Skip to the content
The Update Bureau

SQL Server

SQL Server updates

All published releases for SQL Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 12, 2026.

9 active known issues →

SQL Server updates

  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5090408

    Remote code execution flaw addressed; MSDASQL queries can fail

    Addresses a SQL Server remote code execution vulnerability. Linked server queries using MSDASQL and a provider string can fail with error 7416.

    Check the newer update, KB5102336
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The Web Service Task's XML flaw is addressed; it could let an attacker read local files or cause a denial-of-service.
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2170.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5090354

    Web Service Task flaw could expose files or disrupt service

    Addresses an Important SQL Server remote code execution vulnerability and a Web Service Task XML flaw that could expose local files or cause a denial-of-service. Some linked server queries using MSDASQL still fail with error 7416.

    Check the newer update, KB5102337
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The Web Service Task's XML processing is protected against a flaw that could let an attacker read local files or cause a denial-of-serv...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3530.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5090347

    Linked-server queries with MSDASQL provider strings fail

    The update addresses an XML external entity flaw in Integration Services. Linked-server queries using MSDASQL with a provider string can fail with error 7416.

    Check the newer update, KB5102338
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The XML external entity (XXE) vulnerability in the Web Service Task is addressed. It could let an attacker read local files or cause a...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2110.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5089270

    Web Service Task flaw addressed; linked-server error remains

    The update addresses an XML external entity vulnerability in the Web Service Task. Linked server queries using MSDASQL can still fail with error 7416.

    Check the newer update, KB5102339
    SQL Server 2016 security updates end July 14, 2026.
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The Web Service Task fix addresses an XML external entity vulnerability that could let an attacker read local files or cause a denial-o...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7085.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5089271

    Web Service Task XML vulnerability addressed; linked queries fail

    The update addresses an XML external entity vulnerability in the Web Service Task. Linked server queries using MSDASQL can still fail with error 7416; Microsoft links to troubleshooting information and workarounds.

    Check the newer update, KB5102340
    Security updates for SQL Server 2016 end on July 14, 2026.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 1 CVE · 1 change

    • Fix Integration Services: The Web Service Task's XML handling is addressed for a vulnerability that could let an attacker read local files or cause a denial of s...
    • CVSS 8.8 CVE-2026-40370: SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6490.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2025 CU4 SQL Server 2025 CU4 Cumulative update

    KB5081495

    Fixes lost msdb permissions and Full-Text Search failures

    CU4 includes 11 fixes for SQL Server 2025, including lost permissions during upgrades and failures in Full-Text Search. It also has two open known issues involving parallel SESSION_CONTEXT queries and MSDASQL linked servers.

    Check the newer update, KB5089899
    Known issues: 2 open
    • Linked server queries that use MSDASQL fail with error 7416
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 11 changes

    • Improved JSON: Json_contains uses either exact-match or pattern-match comparison, with exact match as the default.
    • Improved High Availability and Disaster Recovery: Contained availability groups restrict which databases can be added. For DBCreator, the database owner must also match the logged-in us...
    • Fix Database Mail: Database Mail sends email attachments again when used with contained availability groups and sp_RunMailQuery.

    Read update Source: Microsoft

    Build
    17.0.4035.5
    Restart
    Required
  • SQL Server 2025 CU3 + GDR SQL Server 2025 CU3 + GDR Security update

    KB5083245

    Linked-server privilege flaw fixed; MSDASQL queries can fail

    The update fixes two SQL Server vulnerabilities, including a linked-server privilege issue. Linked-server queries using MSDASQL and a provider string might fail with error 7416.

    Check the newer update, KB5089899
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: A linked-server privilege vulnerability is addressed. It could let a low-privileged SQL Server user gain sysadmin permissions.
    • Fix SQL Agent: An SQL injection vulnerability that could let an authorized attacker elevate privileges over a network is resolved.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    17.0.4030.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2025 GDR SQL Server 2025 GDR Security update

    KB5084814

    Linked-server privilege flaw addressed; MSDASQL queries can fail

    The update addresses two Important elevation-of-privilege vulnerabilities, with fixes involving linked servers and SQL Agent. Some linked-server queries using MSDASQL can fail with error 7416 after installation.

    Check the newer update, KB5091223
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: The update addresses a flaw that could let a low-privileged SQL Server user gain sysadmin permission through linked servers.
    • Fix SQL Agent: The update resolves an issue where special elements in SQL commands could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    17.0.1110.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 CU24 + GDR SQL Server 2022 CU24 + GDR Security update

    KB5083252

    Linked-server privilege flaw addressed; MSDASQL queries can fail

    Addresses two important SQL Server elevation-of-privilege vulnerabilities. Linked-server queries using MSDASQL can fail with error 7416 after the update.

    Check the newer update, KB5089900
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: Addresses a linked-server vulnerability that could let a low-privileged SQL Server user gain sysadmin permissions.
    • Fix SQL Agent: Resolves a SQL injection issue that could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.4250.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5084815

    Linked-server flaws fixed; MSDASQL queries can fail

    Addresses three Important SQL Server vulnerabilities, including flaws that could enable privilege escalation or remote code execution. Linked-server queries using MSDASQL and a provider string might fail with error 7416.

    Check the newer update, KB5091158
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 3 CVEs · 3 changes

    • Fix Linked Server: Addresses a flaw that could let a low-privileged SQL Server user gain sysadmin permissions through linked servers.
    • Fix Programmability: Resolves an issue where a specially crafted SQL query could make SQL Server stop responding.
    • Fix SQL Agent: Resolves a SQL injection issue that could let an authorized attacker elevate privileges over a network.

    Read update Source: Microsoft

    Build
    16.0.1175.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5084816

    Linked-server privilege flaws fixed; MSDASQL queries can fail

    The update addresses two SQL Server elevation-of-privilege vulnerabilities. Linked-server queries using MSDASQL can still fail with error 7416.

    Check the newer update, KB5090407
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: The update addresses a linked-server vulnerability that could let a low-privileged SQL Server user gain sysadmin permissions.
    • Fix SQL Agent: The update addresses a SQL injection vulnerability that could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4465.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5084817

    Linked-server security flaws fixed; MSDASQL queries can fail

    Fixes two Important SQL Server elevation-of-privilege vulnerabilities. Linked-server queries using MSDASQL might fail with error 7416 after installation.

    Check the newer update, KB5090408
    Known issues: 1 open
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: Addresses a linked-server vulnerability that could let a low-privileged SQL Server user gain sysadmin permissions.
    • Fix SQL Agent: Resolves an issue where SQL injection could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2165.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5084818

    Linked-server privilege flaws addressed; MSDASQL queries can fail

    Two Important SQL Server elevation-of-privilege vulnerabilities are addressed, including flaws in linked servers and SQL Agent. A known issue can make MSDASQL linked-server queries fail with error 7416.

    Check the newer update, KB5090354
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: The fix addresses a flaw that could let a low-privileged SQL Server user gain sysadmin permissions.
    • Fix SQL Agent: The fix resolves a SQL injection issue that could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3525.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5084819

    Linked-server privilege flaw addressed; MSDASQL queries fail

    Fixes two Important elevation-of-privilege vulnerabilities. Linked server queries using MSDASQL with a provider string fail with error 7416.

    Check the newer update, KB5090347
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: The fix addresses a flaw that lets a low-privileged SQL Server user gain sysadmin permissions through a linked server.
    • Fix SQL Agent: The fix resolves a SQL injection issue that allows an authorized attacker to elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2105.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5084820

    Linked-server privilege flaw addressed; MSDASQL queries fail

    The update addresses two SQL Server elevation-of-privilege vulnerabilities. Linked-server queries using MSDASQL with a provider string might fail with error 7416.

    Check the newer update, KB5089270
    Security updates for SQL Server 2016 are scheduled to end July 14, 2026.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: Addresses a linked-server vulnerability that could let a low-privileged SQL Server user gain sysadmin permissions.
    • Fix SQL Agent: Resolves a SQL injection issue that could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7080.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5084821

    MSDASQL linked-server queries fail with error 7416

    The update addresses two SQL Server elevation-of-privilege vulnerabilities. Linked-server queries using MSDASQL with a provider string fail with error 7416.

    Check the newer update, KB5089271
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.
    Known issues: 1 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416

    Key changes 2 CVEs · 2 changes

    • Fix Linked Server: Addresses a vulnerability that could let a low-privileged SQL Server user gain sysadmin permissions through linked servers.
    • Fix SQL Agent: Resolves a SQL injection issue that could let an authorized attacker elevate privileges over a network.
    • CVSS 6.7 CVE-2026-32167: SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6485.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2025 CU3 SQL Server 2025 CU3 Cumulative update

    KB5077896

    SqlLocalDB crashes fixed; bulk import gains delegated permissions

    Fixes SQL Server issues including SqlLocalDB crashes and adds support for bulk data imports without requiring sysadmin access. Queries using SESSION_CONTEXT might return incorrect results in parallel plans.

    Check the newer update, KB5083245
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 15 changes

    • New Security Infrastructure: Linux supports bulk data imports through the Bulkadmin role and ADMINISTER BULK OPERATIONS permission, without requiring sysadmin acces...
    • New Search: Full-text search batches can use a configurable timeout.
    • New Linux: The getattribute API supports symbolic links.

    Read update Source: Microsoft

    Build
    17.0.4025.3
    Restart
    Required
  • SQL Server 2022 CU24 SQL Server 2022 CU24 Cumulative update

    KB5080999

    Parallel SESSION_CONTEXT errors and listener warnings remain open

    CU24 fixes 14 SQL Server 2022 issues, but parallel SESSION_CONTEXT queries can return wrong results or cause access violations. Availability group listeners might also generate error-log messages.

    Check the newer update, KB5083252
    Known issues: 3 open Organizations and IT administrators
    • Linked server queries that use MSDASQL fail with error 7416
    • Incorrect behavior of SESSION_CONTEXT in parallel plans
    • Availability group listener error 10013 in error log

    Key changes 14 changes

    • New Replication: Replication can use a new optional setting for multi-subnet failover.
    • New Search: Full-text search batches can have a configurable timeout.
    • New Linux: The getattribute API supports symbolic links.

    Read update Source: Microsoft

    Build
    16.0.4245.2
    Restart
    Required
  • SQL Server 2025 CU2 + GDR SQL Server 2025 CU2 + GDR Security update

    KB5077466

    Internal procedure removed; merge replication upgrade flaw fixed

    The update removes an internal procedure tied to a potential SQL injection vulnerability and fixes an elevation-of-privilege flaw in merge replication upgrades. It also blocks a specific ALTER USER operation.

    Check the newer update, KB5083245

    Key changes 3 CVEs · 3 changes

    • Fix Replication: The merge replication version upgrade process is protected against an elevation-of-privilege vulnerability.
    • Fix Security Infrastructure: An ALTER USER operation is blocked when its target login is the system Administrator account.
    • Removed Internal System Metadata: A potential SQL injection route is removed from the database engine.

    Read update Source: Microsoft

    Build
    17.0.4020.2
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2025 GDR SQL Server 2025 GDR Security update

    KB5077468

    Merge replication upgrade privilege flaw patched

    The update fixes three Important vulnerabilities; CVE-2026-21262 is publicly disclosed. It also removes a potential SQL injection path and blocks ALTER USER against the system Administrator login.

    Check the newer update, KB5084814

    Key changes 3 CVEs · 3 changes

    • Fix Internal System Metadata: A potential SQL injection path is removed.
    • Fix Replication: A privilege flaw in the merge replication version upgrade process is fixed.
    • Fix Security Infrastructure: The ALTER USER operation is blocked when the target login is the system Administrator account.

    Read update Source: Microsoft

    Build
    17.0.1105.2
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 CU23 + GDR SQL Server 2022 CU23 + GDR Security update

    KB5077464

    Merge replication upgrade flaw fixed; ALTER USER restricted

    Fixes two Important vulnerabilities, including publicly disclosed CVE-2026-21262, and blocks ALTER USER when its target is the system Administrator account.

    Check the newer update, KB5083252

    Key changes 2 CVEs · 2 changes

    • Fix Replication: Fixes an elevation-of-privilege flaw in the merge replication version upgrade process.
    • Fix Security Infrastructure: ALTER USER is blocked when the target login is the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.4240.4
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5077465

    Merge replication privilege flaw fixed; system Administrator protected

    The update fixes two Important SQL Server vulnerabilities, including publicly disclosed CVE-2026-21262, and blocks an ALTER USER operation that targets the system Administrator login.

    Check the newer update, KB5084815

    Key changes 2 CVEs · 2 changes

    • Fix Replication: An elevation-of-privilege vulnerability in the version upgrade process for merge replication is fixed.
    • Fix Security Infrastructure: The ALTER USER operation is blocked when its target login is the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.1170.5
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5077469

    Merge replication upgrade flaw fixed; ALTER USER restricted

    The update addresses two SQL Server elevation-of-privilege vulnerabilities. It also fixes a flaw in the merge replication version-upgrade process and blocks a specific ALTER USER operation.

    Check the newer update, KB5084816

    Key changes 2 CVEs · 2 changes

    • Fix Replication: An elevation-of-privilege vulnerability in the merge replication version-upgrade process is fixed.
    • Fix Security Infrastructure: ALTER USER is blocked when the target login is the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4460.4
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5077470

    Merge replication privilege flaw fixed; ALTER USER restricted

    Fixes two Important SQL Server vulnerabilities, including the publicly disclosed CVE-2026-21262, and blocks a specific ALTER USER operation.

    Check the newer update, KB5084817

    Key changes 2 CVEs · 2 changes

    • Fix Replication: The merge replication version upgrade process is protected against an elevation-of-privilege vulnerability.
    • Fix Security Infrastructure: ALTER USER is blocked when the target login is the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2160.4
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5077471

    Merge replication flaw fixed; ALTER USER blocked for Administrator

    The update fixes two Important SQL Server elevation-of-privilege vulnerabilities, including publicly disclosed CVE-2026-21262. It also blocks ALTER USER when the target login is the system Administrator account.

    Check the newer update, KB5084818

    Key changes 2 CVEs · 2 changes

    • Fix Replication: The merge replication version upgrade process no longer has the elevation-of-privilege vulnerability addressed by this update.
    • Fix Security Infrastructure: ALTER USER is blocked when the target login is the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3520.4
    Security
    2 vulnerabilities fixed
    Restart
    Required