SQL Server 2022

Build history

• SQL Server 2022 CU28 SQL Server 2022 CU28 Cumulative update

  Updated Nov 13

  KB5125472 Nov 12, 2026

  Replication safeguards, SQL engine fixes, and new link tools

  SQL Server 2022 CU28 adds replication and database safety checks, fixes a range of engine and integration issues, and adds tools for Azure SQL Managed Instance links. Queries using SESSION_CONTEXT in parallel plans might still return wrong results or cause access violations.

  Known issues: 1 open

  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 91 changes

  • New Methods to access stored data: Trace flag 697 can disable HoBt schema-latch promotion without disabling all superlatching.
  • New Methods to access stored data: Trace flag 683 can reduce CPU overhead when latch promotion occurs without counter partitioning.
  • New High Availability and Disaster Recovery: Three procedures can restart seeding, repair a broken link, and check database health in multi-database link mode with Azure SQL Manage...

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU27 + GDR SQL Server 2022 CU27 + GDR Security update

  Updated Nov 10

  KB5129300 Nov 10, 2026

  Recovery-time queries may trigger access violations

  Database monitoring queries during recovery might cause an access violation and create a dump file. The security update also fixes vulnerabilities; avoid those queries or use trace flag 4696 as a mitigation.

  Known issues: 1 open Organizations and IT administrators

  • Access violation when you query sys.dm_exec_requests during database recovery

  Key changes 55 CVEs · 51 changes

  • Improved Methods to access stored data: Security for SQL Server index operations is improved.
  • Improved Methods to access stored data: Security for transaction logging in SQL Server is improved.
  • Improved Access Methods: Sparse column data checks are improved to strengthen security and reliability.

  Read update → Source: Microsoft ↗

• SQL Server 2022 GDR SQL Server 2022 GDR Security update

  Updated Nov 10

  KB5132747 Nov 10, 2026

  Database vulnerabilities addressed; replication checks strengthened

  Database security fixes address vulnerabilities, while changes improve replication checks and prevent unsafe memory access. The update can request a restart.

  Key changes 54 CVEs · 52 changes

  • Improved Replication: Identifier checks for merge replication are improved.
  • Improved Replication: Identifier checks for transactional replication are improved.
  • Improved Methods to access stored data: Index operations have improved security checks.

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU27 + GDR SQL Server 2022 CU27 + GDR Security update

  Updated Nov 10

  KB5126934 Oct 13, 2026

  Recovery queries may raise access violations; security flaws fixed

  Security fixes cover SQL Server components. Queries against `sys.dm_exec_requests` during database recovery might raise an access violation and create a dump file.

  Check the newer update, KB5129300

  Known issues: 2 open

  • Linked server queries that use MSDASQL fail with error 7416
  • Access violation when you query sys.dm_exec_requests during database recovery

  Key changes 23 CVEs · 23 changes

  • Improved High Availability and Disaster Recovery: Availability Group secondary replicas now reject oversized FILESTREAM fragments.
  • Improved Backup Restore: Invalid size values in backup paths are checked before they can cause unsafe memory access.
  • Improved Backup Restore: A backup and restore metadata issue could let a local authenticated user gain elevated privileges or stop a service. The update adds ch...

  Read update → Source: Microsoft ↗

• SQL Server 2022 GDR SQL Server 2022 GDR Security update

  Updated Nov 10

  KB5128493 Oct 13, 2026

  PolyBase security flaws addressed; linked server queries can fail

  Fixes 22 Important SQL Server vulnerabilities. Linked server queries using MSDASQL and a provider string might fail with error 7416.

  Check the newer update, KB5132747

  Known issues: 1 open

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 22 CVEs · 24 changes

  • Improved Extensibility: Package extraction uses an updated archive-extraction component when external language or external library packages are installed.
  • Improved High Availability and Disaster Recovery: Oversized FILESTREAM fragments are rejected on Availability Group secondary replicas.
  • Improved Query Store: Showplan input handling is improved for security and reliability.

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU27 SQL Server 2022 CU27 Cumulative update

  KB5104824 Sep 15, 2026

  New multi-database link mode; recovery queries can trigger access violations

  Adds a multi-database link mode and includes 42 fixes. Open issues include incorrect SESSION_CONTEXT results in parallel plans and access violations during database recovery.

  Check the newer update, KB5126934

  Known issues: 4 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416
  • Access violation when you query sys.dm_exec_requests during database recovery
  • and 2 more

  Key changes 42 changes

  • New High Availability and Disaster Recovery: Managed Instance link can use multiple-database link mode to extend an existing availability group to Azure SQL Managed Instance and re...
  • Improved Backup Restore: Backup metadata that is malformed or too small is rejected safely.
  • Improved SQL Agent: Security validation improves when SQL Server Agent loads task agent components.

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU26 + GDR SQL Server 2022 CU26 + GDR Security update

  KB5122768 Sep 8, 2026

  Remote-code flaws patched; two issues remain open

  The update fixes 52 vulnerabilities, including four critical remote-code-execution flaws. KB5126934 supersedes it, so use the newer update rather than installing this package.

  Check the newer update, KB5126934

  Known issues: 2 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416
  • Access violation when you query sys.dm_exec_requests during database recovery

  Key changes 52 CVEs · 40 changes

  • Fix SQL Agent: Addresses a security validation issue when SQL Server Agent loads task-agent components.
  • Fix SQL Agent: Addresses reliability and security issues when SQL Server Agent processes specific input.
  • Fix WMI Management Provider (SqlMgmProvider): Addresses incorrect handling of malformed input while preserving the existing behavior for valid input.

  Read update → Source: Microsoft ↗

• SQL Server 2022 GDR SQL Server 2022 GDR Security update

  KB5122771 Sep 8, 2026

  Four critical database code-execution flaws patched

  Fixes 52 vulnerabilities, including four critical remote code execution flaws. Some linked server queries using MSDASQL can still fail with error 7416.

  Check the newer update, KB5128493

  Known issues: 1 open

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 52 CVEs · 44 changes

  • Improved Replication: Improves internal validation and security checks for replication stored procedures.
  • Improved PolyBase: Improves validation of responses from S3-compatible external storage endpoints during external data access.
  • Improved Replication: Adds bounds validation for embedded attestation fields.

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU26 SQL Server 2022 CU26 Cumulative update

  KB5093420 Jul 16, 2026

  SQL injection fix, while recovery queries can still trigger crashes

  Includes 12 fixes, including a SQL injection fix. A known issue can still cause an access violation when `sys.dm_exec_requests` runs during database recovery.

  Check the newer update, KB5122768

  Known issues: 3 open

  • Linked server queries that use MSDASQL fail with error 7416
  • Access violation when you query sys.dm_exec_requests during database recovery
  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 12 changes

  • New High Availability and Disaster Recovery: You can remove an IP address from an availability group listener with an ALTER AVAILABILITY GROUP command.
  • Improved High Availability and Disaster Recovery: The Windows Server Failover Cluster log includes more detailed error information when the availability group resource DLL cannot retrie...
  • Improved Query Execution: Incremental statistics use an adjusted sampling rate when the previous rate was 100 percent and many new rows have been added.

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU25 + GDR SQL Server 2022 CU25 + GDR Security update

  KB5101347 Jul 14, 2026

  Some MSDASQL linked-server queries with provider strings fail

  The update fixes four vulnerabilities, including critical SQL Server remote code execution CVE-2026-54118. Linked-server queries using MSDASQL with a provider string can fail with error 7416 in certain configurations.

  Check the newer update, KB5122768

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 4 CVEs · 4 changes

  • Fix Integration Service: Remote code execution through untrusted MSMQ messages is blocked in MessageQueueTask.
  • Fix Query Execution: Memory no longer leaks when the input buffer is queried with the listed SQL Server tools.
  • Fix Replication: Input passed to an internal replication stored procedure is checked and sanitized before use.

  Read update → Source: Microsoft ↗

• SQL Server 2022 GDR SQL Server 2022 GDR Security update

  KB5102334 Jul 14, 2026

  Remote code execution flaw fixed; MSDASQL links can fail

  Fixes four vulnerabilities, including a critical SQL Server remote code execution flaw. Linked server queries using MSDASQL and a provider string might fail with error 7416.

  Check the newer update, KB5122771

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 4 CVEs · 4 changes

  • Fix Integration Services: MessageQueueTask blocks a remote code execution risk from untrusted MSMQ messages.
  • Fix Query Execution: A memory leak is fixed when the input buffer is queried.
  • Fix Replication: User input passed to an internal replication stored procedure is validated and sanitized before the procedure uses it.

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU25 SQL Server 2022 CU25 Cumulative update

  KB5081477 May 20, 2026

  Web Service Task blocks file access through WSDL endpoints

  Includes 12 fixes for SQL Server 2022, including a Web Service Task fix that blocks unauthorized file access through WSDL endpoints. It also leaves two known issues open.

  Check the newer update, KB5101347

  Known issues: 2 open

  • Linked server queries that use MSDASQL fail with error 7416
  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 12 changes

  • Fix Database Mail: Database Mail sends email attachments again in Contained Availability Groups.
  • Fix Management Services: Granted permissions on stored procedures and other msdb objects are no longer lost during a SQL Server upgrade.
  • Fix SQL OS: Querying sys.dm_xe_session_targets no longer causes an access violation on affected SQL Server instances.

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU24 + GDR SQL Server 2022 CU24 + GDR Security update

  KB5089900 May 12, 2026

  Database Engine RCE addressed; provider-string linked queries fail

  Addresses one Important SQL Server vulnerability, CVE-2026-40370. Linked-server queries using MSDASQL and a provider string can fail with error 7416.

  Check the newer update, KB5101347

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 1 CVE · 1 change

  • Fix Integration Service: The Web Service Task fix addresses a flaw that could let an attacker read files on the server or make it unavailable.
  • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2022 GDR SQL Server 2022 GDR Security update

  KB5091158 May 12, 2026

  Web Service Task flaw addressed; linked queries can fail with 7416

  The update addresses one Important SQL Server vulnerability in the Web Service Task. Queries to other servers using the OLE DB Provider for ODBC Drivers might fail with error 7416.

  Check the newer update, KB5102334

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 1 CVE · 1 change

  • Fix Integration Services: The Web Service Task's XML handling is changed to address a vulnerability that could let an attacker read local files or disrupt servic...
  • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU24 + GDR SQL Server 2022 CU24 + GDR Security update

  KB5083252 Apr 14, 2026

  Linked-server privilege flaw addressed; MSDASQL queries can fail

  Addresses two important SQL Server elevation-of-privilege vulnerabilities. Linked-server queries using MSDASQL can fail with error 7416 after the update.

  Check the newer update, KB5089900

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 2 CVEs · 2 changes

  • Fix Linked Server: Addresses a linked-server vulnerability that could let a low-privileged SQL Server user gain sysadmin permissions.
  • Fix SQL Agent: Resolves a SQL injection issue that could let an authorized attacker elevate privileges over a network.
  • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2022 GDR SQL Server 2022 GDR Security update

  KB5084815 Apr 14, 2026

  Linked-server flaws fixed; MSDASQL queries can fail

  Addresses three Important SQL Server vulnerabilities, including flaws that could enable privilege escalation or remote code execution. Linked-server queries using MSDASQL and a provider string might fail with error 7416.

  Check the newer update, KB5091158

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 3 CVEs · 3 changes

  • Fix Linked Server: Addresses a flaw that could let a low-privileged SQL Server user gain sysadmin permissions through linked servers.
  • Fix Programmability: Resolves an issue where a specially crafted SQL query could make SQL Server stop responding.
  • Fix SQL Agent: Resolves a SQL injection issue that could let an authorized attacker elevate privileges over a network.

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU24 SQL Server 2022 CU24 Cumulative update

  KB5080999 Mar 12, 2026

  Parallel SESSION_CONTEXT errors and listener warnings remain open

  CU24 fixes 14 SQL Server 2022 issues, but parallel SESSION_CONTEXT queries can return wrong results or cause access violations. Availability group listeners might also generate error-log messages.

  Check the newer update, KB5083252

  Known issues: 3 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416
  • Incorrect behavior of SESSION_CONTEXT in parallel plans
  • Availability group listener error 10013 in error log

  Key changes 14 changes

  • New Replication: Replication can use a new optional setting for multi-subnet failover.
  • New Search: Full-text search batches can have a configurable timeout.
  • New Linux: The getattribute API supports symbolic links.

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU23 + GDR SQL Server 2022 CU23 + GDR Security update

  KB5077464 Mar 10, 2026

  Merge replication upgrade flaw fixed; ALTER USER restricted

  Fixes two Important vulnerabilities, including publicly disclosed CVE-2026-21262, and blocks ALTER USER when its target is the system Administrator account.

  Check the newer update, KB5083252

  Key changes 2 CVEs · 2 changes

  • Fix Replication: Fixes an elevation-of-privilege flaw in the merge replication version upgrade process.
  • Fix Security Infrastructure: ALTER USER is blocked when the target login is the system Administrator account.
  • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2022 GDR SQL Server 2022 GDR Security update

  KB5077465 Mar 10, 2026

  Merge replication privilege flaw fixed; system Administrator protected

  The update fixes two Important SQL Server vulnerabilities, including publicly disclosed CVE-2026-21262, and blocks an ALTER USER operation that targets the system Administrator login.

  Check the newer update, KB5084815

  Key changes 2 CVEs · 2 changes

  • Fix Replication: An elevation-of-privilege vulnerability in the version upgrade process for merge replication is fixed.
  • Fix Security Infrastructure: The ALTER USER operation is blocked when its target login is the system Administrator account.
  • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU23 SQL Server 2022 CU23 Cumulative update

  KB5078297 Jan 29, 2026

  Database Mail restored; parallel SESSION_CONTEXT issue remains

  CU23 restores Database Mail functionality broken by the initial release and includes 15 fixes. Queries using SESSION_CONTEXT in parallel plans can still return incorrect results or trigger access violation dumps.

  Check the newer update, KB5077464

  Known issues: 1 open

  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 16 changes

  • New SQL OS: Azure SQL Managed Instance can use sys.fn_xe_file_target_read_file() to read system_health event session data.
  • Improved High Availability and Disaster Recovery: Creating an availability group with a name longer than 64 characters returns error 19544 instead of an assertion when cluster_type is N...
  • Improved Security Infrastructure: Only sysadmins can invoke dbcc stackdump to create a dump file.

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU22 + GDR SQL Server 2022 CU22 + GDR Security update

  KB5072936 Jan 13, 2026

  DBCC stackdump is restricted to sysadmins

  Addresses CVE-2026-20803, an SQL Server elevation-of-privilege vulnerability, and limits DBCC stackdump to sysadmins.

  Check the newer update, KB5077464

  Key changes 1 CVE · 1 change

  • Fix Security Infrastructure: Only sysadmins can invoke DBCC stackdump to create a dump file.
  • CVSS 7.2 CVE-2026-20803: Microsoft SQL Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2022 GDR SQL Server 2022 GDR Security update

  KB5073031 Jan 13, 2026

  SSIS vulnerability fixed; DBCC stack dumps restricted

  The update addresses two vulnerabilities, including a SQL Server elevation-of-privilege flaw, and limits who can invoke DBCC stack dumps.

  Check the newer update, KB5077465

  Key changes 2 CVEs · 2 changes

  • Fix Integration Services: The SSIS client runtime is updated to address a vulnerability.
  • Fix Security Infrastructure: Only sysadmins can invoke a DBCC stackdump to create a dump file.
  • CVSS 7.2 CVE-2026-20803: Microsoft SQL Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU22 SQL Server 2022 CU22 Security update

  KB5068450 Nov 13, 2025

  Integration Services vulnerability fixed; parallel SESSION_CONTEXT issue remains

  CU22 updates SQL Server 2022 to build 16.0.4225.2 with 20 fixes, including a fix for CVE-2022-26907 in Integration Services. Queries using SESSION_CONTEXT can still return incorrect results or trigger access violations in parallel plans.

  Check the newer update, KB5072936

  Known issues: 1 open

  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 1 CVE · 20 changes

  • New Cleanup service: Stale Log-Replay Service metadata is cleaned up automatically after it is more than 36 days old.
  • Improved SQL OS: CacheStore PHDR usage is capped when queries consume too much server memory.
  • Fix Backup Restore: Differential backups with compression no longer hit an assertion failure on databases with large amounts of FILESTREAM records.

  Read update → Source: Microsoft ↗

• SQL Server 2022 CU21 + GDR SQL Server 2022 CU21 + GDR Security update

  KB5068406 Nov 11, 2025

  Multi-role security filters corrected; backup procedure flaw mitigated

  The update fixes one Important SQL Server elevation-of-privilege vulnerability, corrects a rare Row-Level Security issue, and mitigates SQL injection risk in an internal backup procedure.

  Check the newer update, KB5072936

  Key changes 1 CVE · 2 changes

  • Fix Analysis Services: In rare, contradictory multi-role setups, row-level security filters are consistently applied.
  • Fix Management Services: Unauthorized access to an internal backup procedure is restricted, mitigating SQL injection risk.
  • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2022 GDR SQL Server 2022 GDR Security update

  KB5068407 Nov 11, 2025

  RLS filtering enforced; backup procedure SQL injection mitigated

  Fixes a rare Analysis Services security-filtering gap and mitigates a SQL injection vulnerability in an internal backup procedure.

  Check the newer update, KB5073031

  Key changes 1 CVE · 2 changes

  • Fix Analysis Services: In rare, contradictory multi-role setups, Row-Level Security filters are consistently applied instead of being skipped.
  • Fix Management Services: Unauthorized access to an internal backup stored procedure is restricted, mitigating the risk of SQL injection.
  • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗