Skip to the content
The Update Bureau

SQL Server 2016

SQL Server 2016

Every published release for SQL Server 2016, newest first: what each update changes, whether to install it and any confirmed known issues.

Latest
KB5102339 Jul 14, 2026
Build
13.0.7095.1
Released
Jun 1, 2016
Cumulative updates
no longer updated since Jul 13, 2021
Security updates
no longer updated since Jul 14, 2026
Known issues
4 open

Latest update · Latest per branch (Branch)

Which branch am I on? →

Build history

  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update
    Final update for this version

    KB5102339

    Untrusted MSMQ messages blocked from triggering code execution

    The update patches SQL Server security vulnerabilities, including a critical remote code execution flaw. Linked-server queries using MSDASQL can still fail with error 7416 in certain configurations.

    July 14, 2026 is the final date for SQL Server 2016 security updates.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: Untrusted Microsoft Message Queuing messages can no longer trigger remote code execution through MessageQueueTask deserialization.
    • Fix Query Execution: Using the input-buffer function or command no longer causes a memory leak.
    • Fix Replication: Input passed to an internal replication stored procedure is validated and sanitized before the procedure uses it.

    Read update Source: Microsoft

    Build
    13.0.7095.1
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update
    Final update for this version

    KB5102340

    Remote code execution flaw fixed; linked-server queries can fail

    The update fixes four vulnerabilities, including critical remote code execution vulnerability CVE-2026-54118. Linked-server queries using MSDASQL with a provider string can fail with error 7416.

    July 14, 2026 is the final date for SQL Server 2016 security updates.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: Untrusted MSMQ messages can no longer use the affected deserialization path to cause remote code execution.
    • Fix Query Execution: The memory leak associated with using the input-buffer function or command is resolved.
    • Fix Replication: Input passed to an internal replication procedure is checked and sanitized before the procedure uses it.

    Read update Source: Microsoft

    Build
    13.0.6500.1
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5089270

    Web Service Task flaw addressed; linked-server error remains

    The update addresses an XML external entity vulnerability in the Web Service Task. Linked server queries using MSDASQL can still fail with error 7416.

    Check the newer update, KB5102339
    SQL Server 2016 security updates end July 14, 2026.
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The Web Service Task fix addresses an XML external entity vulnerability that could let an attacker read local files or cause a denial-o...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7085.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5089271

    Web Service Task XML vulnerability addressed; linked queries fail

    The update addresses an XML external entity vulnerability in the Web Service Task. Linked server queries using MSDASQL can still fail with error 7416; Microsoft links to troubleshooting information and workarounds.

    Check the newer update, KB5102340
    Security updates for SQL Server 2016 end on July 14, 2026.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The Web Service Task's XML handling is addressed for a vulnerability that could let an attacker read local files or cause a denial of s...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6490.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5084820

    Linked-server privilege flaw addressed; MSDASQL queries fail

    The update addresses two SQL Server elevation-of-privilege vulnerabilities. Linked-server queries using MSDASQL with a provider string might fail with error 7416.

    Check the newer update, KB5089270
    Security updates for SQL Server 2016 are scheduled to end July 14, 2026.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: Addresses a linked-server vulnerability that could let a low-privileged SQL Server user gain sysadmin permissions.
    • Fix SQL Agent: Resolves a SQL injection issue that could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7080.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5084821

    MSDASQL linked-server queries fail with error 7416

    The update addresses two SQL Server elevation-of-privilege vulnerabilities. Linked-server queries using MSDASQL with a provider string fail with error 7416.

    Check the newer update, KB5089271
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: Addresses a vulnerability that could let a low-privileged SQL Server user gain sysadmin permissions through linked servers.
    • Fix SQL Agent: Resolves a SQL injection issue that could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6485.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5077473

    Merge replication privilege flaw fixed; Administrator changes blocked

    The update fixes two Important SQL Server vulnerabilities, including publicly disclosed CVE-2026-21262, and blocks ALTER USER operations that target the system Administrator account.

    Check the newer update, KB5084820
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 2 CVEs · 2 changes

    • Fix Replication: A vulnerability in the merge replication version upgrade process is fixed.
    • Fix Security Infrastructure: Changing a user when the target login is the system Administrator account is blocked.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7075.5
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5077474

    Merge replication privilege flaw fixed; Administrator login protected

    Fixes two important vulnerabilities in SQL Server 2016 SP3 GDR, including a publicly disclosed elevation-of-privilege flaw. It also blocks ALTER USER when the target is the system Administrator account.

    Check the newer update, KB5084821
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 2 CVEs · 2 changes

    • Fix Replication: The merge replication version-upgrade process no longer has the elevation-of-privilege vulnerability addressed by this update.
    • Fix Security Infrastructure: The ALTER USER operation is blocked when the target login is the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6480.4
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5068400

    Backup procedure access restricted to reduce SQL injection risk

    The update addresses CVE-2025-59499, an elevation-of-privilege vulnerability, and restricts access to an internal backup procedure to reduce SQL injection risk.

    Check the newer update, KB5077473
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 1 CVE · 1 change

    • Fix Management Services: Access to an internal backup procedure is restricted, and its inputs are sanitized to reduce SQL injection risk.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7070.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5068401

    SQL injection risk in an internal backup procedure reduced

    The update reduces SQL injection risk in an internal backup procedure and addresses one Important SQL Server elevation-of-privilege vulnerability.

    Check the newer update, KB5077474
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 1 CVE · 1 change

    • Fix Management Services: An internal backup procedure that was exposed to all users has restricted access, reducing SQL injection risk.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6475.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5065227

    DMV data exposure and temporal cleanup flaws fixed

    The update fixes SQL Server vulnerabilities involving sensitive statement text, temporal-table cleanup and Newtonsoft.Json. One vulnerability, CVE-2024-21907, is publicly disclosed.

    Check the newer update, KB5068400
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: Integration Services uses an updated Newtonsoft.Json component to address a vulnerability.
    • Fix Master Data Services: Master Data Services uses an updated Newtonsoft.Json component to address a vulnerability.
    • Fix Programmability: In specific scenarios, sensitive data in statements running in other sessions is protected from inspection.

    Read update Source: Microsoft

    Build
    13.0.7065.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5065226

    Three vulnerabilities addressed, including a sensitive-data exposure fix

    Addresses three vulnerabilities and fixes issues involving sensitive statement text and temporal history table cleanup in SQL Server.

    Check the newer update, KB5068401

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: Integration Services updates Newtonsoft.Json to address a vulnerability.
    • Fix Master Data Services: Master Data Services updates Newtonsoft.Json to address a vulnerability.
    • Fix Programmability: An issue that could expose sensitive statement text through DMVs in specific scenarios is fixed.

    Read update Source: Microsoft

    Build
    13.0.6470.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5063761

    SQL injection and privilege-escalation flaws addressed in the engine

    Four Important SQL Server vulnerabilities are addressed, including SQL injection and elevation-of-privilege risks. The fixes also restrict login password resets and reduce permissions for built-in SQL Agent jobs.

    Check the newer update, KB5065227
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: A SQL injection vulnerability in a system stored procedure is addressed.
    • Fix Security Infrastructure: Logins with ALTER ANY LOGIN can no longer use that permission to reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOG...
    • Fix SQL Agent: Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.

    Read update Source: Microsoft

    Build
    13.0.7060.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5063762

    Stored-procedure SQL injection and login privilege flaws blocked

    Fixes four Important SQL Server vulnerabilities, including flaws that could allow SQL injection or elevation of privilege.

    Check the newer update, KB5065226
    Security updates for SQL Server 2016 are scheduled to end July 14, 2026.

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: A SQL injection vulnerability in a system stored procedure is fixed.
    • Fix Security Infrastructure: Logins with ALTER ANY LOGIN permission can no longer reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissio...
    • Fix SQL Agent: Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.

    Read update Source: Microsoft

    Build
    13.0.6465.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5058717

    Information disclosure flaw and setup restarts addressed

    The update addresses one publicly disclosed Important SQL Server information disclosure vulnerability and fixes a rare query execution issue plus SQL Setup restarts that could prevent setup from continuing.

    Check the newer update, KB5063761

    Key changes 1 CVE · 2 changes

    • Fix Query Execution: In rare cases, variable length parameters no longer allow uninitialized memory to be read.
    • Fix Patching: SQL Setup no longer encounters the restart issue that could prevent setup from continuing after a previous Windows update.
    • CVSS 7.5 CVE-2025-49719: Microsoft SQL Server Information Disclosure Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7055.9
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5058718

    Native Client code-execution and data-disclosure flaws addressed

    The update addresses two Important vulnerabilities, including publicly disclosed CVE-2025-49719 (information disclosure) and CVE-2024-49000 (remote code execution). It also fixes three SQL Server connectivity, query execution, and setup issues.

    Check the newer update, KB5063762
    SQL Server 2016 security updates end on July 14, 2026.

    Key changes 2 CVEs · 3 changes

    • Fix SQL Connectivity: Fixes known functional problems in SQL Server Native Client that were introduced in the November GDR.
    • Fix Query Execution: Fixes rare cases where uninitialized memory can be read when using variable-length parameters.
    • Fix Patching: Fixes restarts and setup interruptions caused by a previous Windows update.

    Read update Source: Microsoft

    Build
    13.0.6460.7
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5046856

    SQL OS remote-code execution flaws addressed; SQL Agent failure fixed

    Addresses remote-code-execution vulnerabilities and fixes an “unknown token” failure in SQL Agent jobs after the October 2024 security update.

    Check the newer update, KB5058717

    Key changes 31 CVEs · 3 changes

    • Fix SQL OS: Remote code execution through DLL planting on a SQL Server instance is addressed.
    • Fix SQL OS: A SQL Server assembly vulnerability that might allow remote code execution is addressed.
    • Fix SQL OS: SQL Agent jobs no longer fail with an “unknown token” error after the October 2024 security update.

    Read update Source: Microsoft

    Build
    13.0.7050.2
    Security
    31 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5046855

    Native Client flaws patched; SQL Agent error needs another update

    Addresses 31 vulnerabilities: 30 Important and one unrated. If SQL Agent jobs show an “unknown token” error after the October update, install KB5046856 to fix it.

    Check the newer update, KB5058718

    Key changes 31 CVEs · 3 changes

    • Fix SQL Connectivity: The fix list addresses an “unknown token” failure in SQL Agent jobs after KB5046063; the page directs affected systems to install KB504...
    • Fix SQL OS: Addresses an issue that might allow remote code execution on a SQL Server instance through DLL planting.
    • Fix SQL OS: Addresses an issue in which a vulnerability in a SQL Server assembly might allow remote code execution.

    Read update Source: Microsoft

    Build
    13.0.6455.2
    Security
    31 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5046062

    Database privilege flaw fixed; changed-data capture issues corrected

    A security flaw could allow elevated access to the database. Problems capturing changed data are corrected, but scheduled database jobs might show an “unknown token” error until KB5046856.

    Check the newer update, KB5046856
    Known issues: 2 open Organizations and IT administrators
    • Symptoms
    • Resolution

    Key changes 2 CVEs · 1 change

    • Fix Replication: Problems capturing changed data that began with the September update are fixed.
    • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability
    • CVSS 8.8 CVE-2024-49000: SQL Server Native Client Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7045.2
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5046063

    CDC issues fixed; SQL Agent jobs can show an unknown-token error

    Fixes one Important SQL Server elevation-of-privilege vulnerability, CVE-2024-37341, and functional issues in Change Data Capture. SQL Agent jobs might show an “unknown token” error; KB5046856 is the fix.

    Check the newer update, KB5046855
    Known issues: 2 open Organizations and IT administrators
    • Symptoms
    • Resolution

    Key changes 1 CVE · 1 change

    • Fix Replication: Change Data Capture works correctly after functional issues introduced in the September GDR.
    • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6450.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5042209

    SQL privilege flaws addressed; CDC upgrades may drop columns

    Addresses three SQL Server elevation-of-privilege vulnerabilities and adds a CDC metadata safeguard. CDC jobs or upgrade and restore steps might still fail when CDC tracking columns have certain names.

    Check the newer update, KB5046062
    Known issues: 1 open Organizations and IT administrators
    • CDC capture job might fail if columns are missing in CDC change tables

    Key changes 3 CVEs · 2 changes

    • Improved Replication: CDC metadata has an added safeguard against changes that could affect its definitions.
    • Fix Temporal: Table and column names are quoted correctly in internal batches used by stored procedures that manage temporal tables.
    • CVSS 8.8 CVE-2024-37965: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7040.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5042207

    SQL privilege flaws addressed; CDC upgrades may lose columns

    Addresses three SQL Server vulnerabilities and fixes a temporal-table quoting problem. CDC upgrades can still drop columns with commas in their names or fail on other symbols.

    Check the newer update, KB5046063
    Known issues: 1 open Organizations and IT administrators
    • CDC capture job might fail if columns are missing in CDC change tables

    Key changes 3 CVEs · 2 changes

    • Improved Replication: CDC gets a security safeguard that blocks certain database-definition changes.
    • Fix Temporal: Stored procedures that manage temporal tables handle table and column names correctly when building internal database commands.
    • CVSS 8.8 CVE-2024-37965: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6445.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5040944

    37 database security flaws addressed; unused setup components removed

    The update addresses 37 important security vulnerabilities in SQL Server, including flaws that could let attackers run code, and removes unused setup components.

    Check the newer update, KB5042209

    Key changes 37 CVEs · 1 change

    • Removed Stretch DB: Unused components are removed from SQL Server Setup.
    • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7037.1
    Security
    37 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5040946

    Unused Stretch DB components removed from Setup

    The update addresses 37 Important vulnerabilities and removes unused Stretch DB components from SQL Server Setup.

    Check the newer update, KB5042207

    Key changes 37 CVEs · 1 change

    • Removed Stretch DB: Unused Stretch DB components are removed from SQL Server Setup.
    • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6441.1
    Security
    37 vulnerabilities fixed
    Restart
    Required