Skip to the content
The Update Bureau

SQL Server

SQL Server updates

All published releases for SQL Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 12, 2026.

9 active known issues →

Latest build per version

SQL Server updates

  • SQL Server 2025 CU11 SQL Server 2025 CU11 Cumulative update
    Updated

    KB5129223

    Parallel SESSION_CONTEXT queries can return wrong results

    Queries using SESSION_CONTEXT might return wrong results or create crash dump files when they run in parallel; this remains a known issue. CU11 includes 70 fixes for SQL Server 2025.

    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 70 changes

    • New High Availability and Disaster Recovery: Certificate authentication is supported for endpoints on systems that use only TLS 1.3.
    • New High Availability and Disaster Recovery: Service Broker endpoints can use TLS through Schannel.
    • New Programmability: A new Japanese collation is available for databases.

    Read update Source: Microsoft

    Build
    17.0.5065.9
    Restart
    Required
  • SQL Server 2022 CU28 SQL Server 2022 CU28 Cumulative update
    Updated

    KB5125472

    Replication safeguards, SQL engine fixes, and new link tools

    SQL Server 2022 CU28 adds replication and database safety checks, fixes a range of engine and integration issues, and adds tools for Azure SQL Managed Instance links. Queries using SESSION_CONTEXT in parallel plans might still return wrong results or cause access violations.

    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 91 changes

    • New Methods to access stored data: Trace flag 697 can disable HoBt schema-latch promotion without disabling all superlatching.
    • New Methods to access stored data: Trace flag 683 can reduce CPU overhead when latch promotion occurs without counter partitioning.
    • New High Availability and Disaster Recovery: Three procedures can restart seeding, repair a broken link, and check database health in multi-database link mode with Azure SQL Manage...

    Read update Source: Microsoft

    Build
    16.0.4325.4
    Restart
    Required
  • SQL Server 2025 CU10 + GDR SQL Server 2025 CU10 + GDR Security update
    Updated

    KB5129299

    Recovery monitoring queries can crash the database engine

    Queries against `sys.dm_exec_requests` might raise an access violation while a database is recovering. The release also fixes security flaws across SQL Server components.

    Known issues: 1 open Organizations and IT administrators
    • Access violation when you query sys.dm_exec_requests during database recovery

    Key changes 59 CVEs · 71 changes

    • Improved Integration Services: XSLT scripting is disabled by default.
    • Improved Methods to access stored data: Security for index operations is improved.
    • Improved Methods to access stored data: Security for transaction logging is improved.

    Read update Source: Microsoft

    Build
    17.0.5045.3
    Security
    59 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2025 GDR SQL Server 2025 GDR Security update
    Updated

    KB5132748

    Replication and database data-handling flaws fixed

    Fixes SQL Server security flaws and memory-safety problems across database, JSON, and replication tasks. Some fixes prevent crashes or unintended data exposure.

    Key changes 58 CVEs · 59 changes

    • Improved Integration Services: XSLT scripting is off by default. You can restore the previous behavior with a setting.
    • Improved Replication: Merge replication checks names more carefully.
    • Improved Replication: Transactional replication checks names more carefully.

    Read update Source: Microsoft

    Build
    17.0.1155.3
    Security
    58 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 CU27 + GDR SQL Server 2022 CU27 + GDR Security update
    Updated

    KB5129300

    Recovery-time queries may trigger access violations

    Database monitoring queries during recovery might cause an access violation and create a dump file. The security update also fixes vulnerabilities; avoid those queries or use trace flag 4696 as a mitigation.

    Known issues: 1 open Organizations and IT administrators
    • Access violation when you query sys.dm_exec_requests during database recovery

    Key changes 55 CVEs · 51 changes

    • Improved Methods to access stored data: Security for SQL Server index operations is improved.
    • Improved Methods to access stored data: Security for transaction logging in SQL Server is improved.
    • Improved Access Methods: Sparse column data checks are improved to strengthen security and reliability.

    Read update Source: Microsoft

    Build
    16.0.4315.2
    Security
    55 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update
    Updated

    KB5132747

    Database vulnerabilities addressed; replication checks strengthened

    Database security fixes address vulnerabilities, while changes improve replication checks and prevent unsafe memory access. The update can request a restart.

    Key changes 54 CVEs · 52 changes

    • Improved Replication: Identifier checks for merge replication are improved.
    • Improved Replication: Identifier checks for transactional replication are improved.
    • Improved Methods to access stored data: Index operations have improved security checks.

    Read update Source: Microsoft

    Build
    16.0.1220.3
    Security
    54 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update
    Updated

    KB5132745

    Replication and SSIS memory flaws fixed; XSLT scripting disabled

    SQL Server 2019 gets fixes for memory errors and replication security. Integration Services also disables XSLT scripting by default.

    Key changes 51 CVEs · 48 changes

    • Improved Methods to access stored data: Index operations have stronger security protections.
    • Improved Methods to access stored data: Transaction logging has stronger security protections.
    • Improved Access Methods: SQL Server checks sparse column data more carefully to improve security and reliability.

    Read update Source: Microsoft

    Build
    15.0.4510.2
    Security
    51 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update
    Updated

    KB5132751

    Replication and Integration Services flaws fixed

    SQL Server 2019 gets fixes for security flaws and data-handling errors across replication, the database engine, and Integration Services.

    Key changes 50 CVEs · 47 changes

    • Improved Methods to access stored data: Security checks for index operations are improved.
    • Improved Methods to access stored data: Security for transaction logging is improved.
    • Improved Access Methods: Validation of sparse column data is improved for security and reliability.

    Read update Source: Microsoft

    Build
    15.0.2210.4
    Security
    50 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update
    Updated

    KB5132746

    Database and replication flaws fixed; XSLT scripting disabled

    Security fixes address flaws in database processing and replication, and XSLT scripting is now disabled by default. The update can request a restart.

    Key changes 51 CVEs · 48 changes

    • Improved Methods to access stored data: Security checks for database index operations are stronger.
    • Improved Methods to access stored data: Security checks for database transaction logs are stronger.
    • Improved Access Methods: Checks on sparse column data are stronger, helping protect data and reliability.

    Read update Source: Microsoft

    Build
    14.0.3570.2
    Security
    51 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update
    Updated

    KB5132749

    Replication flaws fixed; XSLT scripting disabled by default

    Replication and memory-safety fixes address security risks, and XSLT scripting is disabled by default. SQL Server 2017 security updates end on October 12, 2027.

    Security updates for SQL Server 2017 are scheduled to end on October 12, 2027.

    Key changes 48 CVEs · 47 changes

    • Improved Methods to access stored data: Index operations have stronger security checks.
    • Improved Methods to access stored data: Transaction logging has stronger security.
    • Improved Access Methods: Sparse column data receives stronger checks for security and reliability.

    Read update Source: Microsoft

    Build
    14.0.2150.2
    Security
    48 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2025 CU10 SQL Server 2025 CU10 Cumulative update
    Updated

    KB5125471

    Recovery checks can trigger access violations

    Queries against `sys.dm_exec_requests` during database recovery can trigger access violations and dump files. CU10 also leaves open an issue where parallel `SESSION_CONTEXT` queries can return wrong results.

    Check the newer update, KB5129299
    Known issues: 2 open
    • Access violation when you query sys.dm_exec_requests during database recovery
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 37 changes

    • New Programmability: SQL Server on Linux can map Windows time-zone IDs to new and updated IANA time zones.
    • Improved Extensibility: The archive extraction component used to install external language and library packages is updated.
    • Improved High Availability and Disaster Recovery: Availability group secondary replicas now reject oversized FILESTREAM fragments.

    Read update Source: Microsoft

    Build
    17.0.5035.5
    Restart
    Required
  • SQL Server 2025 CU9 + GDR SQL Server 2025 CU9 + GDR Security update
    Updated

    KB5126967

    Backup and PolyBase flaws fixed; recovery queries can crash

    Security fixes cover SQL Server components used for backup, PolyBase, and replication. Queries during database recovery can still trigger an access violation; a trace-flag mitigation is available.

    Check the newer update, KB5129299
    Known issues: 2 open
    • Linked server queries that use MSDASQL fail with error 7416
    • Access violation when you query sys.dm_exec_requests during database recovery

    Key changes 24 CVEs · 25 changes

    • Improved High Availability and Disaster Recovery: Oversized backup fragments on secondary database copies are rejected.
    • Improved PolyBase: Incoming changes to a table are checked against its expected layout.
    • Improved PolyBase: Data sharing with external data tools uses updated memory handling.

    Read update Source: Microsoft

    Build
    17.0.5015.4
    Security
    24 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2025 GDR SQL Server 2025 GDR Security update
    Updated

    KB5128492

    23 SQL vulnerabilities addressed; MSDASQL linked queries still fail

    Addresses 23 SQL Server vulnerabilities, including 22 rated Important. Linked server queries using MSDASQL can still fail with error 7416 in some configurations.

    Check the newer update, KB5132748
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 23 CVEs · 27 changes

    • Improved Extensibility: Package extraction uses an updated archive-extraction component when external language or external library packages are installed.
    • Improved High Availability and Disaster Recovery: Availability Group secondary replicas reject oversized FILESTREAM fragments.
    • Improved Query Store: Showplan input handling is more secure and reliable.

    Read update Source: Microsoft

    Build
    17.0.1145.4
    Security
    23 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 CU27 + GDR SQL Server 2022 CU27 + GDR Security update
    Updated

    KB5126934

    Recovery queries may raise access violations; security flaws fixed

    Security fixes cover SQL Server components. Queries against `sys.dm_exec_requests` during database recovery might raise an access violation and create a dump file.

    Check the newer update, KB5129300
    Known issues: 2 open
    • Linked server queries that use MSDASQL fail with error 7416
    • Access violation when you query sys.dm_exec_requests during database recovery

    Key changes 23 CVEs · 23 changes

    • Improved High Availability and Disaster Recovery: Availability Group secondary replicas now reject oversized FILESTREAM fragments.
    • Improved Backup Restore: Invalid size values in backup paths are checked before they can cause unsafe memory access.
    • Improved Backup Restore: A backup and restore metadata issue could let a local authenticated user gain elevated privileges or stop a service. The update adds ch...

    Read update Source: Microsoft

    Build
    16.0.4305.5
    Security
    23 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update
    Updated

    KB5128493

    PolyBase security flaws addressed; linked server queries can fail

    Fixes 22 Important SQL Server vulnerabilities. Linked server queries using MSDASQL and a provider string might fail with error 7416.

    Check the newer update, KB5132747
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 22 CVEs · 24 changes

    • Improved Extensibility: Package extraction uses an updated archive-extraction component when external language or external library packages are installed.
    • Improved High Availability and Disaster Recovery: Oversized FILESTREAM fragments are rejected on Availability Group secondary replicas.
    • Improved Query Store: Showplan input handling is improved for security and reliability.

    Read update Source: Microsoft

    Build
    16.0.1210.3
    Security
    22 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update
    Updated

    KB5128494

    Database Engine vulnerabilities fixed; MSDASQL queries can fail

    Fixes 21 vulnerabilities in SQL Server 2019. Linked-server queries using MSDASQL with a provider string can fail with error 7416.

    Check the newer update, KB5132745
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 21 CVEs · 22 changes

    • Improved Extensibility: Package extraction uses an updated component when external language or external library packages are installed.
    • Improved High Availability and Disaster Recovery: Availability Group secondary replicas reject oversized FILESTREAM fragments.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.

    Read update Source: Microsoft

    Build
    15.0.4500.2
    Security
    21 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update
    Updated

    KB5128495

    21 vulnerabilities fixed; MSDASQL linked queries can fail

    The update fixes 21 vulnerabilities in SQL Server 2019 GDR. A known issue can make linked server queries using MSDASQL and a provider string fail with error 7416.

    Check the newer update, KB5132751
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 21 CVEs · 22 changes

    • Improved Extensibility: Package extraction uses an updated third-party component when external language or external library packages are installed.
    • Improved High Availability and Disaster Recovery: Availability Group secondary replicas reject oversized FILESTREAM fragments.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.

    Read update Source: Microsoft

    Build
    15.0.2200.2
    Security
    21 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update
    Updated

    KB5128496

    Database Engine vulnerability fixes; MSDASQL queries can fail

    Fixes security vulnerabilities in SQL Server 2017, but linked server queries using MSDASQL and a provider string might fail with error 7416.

    Check the newer update, KB5132746
    SQL Server 2017 security updates are scheduled to end on October 12, 2027.
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 14 CVEs · 15 changes

    • Improved High Availability and Disaster Recovery: Availability Group secondary replicas reject oversized FILESTREAM fragments.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.

    Read update Source: Microsoft

    Build
    14.0.3560.2
    Security
    14 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update
    Updated

    KB5128497

    SQL Satellite flaws fixed; MSDASQL linked queries can fail

    The update fixes 14 vulnerabilities, including flaws in SQL Satellite and the Virtual Device Interface. Some linked-server queries that use MSDASQL can still fail with error 7416.

    Check the newer update, KB5132749
    Security updates for SQL Server 2017 are scheduled to end October 12, 2027.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 14 CVEs · 15 changes

    • Improved High Availability and Disaster Recovery: Availability Group secondary replicas reject oversized FILESTREAM fragments.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.

    Read update Source: Microsoft

    Build
    14.0.2140.2
    Security
    14 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2025 CU9 SQL Server 2025 CU9 Cumulative update

    KB5122048

    Parallel session results can be wrong; recovery queries can crash

    CU9 for SQL Server 2025 includes 45 fixes, but it also has open issues that can affect parallel SESSION_CONTEXT queries, MSDASQL linked servers, and queries during database recovery.

    Check the newer update, KB5126967
    Known issues: 3 open
    • Linked server queries that use MSDASQL fail with error 7416
    • Access violation when you query sys.dm_exec_requests during database recovery
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 45 changes

    • New SQL OS: Manual soft-NUMA configuration is available for the Standard and Standard Developer editions.
    • New High Availability and Disaster Recovery: Managed Instance link supports linking multiple databases so they can be replicated and failed over together.
    • Improved Backup Restore: Malformed or undersized backup metadata is rejected more safely.

    Read update Source: Microsoft

    Build
    17.0.5005.3
    Restart
    Required
  • SQL Server 2022 CU27 SQL Server 2022 CU27 Cumulative update

    KB5104824

    New multi-database link mode; recovery queries can trigger access violations

    Adds a multi-database link mode and includes 42 fixes. Open issues include incorrect SESSION_CONTEXT results in parallel plans and access violations during database recovery.

    Check the newer update, KB5126934
    Known issues: 4 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416
    • Access violation when you query sys.dm_exec_requests during database recovery
    • and 2 more

    Key changes 42 changes

    • New High Availability and Disaster Recovery: Managed Instance link can use multiple-database link mode to extend an existing availability group to Azure SQL Managed Instance and re...
    • Improved Backup Restore: Backup metadata that is malformed or too small is rejected safely.
    • Improved SQL Agent: Security validation improves when SQL Server Agent loads task agent components.

    Read update Source: Microsoft

    Build
    16.0.4295.3
    Restart
    Required
  • SQL Server 2025 CU8 + GDR SQL Server 2025 CU8 + GDR Security update

    KB5122769

    Four critical remote-code flaws fixed; MSDASQL queries may fail

    Fixes 56 vulnerabilities, including four critical SQL Server remote-code execution flaws. Linked-server queries using MSDASQL with a provider string can fail, and queries during database recovery can trigger an access violation.

    Check the newer update, KB5126967
    Known issues: 2 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416
    • Access violation when you query sys.dm_exec_requests during database recovery

    Key changes 56 CVEs · 47 changes

    • Improved PolyBase: Validation of responses from S3-compatible external storage endpoints improves.
    • Improved Replication: Security checks for replication stored procedures are strengthened so operations use the expected safeguards.
    • Improved Replication: Object Store Format deserialization is strengthened against malformed or malicious stream data.

    Read update Source: Microsoft

    Build
    17.0.4085.5
    Security
    56 fixed · 4 critical
    Restart
    Required
  • SQL Server 2025 GDR SQL Server 2025 GDR Security update

    KB5122770

    Critical database flaws addressed; linked-server queries may fail

    Addresses 56 SQL Server vulnerabilities, including four critical remote-code-execution flaws. Linked server queries using MSDASQL and a provider string can fail with error 7416.

    Check the newer update, KB5128492
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 56 CVEs · 42 changes

    • Improved PolyBase: Responses from S3-compatible external storage are validated more carefully.
    • Improved Query Store: Showplan input handling is improved for security and reliability.
    • Improved Replication: Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.

    Read update Source: Microsoft

    Build
    17.0.1135.8
    Security
    56 fixed · 4 critical
    Restart
    Required
  • SQL Server 2022 CU26 + GDR SQL Server 2022 CU26 + GDR Security update

    KB5122768

    Remote-code flaws patched; two issues remain open

    The update fixes 52 vulnerabilities, including four critical remote-code-execution flaws. KB5126934 supersedes it, so use the newer update rather than installing this package.

    Check the newer update, KB5126934
    Known issues: 2 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416
    • Access violation when you query sys.dm_exec_requests during database recovery

    Key changes 52 CVEs · 40 changes

    • Fix SQL Agent: Addresses a security validation issue when SQL Server Agent loads task-agent components.
    • Fix SQL Agent: Addresses reliability and security issues when SQL Server Agent processes specific input.
    • Fix WMI Management Provider (SqlMgmProvider): Addresses incorrect handling of malformed input while preserving the existing behavior for valid input.

    Read update Source: Microsoft

    Build
    16.0.4275.2
    Security
    52 fixed · 4 critical
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5122771

    Four critical database code-execution flaws patched

    Fixes 52 vulnerabilities, including four critical remote code execution flaws. Some linked server queries using MSDASQL can still fail with error 7416.

    Check the newer update, KB5128493
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 52 CVEs · 44 changes

    • Improved Replication: Improves internal validation and security checks for replication stored procedures.
    • Improved PolyBase: Improves validation of responses from S3-compatible external storage endpoints during external data access.
    • Improved Replication: Adds bounds validation for embedded attestation fields.

    Read update Source: Microsoft

    Build
    16.0.1200.5
    Security
    52 fixed · 4 critical
    Restart
    Required