Skip to the content
The Update Bureau

SQL Server 2017

SQL Server 2017

Every published release for SQL Server 2017, newest first: what each update changes, whether to install it and any confirmed known issues.

Latest
KB5132746 Nov 10, 2026
Build
14.0.3570.2
Released
Sep 29, 2017
Cumulative updates
no longer updated since Oct 11, 2022
Security updates
updates until Oct 12, 2027
Known issues
2 open

Latest update · Latest per branch (Branch)

Which branch am I on? →

Build history

  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update
    Updated

    KB5132746

    Database and replication flaws fixed; XSLT scripting disabled

    Security fixes address flaws in database processing and replication, and XSLT scripting is now disabled by default. The update can request a restart.

    Key changes 51 CVEs · 48 changes

    • Improved Methods to access stored data: Security checks for database index operations are stronger.
    • Improved Methods to access stored data: Security checks for database transaction logs are stronger.
    • Improved Access Methods: Checks on sparse column data are stronger, helping protect data and reliability.

    Read update Source: Microsoft

    Build
    14.0.3570.2
    Security
    51 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update
    Updated

    KB5132749

    Replication flaws fixed; XSLT scripting disabled by default

    Replication and memory-safety fixes address security risks, and XSLT scripting is disabled by default. SQL Server 2017 security updates end on October 12, 2027.

    Security updates for SQL Server 2017 are scheduled to end on October 12, 2027.

    Key changes 48 CVEs · 47 changes

    • Improved Methods to access stored data: Index operations have stronger security checks.
    • Improved Methods to access stored data: Transaction logging has stronger security.
    • Improved Access Methods: Sparse column data receives stronger checks for security and reliability.

    Read update Source: Microsoft

    Build
    14.0.2150.2
    Security
    48 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update
    Updated

    KB5128496

    Database Engine vulnerability fixes; MSDASQL queries can fail

    Fixes security vulnerabilities in SQL Server 2017, but linked server queries using MSDASQL and a provider string might fail with error 7416.

    Check the newer update, KB5132746
    SQL Server 2017 security updates are scheduled to end on October 12, 2027.
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 14 CVEs · 15 changes

    • Improved High Availability and Disaster Recovery: Availability Group secondary replicas reject oversized FILESTREAM fragments.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.

    Read update Source: Microsoft

    Build
    14.0.3560.2
    Security
    14 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update
    Updated

    KB5128497

    SQL Satellite flaws fixed; MSDASQL linked queries can fail

    The update fixes 14 vulnerabilities, including flaws in SQL Satellite and the Virtual Device Interface. Some linked-server queries that use MSDASQL can still fail with error 7416.

    Check the newer update, KB5132749
    Security updates for SQL Server 2017 are scheduled to end October 12, 2027.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 14 CVEs · 15 changes

    • Improved High Availability and Disaster Recovery: Availability Group secondary replicas reject oversized FILESTREAM fragments.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.

    Read update Source: Microsoft

    Build
    14.0.2140.2
    Security
    14 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5122774

    Critical remote-code-execution flaw patched; linked queries can fail

    Fixes 45 vulnerabilities, including one critical SQL Server remote-code-execution flaw. Linked server queries using MSDASQL and a provider string can fail with error 7416.

    Check the newer update, KB5128496
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 45 CVEs · 27 changes

    • Improved Replication: Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.
    • Improved Replication: Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.
    • Fix Backup Restore: A vulnerability affecting SQL Server managed backup procedures is addressed.

    Read update Source: Microsoft

    Build
    14.0.3550.4
    Security
    45 fixed · 1 critical
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5122775

    Database Engine remote-code flaw patched; linked-server error remains

    The update fixes 45 vulnerabilities, including one Critical SQL Server remote-code execution flaw. Linked-server queries using MSDASQL and a provider string can still fail with error 7416.

    Check the newer update, KB5128497
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 45 CVEs · 37 changes

    • Improved Replication: Replication stored procedures get stronger internal validation and security checks.
    • Improved Backup Restore: SQL Server safely rejects malformed or undersized backup metadata processed by the VSS Writer.
    • Improved Replication: Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.

    Read update Source: Microsoft

    Build
    14.0.2130.4
    Security
    45 fixed · 1 critical
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5102337

    Critical remote-code-execution flaw fixed; linked-server error remains

    The update fixes a critical remote-code-execution vulnerability and three other issues in SQL Server 2017. Linked-server queries using MSDASQL can still fail with error 7416.

    Check the newer update, KB5122774
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: The fix restricts MessageQueueTask deserialization to help prevent remote code execution from untrusted MSMQ messages.
    • Fix Query Execution: A memory leak is fixed when sys.dm_exec_input_buffer or the DBCC INPUTBUFFER command is used.
    • Fix Replication: Input passed to an internal replication stored procedure is validated and sanitized before the procedure uses it.

    Read update Source: Microsoft

    Build
    14.0.3540.1
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5102338

    Critical remote-code flaw; MSDASQL linked-server queries can fail

    Fixes four vulnerabilities, including a critical SQL Server remote-code execution flaw. Linked-server queries using MSDASQL with a provider string might fail with error 7416.

    Check the newer update, KB5122775
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: MessageQueueTask blocks remote code execution from an untrusted Microsoft Message Queuing message by restricting unsafe deserialization...
    • Fix Query Execution: Fixes a memory leak that can occur when the input buffer is queried.
    • Fix Replication: Input passed to an internal replication procedure is validated and sanitized before the procedure uses it.

    Read update Source: Microsoft

    Build
    14.0.2120.1
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5090354

    Web Service Task flaw could expose files or disrupt service

    Addresses an Important SQL Server remote code execution vulnerability and a Web Service Task XML flaw that could expose local files or cause a denial-of-service. Some linked server queries using MSDASQL still fail with error 7416.

    Check the newer update, KB5102337
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The Web Service Task's XML processing is protected against a flaw that could let an attacker read local files or cause a denial-of-serv...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3530.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5090347

    Linked-server queries with MSDASQL provider strings fail

    The update addresses an XML external entity flaw in Integration Services. Linked-server queries using MSDASQL with a provider string can fail with error 7416.

    Check the newer update, KB5102338
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The XML external entity (XXE) vulnerability in the Web Service Task is addressed. It could let an attacker read local files or cause a...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2110.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5084818

    Linked-server privilege flaws addressed; MSDASQL queries can fail

    Two Important SQL Server elevation-of-privilege vulnerabilities are addressed, including flaws in linked servers and SQL Agent. A known issue can make MSDASQL linked-server queries fail with error 7416.

    Check the newer update, KB5090354
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: The fix addresses a flaw that could let a low-privileged SQL Server user gain sysadmin permissions.
    • Fix SQL Agent: The fix resolves a SQL injection issue that could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3525.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5084819

    Linked-server privilege flaw addressed; MSDASQL queries fail

    Fixes two Important elevation-of-privilege vulnerabilities. Linked server queries using MSDASQL with a provider string fail with error 7416.

    Check the newer update, KB5090347
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: The fix addresses a flaw that lets a low-privileged SQL Server user gain sysadmin permissions through a linked server.
    • Fix SQL Agent: The fix resolves a SQL injection issue that allows an authorized attacker to elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2105.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5077471

    Merge replication flaw fixed; ALTER USER blocked for Administrator

    The update fixes two Important SQL Server elevation-of-privilege vulnerabilities, including publicly disclosed CVE-2026-21262. It also blocks ALTER USER when the target login is the system Administrator account.

    Check the newer update, KB5084818

    Key changes 2 CVEs · 2 changes

    • Fix Replication: The merge replication version upgrade process no longer has the elevation-of-privilege vulnerability addressed by this update.
    • Fix Security Infrastructure: ALTER USER is blocked when the target login is the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3520.4
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5077472

    Merge replication privilege flaw fixed; system Administrator protected

    The update fixes an elevation-of-privilege vulnerability in merge replication and blocks an ALTER USER operation targeting the system Administrator account.

    Check the newer update, KB5084819

    Key changes 2 CVEs · 2 changes

    • Fix Replication: A security flaw in the merge replication version upgrade process is fixed.
    • Fix Security Infrastructure: The ALTER USER operation is blocked if it targets the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2100.4
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5068402

    SQL injection protection for backup procedure; RLS filters fixed

    The update reduces SQL injection risk in an exposed backup procedure and fixes cases where row-level security filters could be skipped in certain multi-role configurations.

    Check the newer update, KB5077471

    Key changes 1 CVE · 2 changes

    • Fix Analysis Services: Row-level security filters are applied consistently in certain multi-role setups where users could otherwise see rows those filters wer...
    • Fix Management Services: The internal backup procedure sanitizes input and restricts unauthorized access, reducing SQL injection risk.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3515.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5068403

    Database privilege flaw patched; row filters no longer skipped

    Addresses one Important SQL Server flaw and fixes a rare setup where database row filters could be skipped.

    Check the newer update, KB5077472

    Key changes 1 CVE · 2 changes

    • Fix Analysis Services: In rare setups with several roles, row filters no longer get skipped.
    • Fix Management Services: An internal backup procedure is safer from harmful input and limits access by unauthorized users.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2095.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5065225

    Sensitive SQL statement text and temporal cleanup flaws fixed

    Fixes three SQL Server vulnerabilities, including issues that could expose sensitive statement text or let attackers with elevated privileges run SQL code during temporal-history cleanup. CVE-2024-21907 is publicly disclosed.

    Check the newer update, KB5068402

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: Integration Services gets an updated Newtonsoft.Json library to fix a vulnerability.
    • Fix Master Data Services: Master Data Services gets an updated Newtonsoft.Json library to fix a vulnerability.
    • Fix Programmability: Fixes the issue that let DMVs inspect statement text running in other sessions in specific scenarios, where that text might contain sen...

    Read update Source: Microsoft

    Build
    14.0.3505.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5065224

    Sensitive DMV data exposure and temporal-table SQL flaws fixed

    The update fixes three SQL Server vulnerabilities, including publicly disclosed CVE-2024-21907, and addresses sensitive-data exposure through DMVs and unsafe input validation during temporal-table cleanup.

    Check the newer update, KB5068403

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: SSIS uses Newtonsoft.Json version 13.0.1 to address CVE-2024-21907.
    • Fix Master Data Services: Master Data Services uses Newtonsoft.Json version 13.0.1 to address CVE-2024-21907.
    • Fix Programmability: Sensitive SQL statement text from other sessions is no longer exposed in the described DMV scenarios.

    Read update Source: Microsoft

    Build
    14.0.2085.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5063759

    SQL injection and SQL Agent privilege-escalation flaws blocked

    The update addresses four Important SQL Server vulnerabilities, including SQL injection and privilege-escalation flaws. It also includes the Azure Connect feature pack for SQL Server 2017.

    Check the newer update, KB5065225

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: SQL injection through a system stored procedure is addressed.
    • Fix Security Infrastructure: A login with ALTER ANY LOGIN permission can no longer reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissi...
    • Fix SQL Agent: Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.

    Read update Source: Microsoft

    Build
    14.0.3500.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5063760

    SQL injection and login privilege-escalation flaws addressed

    Addresses four Important vulnerabilities in SQL Server 2017, including SQL injection and elevation-of-privilege flaws.

    Check the newer update, KB5065224

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: A system stored procedure can no longer be used for SQL injection.
    • Fix Security Infrastructure: Certain logins can no longer reset passwords in a way that could lead to elevated privileges.
    • Fix SQL Agent: Built-in SQL Agent job steps run with reduced permissions to help prevent elevated access.

    Read update Source: Microsoft

    Build
    14.0.2080.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5058714

    Information disclosure flaw and SQL Setup interruptions fixed

    Addresses a publicly disclosed SQL Server information disclosure vulnerability and fixes two issues, including restarts that can prevent SQL Setup from continuing.

    Check the newer update, KB5063759

    Key changes 1 CVE · 2 changes

    • Fix Query Execution: In rare cases, variable-length parameters no longer cause uninitialized memory to be read.
    • Fix Patching: SQL Setup no longer encounters the issue that causes restarts and prevents Setup from continuing.
    • CVSS 7.5 CVE-2025-49719: Microsoft SQL Server Information Disclosure Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3495.9
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5058716

    Information disclosure flaw and Setup restart issue fixed

    The update fixes a publicly disclosed information-disclosure vulnerability and a problem introduced by an earlier Windows update that caused restarts and stopped SQL Setup from continuing.

    Check the newer update, KB5063760

    Key changes 1 CVE · 2 changes

    • Fix Query Execution: In rare cases, SQL Server no longer reads unintended memory while processing data whose parameter length varies.
    • Fix Patching: A problem introduced by an earlier Windows update that caused restarts and stopped SQL Server Setup from continuing is fixed.
    • CVSS 7.5 CVE-2025-49719: Microsoft SQL Server Information Disclosure Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2075.8
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 SP3 AC + GDR SQL Server 2017 SP3 AC + GDR Out-of-band update
    Out-of-band

    KB5050533

    Database links to Azure SQL Managed Instance added

    The feature pack adds database replication from SQL Server to Azure SQL Managed Instance. It also improves connections and certificate handling.

    Check the newer update, KB5058714

    Key changes 5 changes

    • New Link feature: You can replicate databases from SQL Server to Azure SQL Managed Instance with the link feature.
    • New Distributed availability groups: SQL Server Standard editions can use distributed availability groups to replicate databases with Azure resources.
    • Improved Distributed availability groups and Service Broker: You can use distributed availability groups and Service Broker connections with Azure SQL Managed Instance.

    Read update Source: Microsoft

    Build
    14.0.3490.10
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5046858

    Native Client remote-code flaws patched; DLL planting fixed

    Addresses 31 Important-severity vulnerabilities, including remote-code execution flaws in SQL Server Native Client. It also fixes two SQL Server Engine issues involving remote code execution.

    Check the newer update, KB5058714

    Key changes 31 CVEs · 2 changes

    • Fix SQL OS: Remote code execution through DLL planting on a SQL Server instance is fixed.
    • Fix SQL OS: A vulnerability in a SQL Server assembly that might allow remote code execution is fixed.
    • CVSS 8.8 CVE-2024-38255: SQL Server Native Client Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3485.1
    Security
    31 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5046857

    Native Client flaws could let attackers run code on SQL servers

    Patches 31 Important-rated vulnerabilities, including flaws that could let attackers run code on SQL Server systems. It also fixes two SQL Server Engine issues.

    Check the newer update, KB5058716

    Key changes 31 CVEs · 2 changes

    • Fix SQL OS: A security flaw that could let someone run their own code on a SQL Server instance through a planted file is addressed.
    • Fix SQL OS: A security flaw in a SQL Server component that could let someone run code on the server is addressed.
    • CVSS 8.8 CVE-2024-38255: SQL Server Native Client Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2070.1
    Security
    31 vulnerabilities fixed
    Restart
    Required