SQL Server 2025

Build history

• SQL Server 2025 CU11 SQL Server 2025 CU11 Cumulative update

  Updated Nov 13

  KB5129223 Nov 12, 2026

  Parallel SESSION_CONTEXT queries can return wrong results

  Queries using SESSION_CONTEXT might return wrong results or create crash dump files when they run in parallel; this remains a known issue. CU11 includes 70 fixes for SQL Server 2025.

  Known issues: 1 open

  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 70 changes

  • New High Availability and Disaster Recovery: Certificate authentication is supported for endpoints on systems that use only TLS 1.3.
  • New High Availability and Disaster Recovery: Service Broker endpoints can use TLS through Schannel.
  • New Programmability: A new Japanese collation is available for databases.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU10 + GDR SQL Server 2025 CU10 + GDR Security update

  Updated Nov 10

  KB5129299 Nov 10, 2026

  Recovery monitoring queries can crash the database engine

  Queries against `sys.dm_exec_requests` might raise an access violation while a database is recovering. The release also fixes security flaws across SQL Server components.

  Known issues: 1 open Organizations and IT administrators

  • Access violation when you query sys.dm_exec_requests during database recovery

  Key changes 59 CVEs · 71 changes

  • Improved Integration Services: XSLT scripting is disabled by default.
  • Improved Methods to access stored data: Security for index operations is improved.
  • Improved Methods to access stored data: Security for transaction logging is improved.

  Read update → Source: Microsoft ↗

• SQL Server 2025 GDR SQL Server 2025 GDR Security update

  Updated Nov 10

  KB5132748 Nov 10, 2026

  Replication and database data-handling flaws fixed

  Fixes SQL Server security flaws and memory-safety problems across database, JSON, and replication tasks. Some fixes prevent crashes or unintended data exposure.

  Key changes 58 CVEs · 59 changes

  • Improved Integration Services: XSLT scripting is off by default. You can restore the previous behavior with a setting.
  • Improved Replication: Merge replication checks names more carefully.
  • Improved Replication: Transactional replication checks names more carefully.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU10 SQL Server 2025 CU10 Cumulative update

  Updated Nov 10

  KB5125471 Oct 22, 2026

  Recovery checks can trigger access violations

  Queries against `sys.dm_exec_requests` during database recovery can trigger access violations and dump files. CU10 also leaves open an issue where parallel `SESSION_CONTEXT` queries can return wrong results.

  Check the newer update, KB5129299

  Known issues: 2 open

  • Access violation when you query sys.dm_exec_requests during database recovery
  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 37 changes

  • New Programmability: SQL Server on Linux can map Windows time-zone IDs to new and updated IANA time zones.
  • Improved Extensibility: The archive extraction component used to install external language and library packages is updated.
  • Improved High Availability and Disaster Recovery: Availability group secondary replicas now reject oversized FILESTREAM fragments.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU9 + GDR SQL Server 2025 CU9 + GDR Security update

  Updated Nov 10

  KB5126967 Oct 13, 2026

  Backup and PolyBase flaws fixed; recovery queries can crash

  Security fixes cover SQL Server components used for backup, PolyBase, and replication. Queries during database recovery can still trigger an access violation; a trace-flag mitigation is available.

  Check the newer update, KB5129299

  Known issues: 2 open

  • Linked server queries that use MSDASQL fail with error 7416
  • Access violation when you query sys.dm_exec_requests during database recovery

  Key changes 24 CVEs · 25 changes

  • Improved High Availability and Disaster Recovery: Oversized backup fragments on secondary database copies are rejected.
  • Improved PolyBase: Incoming changes to a table are checked against its expected layout.
  • Improved PolyBase: Data sharing with external data tools uses updated memory handling.

  Read update → Source: Microsoft ↗

• SQL Server 2025 GDR SQL Server 2025 GDR Security update

  Updated Nov 10

  KB5128492 Oct 13, 2026

  23 SQL vulnerabilities addressed; MSDASQL linked queries still fail

  Addresses 23 SQL Server vulnerabilities, including 22 rated Important. Linked server queries using MSDASQL can still fail with error 7416 in some configurations.

  Check the newer update, KB5132748

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 23 CVEs · 27 changes

  • Improved Extensibility: Package extraction uses an updated archive-extraction component when external language or external library packages are installed.
  • Improved High Availability and Disaster Recovery: Availability Group secondary replicas reject oversized FILESTREAM fragments.
  • Improved Query Store: Showplan input handling is more secure and reliable.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU9 SQL Server 2025 CU9 Cumulative update

  KB5122048 Sep 15, 2026

  Parallel session results can be wrong; recovery queries can crash

  CU9 for SQL Server 2025 includes 45 fixes, but it also has open issues that can affect parallel SESSION_CONTEXT queries, MSDASQL linked servers, and queries during database recovery.

  Check the newer update, KB5126967

  Known issues: 3 open

  • Linked server queries that use MSDASQL fail with error 7416
  • Access violation when you query sys.dm_exec_requests during database recovery
  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 45 changes

  • New SQL OS: Manual soft-NUMA configuration is available for the Standard and Standard Developer editions.
  • New High Availability and Disaster Recovery: Managed Instance link supports linking multiple databases so they can be replicated and failed over together.
  • Improved Backup Restore: Malformed or undersized backup metadata is rejected more safely.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU8 + GDR SQL Server 2025 CU8 + GDR Security update

  KB5122769 Sep 8, 2026

  Four critical remote-code flaws fixed; MSDASQL queries may fail

  Fixes 56 vulnerabilities, including four critical SQL Server remote-code execution flaws. Linked-server queries using MSDASQL with a provider string can fail, and queries during database recovery can trigger an access violation.

  Check the newer update, KB5126967

  Known issues: 2 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416
  • Access violation when you query sys.dm_exec_requests during database recovery

  Key changes 56 CVEs · 47 changes

  • Improved PolyBase: Validation of responses from S3-compatible external storage endpoints improves.
  • Improved Replication: Security checks for replication stored procedures are strengthened so operations use the expected safeguards.
  • Improved Replication: Object Store Format deserialization is strengthened against malformed or malicious stream data.

  Read update → Source: Microsoft ↗

• SQL Server 2025 GDR SQL Server 2025 GDR Security update

  KB5122770 Sep 8, 2026

  Critical database flaws addressed; linked-server queries may fail

  Addresses 56 SQL Server vulnerabilities, including four critical remote-code-execution flaws. Linked server queries using MSDASQL and a provider string can fail with error 7416.

  Check the newer update, KB5128492

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 56 CVEs · 42 changes

  • Improved PolyBase: Responses from S3-compatible external storage are validated more carefully.
  • Improved Query Store: Showplan input handling is improved for security and reliability.
  • Improved Replication: Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU8 SQL Server 2025 CU8 Cumulative update

  KB5104822 Aug 13, 2026

  Database recovery queries can trigger access violations; JSON fixes included

  Includes 11 fixes for SQL Server 2025. It also has an open issue where querying requests during database recovery might cause an access violation and dump file.

  Check the newer update, KB5122769

  Known issues: 3 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416
  • Access violation when you query sys.dm_exec_requests during database recovery
  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 11 changes

  • New PolyBase: PolyBase supports encrypted communication between its external service and gRPC clients on Linux.
  • Improved Replication: sp_adddistributor has a new optional @multi_subnet_failover parameter.
  • Fix Backup Restore: Restoring a database with WITH MOVE no longer takes a long time or times out when the server has hundreds of databases.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU7 SQL Server 2025 CU7 Cumulative update

  KB5096981 Jul 16, 2026

  JSON corruption fixes; recovery monitoring can still crash

  CU7 fixes 10 issues, including JSON corruption and a crash in recovery monitoring queries. A separate open issue can still cause an access violation when `sys.dm_exec_requests` runs during database recovery.

  Check the newer update, KB5104822

  Known issues: 3 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416
  • Access violation when you query sys.dm_exec_requests during database recovery
  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 10 changes

  • New Universal Communication Stack: A new trace flag lets you enable TLS 1.3 without editing the registry.
  • Improved Universal Communication Stack: UCS encryption uses AES-256 instead of AES-128 when TLS isn't explicitly enabled.
  • Improved Universal Communication Stack: Service Broker dialog encryption uses AES-256.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU6 + GDR SQL Server 2025 CU6 + GDR Security update

  KB5101346 Jul 14, 2026

  MessageQueueTask blocks unsafe MSMQ deserialization; MSDASQL links fail

  Fixes SQL Server vulnerabilities, including two critical remote code execution flaws. Linked-server queries using MSDASQL and a provider string might fail with error 7416.

  Check the newer update, KB5122769

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 8 CVEs · 7 changes

  • Fix Integration Services: Untrusted MSMQ messages can no longer trigger remote code execution through MessageQueueTask using the legacy BinaryMessageFormatter.
  • Fix Integration Service: Untrusted MSMQ messages can no longer trigger remote code execution through MessageQueueTask's restricted SoapFormatter deserialization...
  • Fix Metadata: A newly created principal no longer inherits unintended EXECUTE permission on EXTERNAL MODEL objects when it reuses the ID of a former...

  Read update → Source: Microsoft ↗

• SQL Server 2025 GDR SQL Server 2025 GDR Security update

  KB5102333 Jul 14, 2026

  Critical remote-code-execution flaws fixed; MSDASQL queries still fail

  The update fixes two critical remote-code-execution vulnerabilities, CVE-2026-54117 and CVE-2026-54118. Linked-server queries using MSDASQL and a provider string can still fail with error 7416.

  Check the newer update, KB5122770

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 8 CVEs · 8 changes

  • Improved Integration Services: Password-protected Integration Services packages targeting SQL Server 2025 use stronger encryption. Packages saved after the update nee...
  • Fix Integration Services: MessageQueueTask restricts SoapFormatter deserialization to help prevent remote code execution from untrusted MSMQ messages.
  • Fix Metadata: A newly created principal no longer unintentionally inherits EXECUTE permission on EXTERNAL MODEL objects when it reuses the ID of a pr...

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU6 SQL Server 2025 CU6 Cumulative update

  KB5093421 Jun 17, 2026

  Linked-server error 7416 and incorrect parallel SESSION_CONTEXT results

  Linked-server queries using MSDASQL can fail with error 7416, and parallel queries using SESSION_CONTEXT can return incorrect results or create access-violation dumps. The update also includes 19 fixes and improvements.

  Check the newer update, KB5101346

  Known issues: 2 open

  • Linked server queries that use MSDASQL fail with error 7416
  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 18 changes

  • Improved High Availability and Disaster Recovery: The Pacemaker resource agent treats a forwarder replica as the local primary for the local availability group orchestrator.
  • Improved High Availability and Disaster Recovery: The Windows Failover Cluster log includes more detail when an availability group resource cannot retrieve diagnostic column information...
  • Improved Search: On Azure SQL Managed Instance, the default FULLTEXT_INDEX_VERSION database setting changes to 2.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU5 SQL Server 2025 CU5 Cumulative update

  KB5084896 May 20, 2026

  XXE and SQL injection flaws fixed; lock-memory control added

  Fixes seven issues, including an XXE vulnerability in the Web Service Task and a SQL injection vulnerability. It also adds a setting to limit lock-manager cache memory.

  Check the newer update, KB5093421

  Known issues: 2 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416
  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 7 changes

  • New Memory Management: A new setting lets administrators control the maximum size of the lock-manager cache.
  • New Replication: Linux installations can configure change feed parameters through mssql.conf.
  • Improved Search: Full-text indexing can use the version 2 feature. Indexing .docx files also returns correct results when a paragraph begins in a hyperl...

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU4 + GDR SQL Server 2025 CU4 + GDR Security update

  KB5089899 May 12, 2026

  Web Service Task security flaw addressed; MSDASQL queries can fail

  Addresses a security flaw in the Web Service Task, but linked-server queries using MSDASQL and a provider string can fail with error 7416.

  Check the newer update, KB5101346

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 1 CVE · 1 change

  • Fix Integration Services: A security fix addresses an XML issue in the Web Service Task that could let an attacker read local files or cause a denial-of-service...
  • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2025 GDR SQL Server 2025 GDR Security update

  KB5091223 May 12, 2026

  Web Service Task flaw addressed; MSDASQL queries can fail

  Addresses one Important SQL Server vulnerability, CVE-2026-40370. Linked server queries using MSDASQL and a provider string can fail with error 7416.

  Check the newer update, KB5102333

  Known issues: 1 open

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 1 CVE · 1 change

  • Fix Integration Services: A Web Service Task vulnerability that could let an attacker read local files or cause a denial-of-service attack is addressed.
  • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU4 SQL Server 2025 CU4 Cumulative update

  KB5081495 Apr 16, 2026

  Fixes lost msdb permissions and Full-Text Search failures

  CU4 includes 11 fixes for SQL Server 2025, including lost permissions during upgrades and failures in Full-Text Search. It also has two open known issues involving parallel SESSION_CONTEXT queries and MSDASQL linked servers.

  Check the newer update, KB5089899

  Known issues: 2 open

  • Linked server queries that use MSDASQL fail with error 7416
  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 11 changes

  • Improved JSON: Json_contains uses either exact-match or pattern-match comparison, with exact match as the default.
  • Improved High Availability and Disaster Recovery: Contained availability groups restrict which databases can be added. For DBCreator, the database owner must also match the logged-in us...
  • Fix Database Mail: Database Mail sends email attachments again when used with contained availability groups and sp_RunMailQuery.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU3 + GDR SQL Server 2025 CU3 + GDR Security update

  KB5083245 Apr 14, 2026

  Linked-server privilege flaw fixed; MSDASQL queries can fail

  The update fixes two SQL Server vulnerabilities, including a linked-server privilege issue. Linked-server queries using MSDASQL and a provider string might fail with error 7416.

  Check the newer update, KB5089899

  Known issues: 1 open

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 2 CVEs · 2 changes

  • Fix Linked Server: A linked-server privilege vulnerability is addressed. It could let a low-privileged SQL Server user gain sysadmin permissions.
  • Fix SQL Agent: An SQL injection vulnerability that could let an authorized attacker elevate privileges over a network is resolved.
  • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2025 GDR SQL Server 2025 GDR Security update

  KB5084814 Apr 14, 2026

  Linked-server privilege flaw addressed; MSDASQL queries can fail

  The update addresses two Important elevation-of-privilege vulnerabilities, with fixes involving linked servers and SQL Agent. Some linked-server queries using MSDASQL can fail with error 7416 after installation.

  Check the newer update, KB5091223

  Known issues: 1 open Organizations and IT administrators

  • Linked server queries that use MSDASQL fail with error 7416

  Key changes 2 CVEs · 2 changes

  • Fix Linked Server: The update addresses a flaw that could let a low-privileged SQL Server user gain sysadmin permission through linked servers.
  • Fix SQL Agent: The update resolves an issue where special elements in SQL commands could let an authorized attacker elevate privileges over a network.
  • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU3 SQL Server 2025 CU3 Cumulative update

  KB5077896 Mar 12, 2026

  SqlLocalDB crashes fixed; bulk import gains delegated permissions

  Fixes SQL Server issues including SqlLocalDB crashes and adds support for bulk data imports without requiring sysadmin access. Queries using SESSION_CONTEXT might return incorrect results in parallel plans.

  Check the newer update, KB5083245

  Known issues: 1 open

  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 15 changes

  • New Security Infrastructure: Linux supports bulk data imports through the Bulkadmin role and ADMINISTER BULK OPERATIONS permission, without requiring sysadmin acces...
  • New Search: Full-text search batches can use a configurable timeout.
  • New Linux: The getattribute API supports symbolic links.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU2 + GDR SQL Server 2025 CU2 + GDR Security update

  KB5077466 Mar 10, 2026

  Internal procedure removed; merge replication upgrade flaw fixed

  The update removes an internal procedure tied to a potential SQL injection vulnerability and fixes an elevation-of-privilege flaw in merge replication upgrades. It also blocks a specific ALTER USER operation.

  Check the newer update, KB5083245

  Key changes 3 CVEs · 3 changes

  • Fix Replication: The merge replication version upgrade process is protected against an elevation-of-privilege vulnerability.
  • Fix Security Infrastructure: An ALTER USER operation is blocked when its target login is the system Administrator account.
  • Removed Internal System Metadata: A potential SQL injection route is removed from the database engine.

  Read update → Source: Microsoft ↗

• SQL Server 2025 GDR SQL Server 2025 GDR Security update

  KB5077468 Mar 10, 2026

  Merge replication upgrade privilege flaw patched

  The update fixes three Important vulnerabilities; CVE-2026-21262 is publicly disclosed. It also removes a potential SQL injection path and blocks ALTER USER against the system Administrator login.

  Check the newer update, KB5084814

  Key changes 3 CVEs · 3 changes

  • Fix Internal System Metadata: A potential SQL injection path is removed.
  • Fix Replication: A privilege flaw in the merge replication version upgrade process is fixed.
  • Fix Security Infrastructure: The ALTER USER operation is blocked when the target login is the system Administrator account.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU2 SQL Server 2025 CU2 Cumulative update

  KB5075211 Feb 12, 2026

  Six fixes; parallel SESSION_CONTEXT queries can return wrong results

  Fixes six SQL Server 2025 issues, including problems with backups, availability groups, and replication. A known issue remains: parallel queries using SESSION_CONTEXT might return incorrect results or produce access violation dump files.

  Check the newer update, KB5077466

  Known issues: 1 open

  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 6 changes

  • Fix Backup Restore: StripedVdi tests no longer fail when Sqlvdi.dll is not registered on a running instance.
  • Fix High Availability and Disaster Recovery: Availability group replicas receive the same properties when the cluster type is NONE or EXTERNAL.
  • Fix Resource Governor: Resource Governor accounting for tempdb space is more accurate when accelerated database recovery is enabled for tempdb.

  Read update → Source: Microsoft ↗

• SQL Server 2025 CU1 SQL Server 2025 CU1 Cumulative update

  KB5078298 Jan 29, 2026

  Database Mail restored; parallel SESSION_CONTEXT issue remains

  This CU restores Database Mail functionality broken by the initial CU1 release and includes 16 fixes. Queries using SESSION_CONTEXT in parallel plans can still return incorrect results or cause access violation dump files.

  Check the newer update, KB5075211

  Known issues: 1 open

  • Incorrect behavior of SESSION_CONTEXT in parallel plans

  Key changes 17 changes

  • New Linux: SQL Server 2025 can be registered on Linux containers by setting MSSQL_PID to StandardDeveloper or EnterpriseDeveloper.
  • New High Availability and Disaster Recovery: Contained Availability Group users can create or restore a database through a listener without connecting to the SQL instance.
  • Improved Security Infrastructure: Only sysadmins can invoke dbcc stackdump to create a dump file.

  Read update → Source: Microsoft ↗