items
  • Addresses a security issue where insufficient validation in Extended Events can cause memory corruption.24
    Bug reference 5499334; Linux and Windows.
  • Resolves security vulnerabilities that can disclose information or cause denial of service when the Database Engine reads a specially crafted Extended Events file.26
    Bug reference 5500005; .xel files; Linux and Windows.

Improvements 8 changes

Replication

6 items
  • Improves internal validation and security checks for replication stored procedures.37
    Bug reference 5467596; ensures replication operations use expected security safeguards; Linux and Windows.
  • Adds bounds validation for embedded attestation fields.39
    Bug reference 5505434; Windows.
  • Strengthens Object Store Format deserialization against malformed or malicious stream data.40
    Bug reference 5505444; Windows.
  • Strengthens buffer length validation checks within enclave code.41
    Bug reference 5505470; Windows.
  • Adds security and reliability improvements for Queued Updating Subscriptions in Transactional Replication.43
    Bug reference 5529377; Windows.
  • Adds security and reliability improvements for Queued Updating Subscriptions in Transactional Replication.44
    Bug reference 5529389; Windows.

PolyBase

  • Improves validation of responses from S3-compatible external storage endpoints during external data access.38
    Bug reference 5487341; Linux and Windows.

Query Store

  • Improves how Showplan handles input for better security and reliability.42
    Bug reference 5529200; Windows.

Known issues

  1. Open Affects: Not stated by the source

    Linked server queries that use MSDASQL fail with error 7416

    Linked server queries that use the MSDASQL provider and specify a provider string (@provstr) can fail with error 7416. Stricter Database Engine connection validation can reject certain configurations, even if earlier builds allowed them; the error message does not establish that a login mapping is actually missing.45

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Servicing branch
GDR
Restart
Required
Replaces
KB5102334, KB5091158, KB5084815, KB5077465
+11 earlier KB5073031, KB5068407, KB5065221, KB5063756, KB5058712, KB5046861, KB5046057, KB5042211, KB5040936, KB5035432, KB5032968
Replaced by
KB5128493
VersionBuildChannel
2022 16.0.1200.5 General availability

Security

52 vulnerabilities fixed
4 critical 48 important
VulnerabilitySeverityCVSS
CVE-2026-67631
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-67643
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-67378
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.0
CVE-2026-67636
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.0

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 52 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package 2022
350.8 MB
sqlserver2022-kb5122771-x64.exe Main update · KB5122771 SHA-1: 9e56dc2d…8050ac

Updated components

146 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine114
SQL Server PolyBase3

Verified in package: changed files confirm PolyBase.

Sources

Updated
Cited passages from Microsoft's official notes (45)
  1. 1. This fix addresses an unsafe deserialization in SQL Server PolyBase Engine. support.microsoft.com
  2. 2. This fix addresses a vulnerability that affects the SQL Server managed backup to the Microsoft Azure stored procedures, managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup. support.microsoft.com
  3. 3. The fix prevents PolyBase services from opening raw TCP listeners for the DW Engine and DMS control and data channels if the services start by having modified command-line parameters. support.microsoft.com
  4. 4. This fix addresses the internal validation of backup metadata that's processed by the SQL Server Volume Shadow Copy Service (VSS) Writer to improve handling of malformed or undersized metadata and ensure that it's rejected safely. support.microsoft.com
  5. 5. This fix addresses a security validation issue in SQL Server Agent if SQL Server Agent loads task-agent components. support.microsoft.com
  6. 6. This fix addresses reliability and security issues in SQL Server Agent if it processes specific input. support.microsoft.com
  7. 7. This fix addresses an issue in which the SQL WMI Provider processes malformed input incorrectly while preserving existing behavior for valid input. support.microsoft.com
  8. 8. This fix addresses a security vulnerability in Microsoft Entra authentication login handling in SQL Server. support.microsoft.com
  9. 9. This fix addresses identifier handling and input validation in replication stored procedures to ensure that supplied and stored values are processed correctly. support.microsoft.com
  10. 10. This fix addresses replication stored procedures that incorrectly process identifiers that contain longer or special characters. support.microsoft.com
  11. 11. This fix addresses replication stored procedures that incorrectly process identifiers that contain special characters. support.microsoft.com
  12. 12. This fix addresses input validation for a merge replication metadata stored procedure to ensure that supplied values are processed reliably. support.microsoft.com
  13. 13. This fix addresses a replication stored procedure that handles a caller-supplied path value. support.microsoft.com
  14. 14. This fix addresses input validation for parameters that are used by replication stored procedures to ensure that supplied values are processed reliably. support.microsoft.com
  15. 15. This fix addresses an issue that affects the security and reliability of SQL Server Agent under specific operating conditions. support.microsoft.com
  16. 16. This fix addresses an issue in which the SUBSTRING function reads beyond the allocated buffer if it processes malformed double-byte character set (DBCS) varchar input. support.microsoft.com
  17. 17. This fix addresses an issue in which converting or truncating an NVARCHAR value that contains an Ideographic Variation Sequence (IVS) under a Variation Selector Sensitive (_VSS) collation causes an access violation. support.microsoft.com
  18. 18. This fix addresses an issue in which a natively compiled stored procedure causes a heap buffer overwrite while streaming nvarchar(max) data that has SET TEXTSIZE truncation under a Variation Selector Sensitive (_VSS) collation. support.microsoft.com
  19. 19. The fix prevents PolyBase services from opening raw TCP listeners for the DW Engine and DMS control and data channels if the services start by having modified command-line parameters. support.microsoft.com
  20. 20. This fix addresses an XML data type handling bug in Document Type Definition (DTD) attribute lists. support.microsoft.com
  21. 21. This fix addresses an access violation that occurs if SQL Server processes a query that has an extremely large OPTION (USE PLAN) XML declaration. support.microsoft.com
  22. 22. This fix addresses arithmetic overflow and out-of-bounds memory access issues in the SQL Server LEFT_SHIFT- and RIGHT_SHIFT functions if these functions process specially crafted shift values or binary inputs. support.microsoft.com
  23. 23. This fix addresses a security issue in SQL Server by updating how SQL Server processes and outputs certain internal event data to help protect information. support.microsoft.com
  24. 24. This fix addresses a security issue in SQL Server in which insufficient validation in Extended Events can cause memory corruption. support.microsoft.com
  25. 25. This fix addresses an integer overflow in the SQL Server XML reader that occurs if SQL Server processes a specially crafted XML format file through OPENROWSET(BULK...) or BULK INSERT. support.microsoft.com
  26. 26. This fix resolves several security vulnerabilities that allow information disclosure or a denial of service if the database engine reads a specially crafted Extended Events (.xel) file. support.microsoft.com
  27. 27. This fix addresses a security vulnerability in configuration processing. support.microsoft.com
  28. 28. This fix addresses an improper input validation issue in SQL Server that allows an authenticated user to disclose a limited amount of memory. support.microsoft.com
  29. 29. Fixes an issue in which the data_sensitivity_information field is not consistently populated in audit records that are generated by SCHEMA_OBJECT_ACCESS_GROUP. support.microsoft.com
  30. 30. This fix addresses an issue in which the class ID lookup call reads arbitrary memory. support.microsoft.com
  31. 31. This fix addresses an improper input validation issue in SQL Server that allows an authenticated user to disclose in-memory information. support.microsoft.com
  32. 32. This fix addresses an improper input validation issue in SQL Server in which an authenticated user can provide a pointer that SQL Server dereferences and reads but does not execute. support.microsoft.com
  33. 33. This fix addresses improper field offset validation in the SqlDataRecord.SetBytes API forsql_variant values. support.microsoft.com
  34. 34. This fix addresses an issue that affects the protection of internal replication data during processing operations. support.microsoft.com
  35. 35. This fix addresses an issue in Merge Replication that affects the handling of text data during processing operations. support.microsoft.com
  36. 36. A stricter connection validation check in the Database Engine can reject connections for certain linked server configurations that use the MSDASQL provider, even if earlier builds allowed those connections. support.microsoft.com
  37. 37. This fix improves internal validation and security checks for SQL Server replication stored procedures to ensure that replication operations are processed by using the expected security safeguards. support.microsoft.com
  38. 38. This fix improves the validation of responses from S3-compatible external storage endpoints during external data access. support.microsoft.com
  39. 39. This fix adds bounds validation for embedded attestation fields. support.microsoft.com
  40. 40. This fix strengthens Object Store Format (OSF) deserialization against malformed or malicious stream data. support.microsoft.com
  41. 41. This fix strengthens buffer length validation checks within enclave code. support.microsoft.com
  42. 42. This fix improves the handling of input to Showplan to enhance security and reliability. support.microsoft.com
  43. 43. To apply this update, you must have SQL Server 2022 or any SQL Server 2022 GDR release through this SQL Server 2022 GDR installed. support.microsoft.com
  44. 44. This update includes security and reliability improvements for the Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  45. 45. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com
Checked automatically: 8 of 8 checks passed, 45 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake