Skip to the content
The Update Bureau

SQL Server

SQL Server updates

All published releases for SQL Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 12, 2026.

9 active known issues →

SQL Server updates

  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5065227

    DMV data exposure and temporal cleanup flaws fixed

    The update fixes SQL Server vulnerabilities involving sensitive statement text, temporal-table cleanup and Newtonsoft.Json. One vulnerability, CVE-2024-21907, is publicly disclosed.

    Check the newer update, KB5068400
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: Integration Services uses an updated Newtonsoft.Json component to address a vulnerability.
    • Fix Master Data Services: Master Data Services uses an updated Newtonsoft.Json component to address a vulnerability.
    • Fix Programmability: In specific scenarios, sensitive data in statements running in other sessions is protected from inspection.

    Read update Source: Microsoft

    Build
    13.0.7065.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5065226

    Three vulnerabilities addressed, including a sensitive-data exposure fix

    Addresses three vulnerabilities and fixes issues involving sensitive statement text and temporal history table cleanup in SQL Server.

    Check the newer update, KB5068401

    Key changes 3 CVEs · 4 changes

    • Fix Integration Services: Integration Services updates Newtonsoft.Json to address a vulnerability.
    • Fix Master Data Services: Master Data Services updates Newtonsoft.Json to address a vulnerability.
    • Fix Programmability: An issue that could expose sensitive statement text through DMVs in specific scenarios is fixed.

    Read update Source: Microsoft

    Build
    13.0.6470.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 CU20 + GDR SQL Server 2022 CU20 + GDR Security update

    KB5063814

    SQL injection flaws and login-permission escalation blocked

    The update addresses five Important SQL Server vulnerabilities, all involving elevation of privilege. It also changes protections for SQL injection, login password resets, and SQL Agent job steps.

    Check the newer update, KB5065220

    Key changes 5 CVEs · 6 changes

    • Fix High Availability and Disaster Recovery: SQL injection through a system stored procedure is blocked.
    • Fix Metadata: SQL injection through a system stored procedure is blocked.
    • Fix Security Infrastructure: Users with access to certain stored procedures can no longer use them to run arbitrary code with elevated privileges.

    Read update Source: Microsoft

    Build
    16.0.4210.1
    Security
    5 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5063756

    Stored procedure and SQL Agent privilege flaws fixed

    The update fixes five Important-severity SQL Server vulnerabilities, including flaws involving SQL injection and elevation of privilege.

    Check the newer update, KB5065221

    Key changes 5 CVEs · 6 changes

    • Fix High Availability and Disaster Recovery: A SQL injection vulnerability in a system stored procedure is fixed.
    • Fix Metadata: A SQL injection vulnerability in a system stored procedure is fixed.
    • Fix Security Infrastructure: A vulnerability in certain stored procedures that could let users run arbitrary code with elevated privileges is fixed.

    Read update Source: Microsoft

    Build
    16.0.1145.1
    Security
    5 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5063757

    Stored procedures and SQL Agent jobs get privilege protections

    The update fixes four Important SQL Server vulnerabilities, including SQL injection and elevation-of-privilege flaws involving stored procedures, logins, and SQL Agent jobs.

    Check the newer update, KB5065222

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: A SQL injection vulnerability in a system stored procedure is fixed.
    • Fix Security Infrastructure: Logins with certain permissions can no longer reset passwords for other logins that have powerful login-management or impersonation per...
    • Fix SQL Agent: Built-in SQL Agent jobs run with reduced permissions to help prevent privilege escalation.

    Read update Source: Microsoft

    Build
    15.0.4440.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5063758

    Stored procedure, login, and SQL Agent privilege flaws blocked

    The update fixes four Important SQL Server vulnerabilities involving SQL injection and elevation of privilege. None is listed as critical, exploited, or publicly disclosed.

    Check the newer update, KB5065223

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: A system stored procedure no longer has the SQL injection vulnerability addressed by this fix.
    • Fix Security Infrastructure: Logins with ALTER ANY LOGIN permission can no longer reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissio...
    • Fix SQL Agent: Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.

    Read update Source: Microsoft

    Build
    15.0.2140.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5063759

    SQL injection and SQL Agent privilege-escalation flaws blocked

    The update addresses four Important SQL Server vulnerabilities, including SQL injection and privilege-escalation flaws. It also includes the Azure Connect feature pack for SQL Server 2017.

    Check the newer update, KB5065225

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: SQL injection through a system stored procedure is addressed.
    • Fix Security Infrastructure: A login with ALTER ANY LOGIN permission can no longer reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissi...
    • Fix SQL Agent: Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.

    Read update Source: Microsoft

    Build
    14.0.3500.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5063760

    SQL injection and login privilege-escalation flaws addressed

    Addresses four Important vulnerabilities in SQL Server 2017, including SQL injection and elevation-of-privilege flaws.

    Check the newer update, KB5065224

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: A system stored procedure can no longer be used for SQL injection.
    • Fix Security Infrastructure: Certain logins can no longer reset passwords in a way that could lead to elevated privileges.
    • Fix SQL Agent: Built-in SQL Agent job steps run with reduced permissions to help prevent elevated access.

    Read update Source: Microsoft

    Build
    14.0.2080.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5063761

    SQL injection and privilege-escalation flaws addressed in the engine

    Four Important SQL Server vulnerabilities are addressed, including SQL injection and elevation-of-privilege risks. The fixes also restrict login password resets and reduce permissions for built-in SQL Agent jobs.

    Check the newer update, KB5065227
    SQL Server 2016 security updates are scheduled to end on July 14, 2026.

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: A SQL injection vulnerability in a system stored procedure is addressed.
    • Fix Security Infrastructure: Logins with ALTER ANY LOGIN can no longer use that permission to reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOG...
    • Fix SQL Agent: Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.

    Read update Source: Microsoft

    Build
    13.0.7060.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5063762

    Stored-procedure SQL injection and login privilege flaws blocked

    Fixes four Important SQL Server vulnerabilities, including flaws that could allow SQL injection or elevation of privilege.

    Check the newer update, KB5065226
    Security updates for SQL Server 2016 are scheduled to end July 14, 2026.

    Key changes 4 CVEs · 4 changes

    • Fix High Availability and Disaster Recovery: A SQL injection vulnerability in a system stored procedure is fixed.
    • Fix Security Infrastructure: Logins with ALTER ANY LOGIN permission can no longer reset passwords for logins with ALTER ANY LOGIN or IMPERSONATE ANY LOGIN permissio...
    • Fix SQL Agent: Built-in SQL Agent job steps run with reduced permissions to prevent elevation of privilege.

    Read update Source: Microsoft

    Build
    13.0.6465.1
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 CU20 SQL Server 2022 CU20 Cumulative update

    KB5059390

    Analysis Services startup hangs and query errors fixed

    Includes 11 fixes for SQL Server 2022, including an Analysis Services startup hang and several query errors. A known issue with SESSION_CONTEXT in parallel query plans remains open.

    Check the newer update, KB5063814
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 11 changes

    • Improved Linux: SQL Server on Linux can now use memory limits set through Control Groups (cgroups) version 2.
    • Improved SQL Server Engine: SQL Server 2022 adds support for a CREATE USER syntax option that uses a SID and type, enabled by trace flag 11953.
    • Fix Analysis Services: Analysis Services is less likely to stop responding during startup in a rare case involving proactive caching notifications in multidim...

    Read update Source: Microsoft

    Build
    16.0.4205.1
    Restart
    Required
  • SQL Server 2022 CU19 + GDR SQL Server 2022 CU19 + GDR Security update

    KB5058721

    Memory exposure and query outages fixed; Setup restart blocker removed

    A SQL Setup defect that caused restarts and prevented Setup from continuing is fixed. The update also fixes three SQL Server Engine issues and addresses three Important vulnerabilities, including a publicly disclosed information-disclosure flaw.

    Check the newer update, KB5063814

    Key changes 3 CVEs · 4 changes

    • Fix Programmability: Under specific conditions, an attacker can no longer use a query to make the server unavailable.
    • Fix Programmability: In rare cases, using limited-length parameters with REPLACE no longer returns uninitialized memory.
    • Fix Query Execution: In rare cases, variable-length parameters no longer allow uninitialized memory to be read.

    Read update Source: Microsoft

    Build
    16.0.4200.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5058712

    SQL query flaws and Setup restarts fixed

    Fixes a query issue that could make SQL Server unavailable under specific conditions, along with rare memory-handling and Setup problems.

    Check the newer update, KB5063756

    Key changes 3 CVEs · 4 changes

    • Fix Programmability: A query that could make the server unavailable under specific conditions no longer causes that problem.
    • Fix Programmability: In rare cases, limited-length parameters used with REPLACE no longer cause uninitialized memory to be returned.
    • Fix Query Execution: In rare cases, variable-length parameters no longer allow uninitialized memory to be read.

    Read update Source: Microsoft

    Build
    16.0.1140.6
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update

    KB5058722

    Information disclosure flaw and Setup restart issue addressed

    The update addresses three important vulnerabilities, including publicly disclosed CVE-2025-49719, and fixes SQL Setup restarts that could prevent setup from continuing.

    Check the newer update, KB5063757
    SQL Server 2019 cumulative updates ended on February 28, 2025. Security updates continue through January 8, 2030.

    Key changes 3 CVEs · 5 changes

    • Fix Programmability: Under specific conditions, an attacker can no longer execute a query against the server to cause it to become unavailable.
    • Fix Programmability: In rare cases, uninitialized memory is no longer returned when the REPLACE function uses limited-length parameters.
    • Fix Query Execution: In rare cases, uninitialized memory can no longer be read when variable-length parameters are used.

    Read update Source: Microsoft

    Build
    15.0.4435.7
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5058713

    Query and memory flaws fixed; Setup restart issue addressed

    The update fixes three SQL Server vulnerabilities and addresses a Setup problem that could cause restarts and prevent installation from continuing.

    Check the newer update, KB5063758

    Key changes 3 CVEs · 4 changes

    • Fix Programmability: Under specific conditions, an attacker could run a query that makes the server unavailable; this issue is fixed.
    • Fix Programmability: In rare cases, using limited-length parameters with the REPLACE function could return uninitialized memory; this issue is fixed.
    • Fix Query Execution: In rare cases, uninitialized memory could be read when variable-length parameters were used; this issue is fixed.

    Read update Source: Microsoft

    Build
    15.0.2135.5
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5058714

    Information disclosure flaw and SQL Setup interruptions fixed

    Addresses a publicly disclosed SQL Server information disclosure vulnerability and fixes two issues, including restarts that can prevent SQL Setup from continuing.

    Check the newer update, KB5063759

    Key changes 1 CVE · 2 changes

    • Fix Query Execution: In rare cases, variable-length parameters no longer cause uninitialized memory to be read.
    • Fix Patching: SQL Setup no longer encounters the issue that causes restarts and prevents Setup from continuing.
    • CVSS 7.5 CVE-2025-49719: Microsoft SQL Server Information Disclosure Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3495.9
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5058716

    Information disclosure flaw and Setup restart issue fixed

    The update fixes a publicly disclosed information-disclosure vulnerability and a problem introduced by an earlier Windows update that caused restarts and stopped SQL Setup from continuing.

    Check the newer update, KB5063760

    Key changes 1 CVE · 2 changes

    • Fix Query Execution: In rare cases, SQL Server no longer reads unintended memory while processing data whose parameter length varies.
    • Fix Patching: A problem introduced by an earlier Windows update that caused restarts and stopped SQL Server Setup from continuing is fixed.
    • CVSS 7.5 CVE-2025-49719: Microsoft SQL Server Information Disclosure Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2075.8
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5058717

    Information disclosure flaw and setup restarts addressed

    The update addresses one publicly disclosed Important SQL Server information disclosure vulnerability and fixes a rare query execution issue plus SQL Setup restarts that could prevent setup from continuing.

    Check the newer update, KB5063761

    Key changes 1 CVE · 2 changes

    • Fix Query Execution: In rare cases, variable length parameters no longer allow uninitialized memory to be read.
    • Fix Patching: SQL Setup no longer encounters the restart issue that could prevent setup from continuing after a previous Windows update.
    • CVSS 7.5 CVE-2025-49719: Microsoft SQL Server Information Disclosure Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7055.9
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5058718

    Native Client code-execution and data-disclosure flaws addressed

    The update addresses two Important vulnerabilities, including publicly disclosed CVE-2025-49719 (information disclosure) and CVE-2024-49000 (remote code execution). It also fixes three SQL Server connectivity, query execution, and setup issues.

    Check the newer update, KB5063762
    SQL Server 2016 security updates end on July 14, 2026.

    Key changes 2 CVEs · 3 changes

    • Fix SQL Connectivity: Fixes known functional problems in SQL Server Native Client that were introduced in the November GDR.
    • Fix Query Execution: Fixes rare cases where uninitialized memory can be read when using variable-length parameters.
    • Fix Patching: Fixes restarts and setup interruptions caused by a previous Windows update.

    Read update Source: Microsoft

    Build
    13.0.6460.7
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 CU19 SQL Server 2022 CU19 Cumulative update

    KB5054531

    Repairs S3 backups, Entra sign-in, and SQL query problems

    CU19 adds 13 fixes after CU18, including repairs for S3-compatible backups, Microsoft Entra authentication on Linux, and incorrect query results. Queries using SESSION_CONTEXT in parallel plans can still return incorrect results or trigger access violations.

    Check the newer update, KB5058721
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 13 changes

    • Improved Query Optimizer: The EXPAND VIEWS behavior can be used without adding a per-query hint.
    • Improved Security Infrastructure: Auditing can now track actions associated with this action group.
    • Improved SQL OS: The log tail file name matches the dump file name after a stack dump is generated.

    Read update Source: Microsoft

    Build
    16.0.4195.2
    Restart
    Required
  • SQL Server 2022 CU18 SQL Server 2022 CU18 Cumulative update

    KB5050771

    Contained availability groups gain instance-level workload groups

    CU18 adds 11 fixes for SQL Server 2022 and lets contained availability groups use instance-level Resource Governor workload groups. Queries using SESSION_CONTEXT might still return incorrect results or trigger access violation dumps in parallel plans.

    Check the newer update, KB5054531
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 11 changes

    • Improved High Availability and Disaster Recovery: Contained availability groups can use Resource Governor workload groups defined at the SQL Server instance level.
    • Fix Backup Restore: A copy-only filegroup backup on an availability group secondary replica no longer fails with an unsupported-backup error.
    • Fix Linux: Some transactions no longer encounter extended waits during flush operations when the alternate write-through setting is enabled.

    Read update Source: Microsoft

    Build
    16.0.4185.3
    Restart
    Required
  • SQL Server 2017 SP3 AC + GDR SQL Server 2017 SP3 AC + GDR Out-of-band update
    Out-of-band

    KB5050533

    Database links to Azure SQL Managed Instance added

    The feature pack adds database replication from SQL Server to Azure SQL Managed Instance. It also improves connections and certificate handling.

    Check the newer update, KB5058714

    Key changes 5 changes

    • New Link feature: You can replicate databases from SQL Server to Azure SQL Managed Instance with the link feature.
    • New Distributed availability groups: SQL Server Standard editions can use distributed availability groups to replicate databases with Azure resources.
    • Improved Distributed availability groups and Service Broker: You can use distributed availability groups and Service Broker connections with Azure SQL Managed Instance.

    Read update Source: Microsoft

    Build
    14.0.3490.10
  • SQL Server 2019 CU32 SQL Server 2019 CU32 Cumulative update

    KB5054833

    Read-scale availability groups stay in place after patching

    Patching a read-scale availability group no longer removes it from the patched replica. An open issue can still make some queries return incorrect results or create diagnostic files.

    Check the newer update, KB5058722
    SQL Server 2019 cumulative updates end February 28, 2025. Security updates continue through January 8, 2030.
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 1 change

    • Fix High Availability and Disaster Recovery: Patching a read-scale availability group no longer removes it from the patched replica.

    Read update Source: Microsoft

    Build
    15.0.4430.1
    Restart
    Required
  • SQL Server 2019 CU31 SQL Server 2019 CU31 Cumulative update

    KB5049296

    Read-scale AG metadata loss; SESSION_CONTEXT may return wrong results

    Includes 10 fixes, but it can remove read-scale availability group metadata on a patched replica. Queries using SESSION_CONTEXT might also return incorrect results or trigger access violation dumps in parallel plans.

    Check the newer update, KB5054833
    Cumulative updates for SQL Server 2019 are listed as ending on February 28, 2025.
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 10 changes

    • Fix Master Data Services: The business rule item for the domain-based attribute option works correctly in Master Data Services.
    • Fix High Availability and Disaster Recovery: Creating an availability group with a name longer than 64 characters no longer triggers the listed assertion failures.
    • Fix Linux: Some transactions no longer face extended waits during flush operations with the specified alternate write-through setting.

    Read update Source: Microsoft

    Build
    15.0.4420.2
    Restart
    Required
  • SQL Server 2022 CU17 SQL Server 2022 CU17 Cumulative update

    KB5048038

    Parallel SESSION_CONTEXT queries may return incorrect results

    Parallel queries that use SESSION_CONTEXT might return incorrect results or trigger access-violation dumps. CU17 also adds Always On support for Pacemaker clusters when SQL Server runs as a restricted application with SELinux enabled.

    Check the newer update, KB5050771
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 11 changes

    • New High Availability and Disaster Recovery: A new trace flag can increase the maximum number of parallel redo threads based on the total number of CPUs.
    • New High Availability and Disaster Recovery: Always On availability groups can use a Pacemaker cluster in the specified Linux configuration.
    • New In-Memory OLTP: A new server option lets SQL Server use the Hekaton DLL Generator for the In-Memory OLTP feature.

    Read update Source: Microsoft

    Build
    16.0.4175.1
    Restart
    Required