Skip to the content
The Update Bureau

SQL Server

SQL Server updates

All published releases for SQL Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 12, 2026.

9 active known issues →

SQL Server updates

  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5077472

    Merge replication privilege flaw fixed; system Administrator protected

    The update fixes an elevation-of-privilege vulnerability in merge replication and blocks an ALTER USER operation targeting the system Administrator account.

    Check the newer update, KB5084819

    Key changes 2 CVEs · 2 changes

    • Fix Replication: A security flaw in the merge replication version upgrade process is fixed.
    • Fix Security Infrastructure: The ALTER USER operation is blocked if it targets the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2100.4
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5077473

    Merge replication privilege flaw fixed; Administrator changes blocked

    The update fixes two Important SQL Server vulnerabilities, including publicly disclosed CVE-2026-21262, and blocks ALTER USER operations that target the system Administrator account.

    Check the newer update, KB5084820
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 2 CVEs · 2 changes

    • Fix Replication: A vulnerability in the merge replication version upgrade process is fixed.
    • Fix Security Infrastructure: Changing a user when the target login is the system Administrator account is blocked.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7075.5
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5077474

    Merge replication privilege flaw fixed; Administrator login protected

    Fixes two important vulnerabilities in SQL Server 2016 SP3 GDR, including a publicly disclosed elevation-of-privilege flaw. It also blocks ALTER USER when the target is the system Administrator account.

    Check the newer update, KB5084821
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 2 CVEs · 2 changes

    • Fix Replication: The merge replication version-upgrade process no longer has the elevation-of-privilege vulnerability addressed by this update.
    • Fix Security Infrastructure: The ALTER USER operation is blocked when the target login is the system Administrator account.
    • CVSS 8.8 CVE-2026-21262: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6480.4
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2025 CU2 SQL Server 2025 CU2 Cumulative update

    KB5075211

    Six fixes; parallel SESSION_CONTEXT queries can return wrong results

    Fixes six SQL Server 2025 issues, including problems with backups, availability groups, and replication. A known issue remains: parallel queries using SESSION_CONTEXT might return incorrect results or produce access violation dump files.

    Check the newer update, KB5077466
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 6 changes

    • Fix Backup Restore: StripedVdi tests no longer fail when Sqlvdi.dll is not registered on a running instance.
    • Fix High Availability and Disaster Recovery: Availability group replicas receive the same properties when the cluster type is NONE or EXTERNAL.
    • Fix Resource Governor: Resource Governor accounting for tempdb space is more accurate when accelerated database recovery is enabled for tempdb.

    Read update Source: Microsoft

    Build
    17.0.4015.4
    Restart
    Required
  • SQL Server 2025 CU1 SQL Server 2025 CU1 Cumulative update

    KB5078298

    Database Mail restored; parallel SESSION_CONTEXT issue remains

    This CU restores Database Mail functionality broken by the initial CU1 release and includes 16 fixes. Queries using SESSION_CONTEXT in parallel plans can still return incorrect results or cause access violation dump files.

    Check the newer update, KB5075211
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 17 changes

    • New Linux: SQL Server 2025 can be registered on Linux containers by setting MSSQL_PID to StandardDeveloper or EnterpriseDeveloper.
    • New High Availability and Disaster Recovery: Contained Availability Group users can create or restore a database through a listener without connecting to the SQL instance.
    • Improved Security Infrastructure: Only sysadmins can invoke dbcc stackdump to create a dump file.

    Read update Source: Microsoft

    Build
    17.0.4006.2
    Restart
    Required
  • SQL Server 2022 CU23 SQL Server 2022 CU23 Cumulative update

    KB5078297

    Database Mail restored; parallel SESSION_CONTEXT issue remains

    CU23 restores Database Mail functionality broken by the initial release and includes 15 fixes. Queries using SESSION_CONTEXT in parallel plans can still return incorrect results or trigger access violation dumps.

    Check the newer update, KB5077464
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 16 changes

    • New SQL OS: Azure SQL Managed Instance can use sys.fn_xe_file_target_read_file() to read system_health event session data.
    • Improved High Availability and Disaster Recovery: Creating an availability group with a name longer than 64 characters returns error 19544 instead of an assertion when cluster_type is N...
    • Improved Security Infrastructure: Only sysadmins can invoke dbcc stackdump to create a dump file.

    Read update Source: Microsoft

    Build
    16.0.4236.2
    Restart
    Required
  • SQL Server 2025 GDR SQL Server 2025 GDR Security update

    KB5073177

    DBCC stackdump invocation limited to sysadmins

    Addresses the Important SQL Server elevation-of-privilege vulnerability CVE-2026-20803 and limits who can invoke a dump file through DBCC stackdump.

    Check the newer update, KB5077468

    Key changes 1 CVE · 1 change

    • Fix Security Infrastructure: Only sysadmins can invoke a dump file through DBCC stackdump.
    • CVSS 7.2 CVE-2026-20803: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    17.0.1050.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2022 CU22 + GDR SQL Server 2022 CU22 + GDR Security update

    KB5072936

    DBCC stackdump is restricted to sysadmins

    Addresses CVE-2026-20803, an SQL Server elevation-of-privilege vulnerability, and limits DBCC stackdump to sysadmins.

    Check the newer update, KB5077464

    Key changes 1 CVE · 1 change

    • Fix Security Infrastructure: Only sysadmins can invoke DBCC stackdump to create a dump file.
    • CVSS 7.2 CVE-2026-20803: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.4230.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5073031

    SSIS vulnerability fixed; DBCC stack dumps restricted

    The update addresses two vulnerabilities, including a SQL Server elevation-of-privilege flaw, and limits who can invoke DBCC stack dumps.

    Check the newer update, KB5077465

    Key changes 2 CVEs · 2 changes

    • Fix Integration Services: The SSIS client runtime is updated to address a vulnerability.
    • Fix Security Infrastructure: Only sysadmins can invoke a DBCC stackdump to create a dump file.
    • CVSS 7.2 CVE-2026-20803: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.1165.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 CU22 SQL Server 2022 CU22 Security update

    KB5068450

    Integration Services vulnerability fixed; parallel SESSION_CONTEXT issue remains

    CU22 updates SQL Server 2022 to build 16.0.4225.2 with 20 fixes, including a fix for CVE-2022-26907 in Integration Services. Queries using SESSION_CONTEXT can still return incorrect results or trigger access violations in parallel plans.

    Check the newer update, KB5072936
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 1 CVE · 20 changes

    • New Cleanup service: Stale Log-Replay Service metadata is cleaned up automatically after it is more than 36 days old.
    • Improved SQL OS: CacheStore PHDR usage is capped when queries consume too much server memory.
    • Fix Backup Restore: Differential backups with compression no longer hit an assertion failure on databases with large amounts of FILESTREAM records.

    Read update Source: Microsoft

    Build
    16.0.4225.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2022 CU21 + GDR SQL Server 2022 CU21 + GDR Security update

    KB5068406

    Multi-role security filters corrected; backup procedure flaw mitigated

    The update fixes one Important SQL Server elevation-of-privilege vulnerability, corrects a rare Row-Level Security issue, and mitigates SQL injection risk in an internal backup procedure.

    Check the newer update, KB5072936

    Key changes 1 CVE · 2 changes

    • Fix Analysis Services: In rare, contradictory multi-role setups, row-level security filters are consistently applied.
    • Fix Management Services: Unauthorized access to an internal backup procedure is restricted, mitigating SQL injection risk.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.4222.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5068407

    RLS filtering enforced; backup procedure SQL injection mitigated

    Fixes a rare Analysis Services security-filtering gap and mitigates a SQL injection vulnerability in an internal backup procedure.

    Check the newer update, KB5073031

    Key changes 1 CVE · 2 changes

    • Fix Analysis Services: In rare, contradictory multi-role setups, Row-Level Security filters are consistently applied instead of being skipped.
    • Fix Management Services: Unauthorized access to an internal backup stored procedure is restricted, mitigating the risk of SQL injection.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.1160.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5068404

    SQL injection access restricted; Analysis Services filters fixed

    Addresses an SQL injection vulnerability in an internal backup procedure and fixes a rare configuration where Analysis Services security filters could be skipped.

    Check the newer update, KB5077469

    Key changes 1 CVE · 2 changes

    • Fix Analysis Services: Row-level security filters are consistently applied in the affected multi-role configurations.
    • Fix Management Services: Unauthorized access to an internal backup procedure is restricted, reducing the risk of SQL injection.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4455.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5068405

    Elevation-of-privilege flaw fixed; Analysis Services filters corrected

    Fixes one Important SQL Server elevation-of-privilege vulnerability, corrects rare Analysis Services security-filter behavior, and reduces SQL injection risk in an exposed backup procedure.

    Check the newer update, KB5077470

    Key changes 1 CVE · 2 changes

    • Fix Analysis Services: Row-level filters are applied consistently in rare, conflicting multi-role security setups.
    • Fix Management Services: The risk of SQL injection through an exposed internal backup procedure is reduced.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2155.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5068402

    SQL injection protection for backup procedure; RLS filters fixed

    The update reduces SQL injection risk in an exposed backup procedure and fixes cases where row-level security filters could be skipped in certain multi-role configurations.

    Check the newer update, KB5077471

    Key changes 1 CVE · 2 changes

    • Fix Analysis Services: Row-level security filters are applied consistently in certain multi-role setups where users could otherwise see rows those filters wer...
    • Fix Management Services: The internal backup procedure sanitizes input and restricts unauthorized access, reducing SQL injection risk.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3515.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5068403

    Database privilege flaw patched; row filters no longer skipped

    Addresses one Important SQL Server flaw and fixes a rare setup where database row filters could be skipped.

    Check the newer update, KB5077472

    Key changes 1 CVE · 2 changes

    • Fix Analysis Services: In rare setups with several roles, row filters no longer get skipped.
    • Fix Management Services: An internal backup procedure is safer from harmful input and limits access by unauthorized users.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2095.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5068400

    Backup procedure access restricted to reduce SQL injection risk

    The update addresses CVE-2025-59499, an elevation-of-privilege vulnerability, and restricts access to an internal backup procedure to reduce SQL injection risk.

    Check the newer update, KB5077473
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 1 CVE · 1 change

    • Fix Management Services: Access to an internal backup procedure is restricted, and its inputs are sanitized to reduce SQL injection risk.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7070.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5068401

    SQL injection risk in an internal backup procedure reduced

    The update reduces SQL injection risk in an internal backup procedure and addresses one Important SQL Server elevation-of-privilege vulnerability.

    Check the newer update, KB5077474
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 1 CVE · 1 change

    • Fix Management Services: An internal backup procedure that was exposed to all users has restricted access, reducing SQL injection risk.
    • CVSS 8.8 CVE-2025-59499: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6475.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2022 CU21 SQL Server 2022 CU21 Cumulative update

    KB5065865

    SQL injection protections added; parallel SESSION_CONTEXT issue remains

    Includes SQL injection and privilege-escalation protections, along with fixes for SQL Server Engine problems. Queries using SESSION_CONTEXT in parallel plans might still return incorrect results or trigger access violation dumps.

    Check the newer update, KB5068406
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 17 changes

    • Fix DB Management: Truncating a table with nonaligned partitions no longer succeeds unexpectedly and causes corruption.
    • Fix High Availability and Disaster Recovery: The primary replica of an availability group no longer encounters this assertion dump issue.
    • Fix High Availability and Disaster Recovery: A SQL injection vulnerability in a system stored procedure is fixed.

    Read update Source: Microsoft

    Build
    16.0.4215.2
    Restart
    Required
  • SQL Server 2022 CU20 + GDR SQL Server 2022 CU20 + GDR Security update

    KB5065220

    DMV data exposure and temporal-table SQL execution flaws fixed

    Fixes two Important SQL Server vulnerabilities: one could expose sensitive statement text, and the other could let attackers with elevated privileges run SQL code.

    Check the newer update, KB5068406

    Key changes 2 CVEs · 2 changes

    • Fix Programmability: Statement text inspected from other sessions might contain sensitive data.
    • Fix Temporal: Improper input validation during temporal history table cleanup could let attackers with elevated privileges run SQL code.
    • CVSS 8.8 CVE-2025-55227: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.4212.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5065221

    Sensitive statement text exposure and SQL code execution fixed

    Fixes two Important SQL Server vulnerabilities, including issues that could expose statement text or let attackers with elevated privileges run SQL code.

    Check the newer update, KB5068407

    Key changes 2 CVEs · 2 changes

    • Fix Programmability: Sensitive text from statements running in other sessions is no longer exposed when database monitoring views are used to inspect them.
    • Fix Temporal: Attackers with elevated privileges can no longer exploit a flaw in historical-record cleanup to run SQL code.
    • CVSS 8.8 CVE-2025-55227: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.1150.1
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5065222

    Temporal cleanup flaw and sensitive DMV data exposure fixed

    The update addresses three vulnerabilities and four SQL Server issues, including a temporal-cleanup flaw that could let attackers with elevated privileges run SQL code. CVE-2024-21907 is publicly disclosed.

    Check the newer update, KB5068404

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: Integration Services updates Newtonsoft.Json to version 13.0.1 to address a vulnerability.
    • Fix Master Data Services: Master Data Services updates Newtonsoft.Json to version 13.0.1 to address a vulnerability.
    • Fix Programmability: In specific scenarios, inspecting statements running in other sessions through DMVs might reveal sensitive data; this issue is fixed.

    Read update Source: Microsoft

    Build
    15.0.4445.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5065223

    DMV data exposure and temporal cleanup flaws fixed

    Fixes three vulnerabilities: CVE-2025-47997 (information disclosure), CVE-2025-55227 (elevation of privilege), and publicly disclosed CVE-2024-21907 in Newtonsoft.Json.

    Check the newer update, KB5068405

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: SSIS uses an updated Newtonsoft.Json component to address CVE-2024-21907.
    • Fix Master Data Services: The Newtonsoft.Json vulnerability is addressed for Master Data Services.
    • Fix Programmability: Fixes a case where statement text inspected through DMVs might contain sensitive data from other sessions.

    Read update Source: Microsoft

    Build
    15.0.2145.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5065225

    Sensitive SQL statement text and temporal cleanup flaws fixed

    Fixes three SQL Server vulnerabilities, including issues that could expose sensitive statement text or let attackers with elevated privileges run SQL code during temporal-history cleanup. CVE-2024-21907 is publicly disclosed.

    Check the newer update, KB5068402

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: Integration Services gets an updated Newtonsoft.Json library to fix a vulnerability.
    • Fix Master Data Services: Master Data Services gets an updated Newtonsoft.Json library to fix a vulnerability.
    • Fix Programmability: Fixes the issue that let DMVs inspect statement text running in other sessions in specific scenarios, where that text might contain sen...

    Read update Source: Microsoft

    Build
    14.0.3505.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5065224

    Sensitive DMV data exposure and temporal-table SQL flaws fixed

    The update fixes three SQL Server vulnerabilities, including publicly disclosed CVE-2024-21907, and addresses sensitive-data exposure through DMVs and unsafe input validation during temporal-table cleanup.

    Check the newer update, KB5068403

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: SSIS uses Newtonsoft.Json version 13.0.1 to address CVE-2024-21907.
    • Fix Master Data Services: Master Data Services uses Newtonsoft.Json version 13.0.1 to address CVE-2024-21907.
    • Fix Programmability: Sensitive SQL statement text from other sessions is no longer exposed in the described DMV scenarios.

    Read update Source: Microsoft

    Build
    14.0.2085.1
    Security
    3 vulnerabilities fixed
    Restart
    Required