Skip to the content
The Update Bureau

SQL Server 2019

SQL Server 2019

Every published release for SQL Server 2019, newest first: what each update changes, whether to install it and any confirmed known issues.

Latest
KB5132745 Nov 10, 2026
Build
15.0.4510.2
Released
Nov 4, 2019
Cumulative updates
no longer updated since Feb 28, 2025
Security updates
updates until Jan 8, 2030
Known issues
4 open

Latest update · Latest per branch (Branch)

Which branch am I on? →

Build history

  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update
    Updated

    KB5132745

    Replication and SSIS memory flaws fixed; XSLT scripting disabled

    SQL Server 2019 gets fixes for memory errors and replication security. Integration Services also disables XSLT scripting by default.

    Key changes 51 CVEs · 48 changes

    • Improved Methods to access stored data: Index operations have stronger security protections.
    • Improved Methods to access stored data: Transaction logging has stronger security protections.
    • Improved Access Methods: SQL Server checks sparse column data more carefully to improve security and reliability.

    Read update Source: Microsoft

    Build
    15.0.4510.2
    Security
    51 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update
    Updated

    KB5132751

    Replication and Integration Services flaws fixed

    SQL Server 2019 gets fixes for security flaws and data-handling errors across replication, the database engine, and Integration Services.

    Key changes 50 CVEs · 47 changes

    • Improved Methods to access stored data: Security checks for index operations are improved.
    • Improved Methods to access stored data: Security for transaction logging is improved.
    • Improved Access Methods: Validation of sparse column data is improved for security and reliability.

    Read update Source: Microsoft

    Build
    15.0.2210.4
    Security
    50 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update
    Updated

    KB5128494

    Database Engine vulnerabilities fixed; MSDASQL queries can fail

    Fixes 21 vulnerabilities in SQL Server 2019. Linked-server queries using MSDASQL with a provider string can fail with error 7416.

    Check the newer update, KB5132745
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 21 CVEs · 22 changes

    • Improved Extensibility: Package extraction uses an updated component when external language or external library packages are installed.
    • Improved High Availability and Disaster Recovery: Availability Group secondary replicas reject oversized FILESTREAM fragments.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.

    Read update Source: Microsoft

    Build
    15.0.4500.2
    Security
    21 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update
    Updated

    KB5128495

    21 vulnerabilities fixed; MSDASQL linked queries can fail

    The update fixes 21 vulnerabilities in SQL Server 2019 GDR. A known issue can make linked server queries using MSDASQL and a provider string fail with error 7416.

    Check the newer update, KB5132751
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 21 CVEs · 22 changes

    • Improved Extensibility: Package extraction uses an updated third-party component when external language or external library packages are installed.
    • Improved High Availability and Disaster Recovery: Availability Group secondary replicas reject oversized FILESTREAM fragments.
    • Improved Replication: Queued Updating Subscriptions get security and reliability improvements.

    Read update Source: Microsoft

    Build
    15.0.2200.2
    Security
    21 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5122772

    52 vulnerabilities addressed; linked-server queries can fail

    Addresses 52 vulnerabilities, including three Critical remote code execution flaws; none are listed as exploited. Some linked-server queries might fail with error 7416 after installation.

    Check the newer update, KB5128494
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 52 CVEs · 40 changes

    • Improved Replication: Replication procedures get stronger internal checks.
    • Improved Replication: Queued Updating Subscriptions in Transactional Replication get security and reliability improvements.
    • Improved Replication: Queued Updating Subscriptions in Transactional Replication get security and reliability improvements.

    Read update Source: Microsoft

    Build
    15.0.4490.9
    Security
    52 fixed · 3 critical
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5122773

    Three critical remote-code flaws affect the database engine

    Fixes 52 vulnerabilities, including three critical flaws that could allow remote code execution in SQL Server. It also lists an open issue that can make some linked server queries fail with error 7416.

    Check the newer update, KB5128495
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 52 CVEs · 40 changes

    • Improved Replication: Replication stored procedures receive stronger internal validation and security checks.
    • Improved Replication: Bounds validation is added for embedded attestation fields.
    • Improved Replication: Object Store Format deserialization is strengthened against malformed or malicious stream data.

    Read update Source: Microsoft

    Build
    15.0.2190.7
    Security
    52 fixed · 3 critical
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5102335

    Critical remote-code flaw fixed; MSDASQL linked queries still fail

    Fixes a critical remote-code execution vulnerability and three other security vulnerabilities. Linked server queries using MSDASQL can still fail with error 7416.

    Check the newer update, KB5122772
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: Integration Services blocks remote code execution from untrusted MSMQ messages by restricting how it processes serialized data.
    • Fix Query Execution: A memory leak that can occur when querying the input buffer is fixed.
    • Fix Replication: Input passed to an internal replication procedure is validated and sanitized before use.

    Read update Source: Microsoft

    Build
    15.0.4480.2
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5102336

    Critical remote-code flaw fixed; MSDASQL queries can fail

    Fixes 4 vulnerabilities, including a Critical remote code execution flaw. Linked server queries using MSDASQL with a provider string might fail with error 7416.

    Check the newer update, KB5122773
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: Untrusted MSMQ messages can no longer trigger remote code execution through insecure deserialization in MessageQueueTask.
    • Fix Query Execution: Using sys.dm_exec_input_buffer or DBCC INPUTBUFFER no longer causes a memory leak.
    • Fix Replication: Input passed to an internal replication stored procedure is validated and sanitized before the procedure uses it.

    Read update Source: Microsoft

    Build
    15.0.2180.2
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5090407

    Web Service Task flaw addressed; linked-server error 7416 remains

    The update addresses a Web Service Task vulnerability that could let an attacker read arbitrary local files or cause a denial-of-service attack. Linked-server queries using MSDASQL can still fail with error 7416.

    Check the newer update, KB5102335
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The Web Service Task vulnerability is addressed. It could let an attacker read arbitrary files from the local file system or cause a de...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4470.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5090408

    Remote code execution flaw addressed; MSDASQL queries can fail

    Addresses a SQL Server remote code execution vulnerability. Linked server queries using MSDASQL and a provider string can fail with error 7416.

    Check the newer update, KB5102336
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The Web Service Task's XML flaw is addressed; it could let an attacker read local files or cause a denial-of-service.
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2170.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5084816

    Linked-server privilege flaws fixed; MSDASQL queries can fail

    The update addresses two SQL Server elevation-of-privilege vulnerabilities. Linked-server queries using MSDASQL can still fail with error 7416.

    Check the newer update, KB5090407
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: The update addresses a linked-server vulnerability that could let a low-privileged SQL Server user gain sysadmin permissions.
    • Fix SQL Agent: The update addresses a SQL injection vulnerability that could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4465.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5084817

    Linked-server security flaws fixed; MSDASQL queries can fail

    Fixes two Important SQL Server elevation-of-privilege vulnerabilities. Linked-server queries using MSDASQL might fail with error 7416 after installation.

    Check the newer update, KB5090408
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: Addresses a linked-server vulnerability that could let a low-privileged SQL Server user gain sysadmin permissions.
    • Fix SQL Agent: Resolves an issue where SQL injection could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2165.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5077469

    Merge replication upgrade flaw fixed; ALTER USER restricted

    The update addresses two SQL Server elevation-of-privilege vulnerabilities. It also fixes a flaw in the merge replication version-upgrade process and blocks a specific ALTER USER operation.

    Check the newer update, KB5084816

    Key changes 2 CVEs · 2 changes

    • Fix Replication: An elevation-of-privilege vulnerability in the merge replication version-upgrade process is fixed.
    • Fix Security Infrastructure: ALTER USER is blocked when the target login is the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4460.4
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5077470

    Merge replication privilege flaw fixed; ALTER USER restricted

    Fixes two Important SQL Server vulnerabilities, including the publicly disclosed CVE-2026-21262, and blocks a specific ALTER USER operation.

    Check the newer update, KB5084817

    Key changes 2 CVEs · 2 changes

    • Fix Replication: The merge replication version upgrade process is protected against an elevation-of-privilege vulnerability.
    • Fix Security Infrastructure: ALTER USER is blocked when the target login is the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2160.4
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5068404

    SQL injection access restricted; Analysis Services filters fixed

    Addresses an SQL injection vulnerability in an internal backup procedure and fixes a rare configuration where Analysis Services security filters could be skipped.

    Check the newer update, KB5077469

    Key changes 1 CVE · 2 changes

    • Fix Analysis Services: Row-level security filters are consistently applied in the affected multi-role configurations.
    • Fix Management Services: Unauthorized access to an internal backup procedure is restricted, reducing the risk of SQL injection.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4455.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5068405

    Elevation-of-privilege flaw fixed; Analysis Services filters corrected

    Fixes one Important SQL Server elevation-of-privilege vulnerability, corrects rare Analysis Services security-filter behavior, and reduces SQL injection risk in an exposed backup procedure.

    Check the newer update, KB5077470

    Key changes 1 CVE · 2 changes

    • Fix Analysis Services: Row-level filters are applied consistently in rare, conflicting multi-role security setups.
    • Fix Management Services: The risk of SQL injection through an exposed internal backup procedure is reduced.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2155.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5065222

    Temporal cleanup flaw and sensitive DMV data exposure fixed

    The update addresses three vulnerabilities and four SQL Server issues, including a temporal-cleanup flaw that could let attackers with elevated privileges run SQL code. CVE-2024-21907 is publicly disclosed.

    Check the newer update, KB5068404

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: Integration Services updates Newtonsoft.Json to version 13.0.1 to address a vulnerability.
    • Fix Master Data Services: Master Data Services updates Newtonsoft.Json to version 13.0.1 to address a vulnerability.
    • Fix Programmability: In specific scenarios, inspecting statements running in other sessions through DMVs might reveal sensitive data; this issue is fixed.

    Read update Source: Microsoft

    Build
    15.0.4445.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5065223

    DMV data exposure and temporal cleanup flaws fixed

    Fixes three vulnerabilities: CVE-2025-47997 (information disclosure), CVE-2025-55227 (elevation of privilege), and publicly disclosed CVE-2024-21907 in Newtonsoft.Json.

    Check the newer update, KB5068405

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: SSIS uses an updated Newtonsoft.Json component to address CVE-2024-21907.
    • Fix Master Data Services: The Newtonsoft.Json vulnerability is addressed for Master Data Services.
    • Fix Programmability: Fixes a case where statement text inspected through DMVs might contain sensitive data from other sessions.

    Read update Source: Microsoft

    Build
    15.0.2145.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5063757

    Stored procedures and SQL Agent jobs get privilege protections

    The update fixes four Important SQL Server vulnerabilities, including SQL injection and elevation-of-privilege flaws involving stored procedures, logins, and SQL Agent jobs.

    Check the newer update, KB5065222

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: A SQL injection vulnerability in a system stored procedure is fixed.
    • Fix Security Infrastructure: Logins with certain permissions can no longer reset passwords for other logins that have powerful login-management or impersonation per...
    • Fix SQL Agent: Built-in SQL Agent jobs run with reduced permissions to help prevent privilege escalation.

    Read update Source: Microsoft

    Build
    15.0.4440.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5063758

    Stored procedure, login, and SQL Agent privilege flaws blocked

    The update fixes four Important SQL Server vulnerabilities involving SQL injection and elevation of privilege. None is listed as critical, exploited, or publicly disclosed.

    Check the newer update, KB5065223

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: A system stored procedure no longer has the SQL injection vulnerability addressed by this fix.
    • Fix Security Infrastructure: Logins with ALTER ANY LOGIN permission can no longer reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissio...
    • Fix SQL Agent: Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.

    Read update Source: Microsoft

    Build
    15.0.2140.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5058722

    Information disclosure flaw and Setup restart issue addressed

    The update addresses three important vulnerabilities, including publicly disclosed CVE-2025-49719, and fixes SQL Setup restarts that could prevent setup from continuing.

    Check the newer update, KB5063757
    SQL Server 2019 cumulative updates ended on February 28, 2025. Security updates continue through January 8, 2030.

    Key changes 3 CVEs · 5 changes

    • Fix Programmability: Under specific conditions, an attacker can no longer execute a query against the server to cause it to become unavailable.
    • Fix Programmability: In rare cases, uninitialized memory is no longer returned when the REPLACE function uses limited-length parameters.
    • Fix Query Execution: In rare cases, uninitialized memory can no longer be read when variable-length parameters are used.

    Read update Source: Microsoft

    Build
    15.0.4435.7
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5058713

    Query and memory flaws fixed; Setup restart issue addressed

    The update fixes three SQL Server vulnerabilities and addresses a Setup problem that could cause restarts and prevent installation from continuing.

    Check the newer update, KB5063758

    Key changes 3 CVEs · 4 changes

    • Fix Programmability: Under specific conditions, an attacker could run a query that makes the server unavailable; this issue is fixed.
    • Fix Programmability: In rare cases, using limited-length parameters with the REPLACE function could return uninitialized memory; this issue is fixed.
    • Fix Query Execution: In rare cases, uninitialized memory could be read when variable-length parameters were used; this issue is fixed.

    Read update Source: Microsoft

    Build
    15.0.2135.5
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 SQL Server 2019 CU32 Cumulative update

    KB5054833

    Read-scale availability groups stay in place after patching

    Patching a read-scale availability group no longer removes it from the patched replica. An open issue can still make some queries return incorrect results or create diagnostic files.

    Check the newer update, KB5058722
    SQL Server 2019 cumulative updates end February 28, 2025. Security updates continue through January 8, 2030.
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 1 change

    • Fix High Availability and Disaster Recovery: Patching a read-scale availability group no longer removes it from the patched replica.

    Read update Source: Microsoft

    Build
    15.0.4430.1
    Restart
    Required
  • SQL Server 2019 CU31 SQL Server 2019 CU31 Cumulative update

    KB5049296

    Read-scale AG metadata loss; SESSION_CONTEXT may return wrong results

    Includes 10 fixes, but it can remove read-scale availability group metadata on a patched replica. Queries using SESSION_CONTEXT might also return incorrect results or trigger access violation dumps in parallel plans.

    Check the newer update, KB5054833
    Cumulative updates for SQL Server 2019 are listed as ending on February 28, 2025.
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 10 changes

    • Fix Master Data Services: The business rule item for the domain-based attribute option works correctly in Master Data Services.
    • Fix High Availability and Disaster Recovery: Creating an availability group with a name longer than 64 characters no longer triggers the listed assertion failures.
    • Fix Linux: Some transactions no longer face extended waits during flush operations with the specified alternate write-through setting.

    Read update Source: Microsoft

    Build
    15.0.4420.2
    Restart
    Required
  • SQL Server 2019 CU30 SQL Server 2019 CU30 Cumulative update

    KB5049235

    Remote code execution fixes; parallel SESSION_CONTEXT issue remains

    CU30 includes eight fixes, including fixes for remote code execution, but a known issue can still affect SESSION_CONTEXT in parallel plans. KB5049235 has been superseded by KB5049296.

    Check the newer update, KB5049296
    SQL Server 2019 cumulative updates are scheduled to end February 28, 2025; security updates are scheduled to continue until January 8, 2030.
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 8 changes

    • Fix Integration Services: Extracting data for Google BigQuery with the Simba ODBC driver no longer has the described data discrepancy issue.
    • Fix High Availability and Disaster Recovery: Some Always On availability group workloads have fewer waits during data movement.
    • Fix High Availability and Disaster Recovery: Some availability group databases can move to a resolving state after a Windows Server Failover Clustering quorum loss, helping them re...

    Read update Source: Microsoft

    Build
    15.0.4415.2
    Restart
    Required