Skip to the content
The Update Bureau

SQL Server

SQL Server updates

All published releases for SQL Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 12, 2026.

9 active known issues →

SQL Server updates

  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5122772

    52 vulnerabilities addressed; linked-server queries can fail

    Addresses 52 vulnerabilities, including three Critical remote code execution flaws; none are listed as exploited. Some linked-server queries might fail with error 7416 after installation.

    Check the newer update, KB5128494
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 52 CVEs · 40 changes

    • Improved Replication: Replication procedures get stronger internal checks.
    • Improved Replication: Queued Updating Subscriptions in Transactional Replication get security and reliability improvements.
    • Improved Replication: Queued Updating Subscriptions in Transactional Replication get security and reliability improvements.

    Read update Source: Microsoft

    Build
    15.0.4490.9
    Security
    52 fixed · 3 critical
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5122773

    Three critical remote-code flaws affect the database engine

    Fixes 52 vulnerabilities, including three critical flaws that could allow remote code execution in SQL Server. It also lists an open issue that can make some linked server queries fail with error 7416.

    Check the newer update, KB5128495
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 52 CVEs · 40 changes

    • Improved Replication: Replication stored procedures receive stronger internal validation and security checks.
    • Improved Replication: Bounds validation is added for embedded attestation fields.
    • Improved Replication: Object Store Format deserialization is strengthened against malformed or malicious stream data.

    Read update Source: Microsoft

    Build
    15.0.2190.7
    Security
    52 fixed · 3 critical
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5122774

    Critical remote-code-execution flaw patched; linked queries can fail

    Fixes 45 vulnerabilities, including one critical SQL Server remote-code-execution flaw. Linked server queries using MSDASQL and a provider string can fail with error 7416.

    Check the newer update, KB5128496
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 45 CVEs · 27 changes

    • Improved Replication: Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.
    • Improved Replication: Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.
    • Fix Backup Restore: A vulnerability affecting SQL Server managed backup procedures is addressed.

    Read update Source: Microsoft

    Build
    14.0.3550.4
    Security
    45 fixed · 1 critical
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5122775

    Database Engine remote-code flaw patched; linked-server error remains

    The update fixes 45 vulnerabilities, including one Critical SQL Server remote-code execution flaw. Linked-server queries using MSDASQL and a provider string can still fail with error 7416.

    Check the newer update, KB5128497
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 45 CVEs · 37 changes

    • Improved Replication: Replication stored procedures get stronger internal validation and security checks.
    • Improved Backup Restore: SQL Server safely rejects malformed or undersized backup metadata processed by the VSS Writer.
    • Improved Replication: Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.

    Read update Source: Microsoft

    Build
    14.0.2130.4
    Security
    45 fixed · 1 critical
    Restart
    Required
  • SQL Server 2025 CU8 SQL Server 2025 CU8 Cumulative update

    KB5104822

    Database recovery queries can trigger access violations; JSON fixes included

    Includes 11 fixes for SQL Server 2025. It also has an open issue where querying requests during database recovery might cause an access violation and dump file.

    Check the newer update, KB5122769
    Known issues: 3 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416
    • Access violation when you query sys.dm_exec_requests during database recovery
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 11 changes

    • New PolyBase: PolyBase supports encrypted communication between its external service and gRPC clients on Linux.
    • Improved Replication: sp_adddistributor has a new optional @multi_subnet_failover parameter.
    • Fix Backup Restore: Restoring a database with WITH MOVE no longer takes a long time or times out when the server has hundreds of databases.

    Read update Source: Microsoft

    Build
    17.0.4075.5
    Restart
    Required
  • SQL Server 2025 CU7 SQL Server 2025 CU7 Cumulative update

    KB5096981

    JSON corruption fixes; recovery monitoring can still crash

    CU7 fixes 10 issues, including JSON corruption and a crash in recovery monitoring queries. A separate open issue can still cause an access violation when `sys.dm_exec_requests` runs during database recovery.

    Check the newer update, KB5104822
    Known issues: 3 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416
    • Access violation when you query sys.dm_exec_requests during database recovery
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 10 changes

    • New Universal Communication Stack: A new trace flag lets you enable TLS 1.3 without editing the registry.
    • Improved Universal Communication Stack: UCS encryption uses AES-256 instead of AES-128 when TLS isn't explicitly enabled.
    • Improved Universal Communication Stack: Service Broker dialog encryption uses AES-256.

    Read update Source: Microsoft

    Build
    17.0.4065.4
    Restart
    Required
  • SQL Server 2022 CU26 SQL Server 2022 CU26 Cumulative update

    KB5093420

    SQL injection fix, while recovery queries can still trigger crashes

    Includes 12 fixes, including a SQL injection fix. A known issue can still cause an access violation when `sys.dm_exec_requests` runs during database recovery.

    Check the newer update, KB5122768
    Known issues: 3 open
    • Linked server queries that use MSDASQL fail with error 7416
    • Access violation when you query sys.dm_exec_requests during database recovery
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 12 changes

    • New High Availability and Disaster Recovery: You can remove an IP address from an availability group listener with an ALTER AVAILABILITY GROUP command.
    • Improved High Availability and Disaster Recovery: The Windows Server Failover Cluster log includes more detailed error information when the availability group resource DLL cannot retrie...
    • Improved Query Execution: Incremental statistics use an adjusted sampling rate when the previous rate was 100 percent and many new rows have been added.

    Read update Source: Microsoft

    Build
    16.0.4265.3
    Restart
    Required
  • SQL Server 2025 CU6 + GDR SQL Server 2025 CU6 + GDR Security update

    KB5101346

    MessageQueueTask blocks unsafe MSMQ deserialization; MSDASQL links fail

    Fixes SQL Server vulnerabilities, including two critical remote code execution flaws. Linked-server queries using MSDASQL and a provider string might fail with error 7416.

    Check the newer update, KB5122769
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 8 CVEs · 7 changes

    • Fix Integration Services: Untrusted MSMQ messages can no longer trigger remote code execution through MessageQueueTask using the legacy BinaryMessageFormatter.
    • Fix Integration Service: Untrusted MSMQ messages can no longer trigger remote code execution through MessageQueueTask's restricted SoapFormatter deserialization...
    • Fix Metadata: A newly created principal no longer inherits unintended EXECUTE permission on EXTERNAL MODEL objects when it reuses the ID of a former...

    Read update Source: Microsoft

    Build
    17.0.4060.2
    Security
    8 fixed · 2 critical
    Restart
    Required
  • SQL Server 2025 GDR SQL Server 2025 GDR Security update

    KB5102333

    Critical remote-code-execution flaws fixed; MSDASQL queries still fail

    The update fixes two critical remote-code-execution vulnerabilities, CVE-2026-54117 and CVE-2026-54118. Linked-server queries using MSDASQL and a provider string can still fail with error 7416.

    Check the newer update, KB5122770
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 8 CVEs · 8 changes

    • Improved Integration Services: Password-protected Integration Services packages targeting SQL Server 2025 use stronger encryption. Packages saved after the update nee...
    • Fix Integration Services: MessageQueueTask restricts SoapFormatter deserialization to help prevent remote code execution from untrusted MSMQ messages.
    • Fix Metadata: A newly created principal no longer unintentionally inherits EXECUTE permission on EXTERNAL MODEL objects when it reuses the ID of a pr...

    Read update Source: Microsoft

    Build
    17.0.1125.2
    Security
    8 fixed · 2 critical
    Restart
    Required
  • SQL Server 2022 CU25 + GDR SQL Server 2022 CU25 + GDR Security update

    KB5101347

    Some MSDASQL linked-server queries with provider strings fail

    The update fixes four vulnerabilities, including critical SQL Server remote code execution CVE-2026-54118. Linked-server queries using MSDASQL with a provider string can fail with error 7416 in certain configurations.

    Check the newer update, KB5122768
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Service: Remote code execution through untrusted MSMQ messages is blocked in MessageQueueTask.
    • Fix Query Execution: Memory no longer leaks when the input buffer is queried with the listed SQL Server tools.
    • Fix Replication: Input passed to an internal replication stored procedure is checked and sanitized before use.

    Read update Source: Microsoft

    Build
    16.0.4262.2
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5102334

    Remote code execution flaw fixed; MSDASQL links can fail

    Fixes four vulnerabilities, including a critical SQL Server remote code execution flaw. Linked server queries using MSDASQL and a provider string might fail with error 7416.

    Check the newer update, KB5122771
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: MessageQueueTask blocks a remote code execution risk from untrusted MSMQ messages.
    • Fix Query Execution: A memory leak is fixed when the input buffer is queried.
    • Fix Replication: User input passed to an internal replication stored procedure is validated and sanitized before the procedure uses it.

    Read update Source: Microsoft

    Build
    16.0.1190.2
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5102335

    Critical remote-code flaw fixed; MSDASQL linked queries still fail

    Fixes a critical remote-code execution vulnerability and three other security vulnerabilities. Linked server queries using MSDASQL can still fail with error 7416.

    Check the newer update, KB5122772
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: Integration Services blocks remote code execution from untrusted MSMQ messages by restricting how it processes serialized data.
    • Fix Query Execution: A memory leak that can occur when querying the input buffer is fixed.
    • Fix Replication: Input passed to an internal replication procedure is validated and sanitized before use.

    Read update Source: Microsoft

    Build
    15.0.4480.2
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5102336

    Critical remote-code flaw fixed; MSDASQL queries can fail

    Fixes 4 vulnerabilities, including a Critical remote code execution flaw. Linked server queries using MSDASQL with a provider string might fail with error 7416.

    Check the newer update, KB5122773
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: Untrusted MSMQ messages can no longer trigger remote code execution through insecure deserialization in MessageQueueTask.
    • Fix Query Execution: Using sys.dm_exec_input_buffer or DBCC INPUTBUFFER no longer causes a memory leak.
    • Fix Replication: Input passed to an internal replication stored procedure is validated and sanitized before the procedure uses it.

    Read update Source: Microsoft

    Build
    15.0.2180.2
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5102337

    Critical remote-code-execution flaw fixed; linked-server error remains

    The update fixes a critical remote-code-execution vulnerability and three other issues in SQL Server 2017. Linked-server queries using MSDASQL can still fail with error 7416.

    Check the newer update, KB5122774
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: The fix restricts MessageQueueTask deserialization to help prevent remote code execution from untrusted MSMQ messages.
    • Fix Query Execution: A memory leak is fixed when sys.dm_exec_input_buffer or the DBCC INPUTBUFFER command is used.
    • Fix Replication: Input passed to an internal replication stored procedure is validated and sanitized before the procedure uses it.

    Read update Source: Microsoft

    Build
    14.0.3540.1
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5102338

    Critical remote-code flaw; MSDASQL linked-server queries can fail

    Fixes four vulnerabilities, including a critical SQL Server remote-code execution flaw. Linked-server queries using MSDASQL with a provider string might fail with error 7416.

    Check the newer update, KB5122775
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: MessageQueueTask blocks remote code execution from an untrusted Microsoft Message Queuing message by restricting unsafe deserialization...
    • Fix Query Execution: Fixes a memory leak that can occur when the input buffer is queried.
    • Fix Replication: Input passed to an internal replication procedure is validated and sanitized before the procedure uses it.

    Read update Source: Microsoft

    Build
    14.0.2120.1
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update
    Final update for this version

    KB5102339

    Untrusted MSMQ messages blocked from triggering code execution

    The update patches SQL Server security vulnerabilities, including a critical remote code execution flaw. Linked-server queries using MSDASQL can still fail with error 7416 in certain configurations.

    July 14, 2026 is the final date for SQL Server 2016 security updates.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: Untrusted Microsoft Message Queuing messages can no longer trigger remote code execution through MessageQueueTask deserialization.
    • Fix Query Execution: Using the input-buffer function or command no longer causes a memory leak.
    • Fix Replication: Input passed to an internal replication stored procedure is validated and sanitized before the procedure uses it.

    Read update Source: Microsoft

    Build
    13.0.7095.1
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update
    Final update for this version

    KB5102340

    Remote code execution flaw fixed; linked-server queries can fail

    The update fixes four vulnerabilities, including critical remote code execution vulnerability CVE-2026-54118. Linked-server queries using MSDASQL with a provider string can fail with error 7416.

    July 14, 2026 is the final date for SQL Server 2016 security updates.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 4 CVEs · 4 changes

    • Fix Integration Services: Untrusted MSMQ messages can no longer use the affected deserialization path to cause remote code execution.
    • Fix Query Execution: The memory leak associated with using the input-buffer function or command is resolved.
    • Fix Replication: Input passed to an internal replication procedure is checked and sanitized before the procedure uses it.

    Read update Source: Microsoft

    Build
    13.0.6500.1
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SQL Server 2025 CU6 SQL Server 2025 CU6 Cumulative update

    KB5093421

    Linked-server error 7416 and incorrect parallel SESSION_CONTEXT results

    Linked-server queries using MSDASQL can fail with error 7416, and parallel queries using SESSION_CONTEXT can return incorrect results or create access-violation dumps. The update also includes 19 fixes and improvements.

    Check the newer update, KB5101346
    Known issues: 2 open
    • Linked server queries that use MSDASQL fail with error 7416
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 18 changes

    • Improved High Availability and Disaster Recovery: The Pacemaker resource agent treats a forwarder replica as the local primary for the local availability group orchestrator.
    • Improved High Availability and Disaster Recovery: The Windows Failover Cluster log includes more detail when an availability group resource cannot retrieve diagnostic column information...
    • Improved Search: On Azure SQL Managed Instance, the default FULLTEXT_INDEX_VERSION database setting changes to 2.

    Read update Source: Microsoft

    Build
    17.0.4055.5
    Restart
    Required
  • SQL Server 2025 CU5 SQL Server 2025 CU5 Cumulative update

    KB5084896

    XXE and SQL injection flaws fixed; lock-memory control added

    Fixes seven issues, including an XXE vulnerability in the Web Service Task and a SQL injection vulnerability. It also adds a setting to limit lock-manager cache memory.

    Check the newer update, KB5093421
    Known issues: 2 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 7 changes

    • New Memory Management: A new setting lets administrators control the maximum size of the lock-manager cache.
    • New Replication: Linux installations can configure change feed parameters through mssql.conf.
    • Improved Search: Full-text indexing can use the version 2 feature. Indexing .docx files also returns correct results when a paragraph begins in a hyperl...

    Read update Source: Microsoft

    Build
    17.0.4045.5
    Restart
    Required
  • SQL Server 2022 CU25 SQL Server 2022 CU25 Cumulative update

    KB5081477

    Web Service Task blocks file access through WSDL endpoints

    Includes 12 fixes for SQL Server 2022, including a Web Service Task fix that blocks unauthorized file access through WSDL endpoints. It also leaves two known issues open.

    Check the newer update, KB5101347
    Known issues: 2 open
    • Linked server queries that use MSDASQL fail with error 7416
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 12 changes

    • Fix Database Mail: Database Mail sends email attachments again in Contained Availability Groups.
    • Fix Management Services: Granted permissions on stored procedures and other msdb objects are no longer lost during a SQL Server upgrade.
    • Fix SQL OS: Querying sys.dm_xe_session_targets no longer causes an access violation on affected SQL Server instances.

    Read update Source: Microsoft

    Build
    16.0.4255.1
    Restart
    Required
  • SQL Server 2025 CU4 + GDR SQL Server 2025 CU4 + GDR Security update

    KB5089899

    Web Service Task security flaw addressed; MSDASQL queries can fail

    Addresses a security flaw in the Web Service Task, but linked-server queries using MSDASQL and a provider string can fail with error 7416.

    Check the newer update, KB5101346
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: A security fix addresses an XML issue in the Web Service Task that could let an attacker read local files or cause a denial-of-service...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    17.0.4040.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2025 GDR SQL Server 2025 GDR Security update

    KB5091223

    Web Service Task flaw addressed; MSDASQL queries can fail

    Addresses one Important SQL Server vulnerability, CVE-2026-40370. Linked server queries using MSDASQL and a provider string can fail with error 7416.

    Check the newer update, KB5102333
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: A Web Service Task vulnerability that could let an attacker read local files or cause a denial-of-service attack is addressed.
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    17.0.1115.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2022 CU24 + GDR SQL Server 2022 CU24 + GDR Security update

    KB5089900

    Database Engine RCE addressed; provider-string linked queries fail

    Addresses one Important SQL Server vulnerability, CVE-2026-40370. Linked-server queries using MSDASQL and a provider string can fail with error 7416.

    Check the newer update, KB5101347
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Service: The Web Service Task fix addresses a flaw that could let an attacker read files on the server or make it unavailable.
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.4252.3
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5091158

    Web Service Task flaw addressed; linked queries can fail with 7416

    The update addresses one Important SQL Server vulnerability in the Web Service Task. Queries to other servers using the OLE DB Provider for ODBC Drivers might fail with error 7416.

    Check the newer update, KB5102334
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The Web Service Task's XML handling is changed to address a vulnerability that could let an attacker read local files or disrupt servic...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.1180.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5090407

    Web Service Task flaw addressed; linked-server error 7416 remains

    The update addresses a Web Service Task vulnerability that could let an attacker read arbitrary local files or cause a denial-of-service attack. Linked-server queries using MSDASQL can still fail with error 7416.

    Check the newer update, KB5102335
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The Web Service Task vulnerability is addressed. It could let an attacker read arbitrary files from the local file system or cause a de...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4470.1
    Security
    1 vulnerability fixed
    Restart
    Required