Skip to the content
The Update Bureau

SQL Server

SQL Server updates

All published releases for SQL Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 12, 2026.

9 active known issues →

SQL Server updates

  • SQL Server 2019 CU30 SQL Server 2019 CU30 Cumulative update

    KB5049235

    Remote code execution fixes; parallel SESSION_CONTEXT issue remains

    CU30 includes eight fixes, including fixes for remote code execution, but a known issue can still affect SESSION_CONTEXT in parallel plans. KB5049235 has been superseded by KB5049296.

    Check the newer update, KB5049296
    SQL Server 2019 cumulative updates are scheduled to end February 28, 2025; security updates are scheduled to continue until January 8, 2030.
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 8 changes

    • Fix Integration Services: Extracting data for Google BigQuery with the Simba ODBC driver no longer has the described data discrepancy issue.
    • Fix High Availability and Disaster Recovery: Some Always On availability group workloads have fewer waits during data movement.
    • Fix High Availability and Disaster Recovery: Some availability group databases can move to a resolving state after a Windows Server Failover Clustering quorum loss, helping them re...

    Read update Source: Microsoft

    Build
    15.0.4415.2
    Restart
    Required
  • SQL Server 2022 CU16 SQL Server 2022 CU16 Cumulative update

    KB5048033

    Linux database corruption and snapshot backup failures fixed

    Includes 16 fixes for SQL Server 2022, including a Linux database corruption issue and snapshot backup failures. Queries using SESSION_CONTEXT in parallel plans might still return incorrect results or cause access violation dumps.

    Check the newer update, KB5048038
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 16 changes

    • Improved Replication: You can disable OLE DB streaming for the Replication Distribution Agent to avoid the referenced error.
    • Fix Analysis Services: DAX queries using SUMMARIZECOLUMNS and ROLLUPGROUP with multidimensional models return accurate totals when different sub-selects run w...
    • Fix Data Quality Services: Exporting cleaned data to SQL Server no longer produces an invalid Data Quality Services format.

    Read update Source: Microsoft

    Build
    16.0.4165.4
    Restart
    Required
  • SQL Server 2022 CU15 + GDR SQL Server 2022 CU15 + GDR Security update

    KB5046862

    SQL OS fixes address two remote code execution paths

    The update fixes two Important remote code execution vulnerabilities in SQL Server 2022, including one involving DLL planting and one involving a SQL Server assembly.

    Check the newer update, KB5058721

    Key changes 2 CVEs · 2 changes

    • Fix SQL OS: Remote code execution might be performed on a SQL Server instance through DLL planting.
    • Fix SQL OS: A vulnerability in a SQL Server assembly might allow remote code execution.
    • CVSS 7.8 CVE-2024-49021: Microsoft SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.4155.4
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5046861

    SQL OS fixes two remote code execution vulnerabilities

    Fixes two issues that might allow remote code execution.

    Check the newer update, KB5058712

    Key changes 2 CVEs · 2 changes

    • Fix SQL OS: Remote code execution on a SQL Server instance through DLL planting is fixed.
    • Fix SQL OS: An issue in which a SQL Server assembly vulnerability might allow remote code execution is fixed.
    • CVSS 7.8 CVE-2024-49021: Microsoft SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.1135.2
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU29 + GDR SQL Server 2019 CU29 + GDR Security update

    KB5046860

    SQL OS closes two remote-code-execution paths

    The update fixes two SQL OS issues that might allow remote code execution on Windows SQL Server instances and addresses 31 Important-severity vulnerabilities.

    Check the newer update, KB5058722
    Cumulative updates for SQL Server 2019 end on February 28, 2025. Security updates continue until January 8, 2030.

    Key changes 31 CVEs · 2 changes

    • Fix SQL OS: Remote code execution might be possible on a SQL Server instance through a DLL planting technique; this update fixes the issue.
    • Fix SQL OS: A vulnerability in a SQL Server assembly might allow remote code execution; this update fixes the issue.
    • CVSS 8.8 CVE-2024-38255: SQL Server Native Client Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4410.1
    Security
    31 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5046859

    SQL OS flaws that could let attackers run code are fixed

    The update fixes two SQL Server Engine problems that could let attackers run their own instructions on a server from another computer. It also addresses 31 vulnerabilities overall.

    Check the newer update, KB5058713
    SQL Server 2019 cumulative updates end February 28, 2025. Security updates are scheduled to continue through January 8, 2030.

    Key changes 31 CVEs · 2 changes

    • Fix SQL OS: A specially placed library file might let an attacker run their own instructions on a SQL Server instance from another computer; this p...
    • Fix SQL OS: A security weakness in a SQL Server software component might let an attacker run their own instructions on a server from another comput...
    • CVSS 8.8 CVE-2024-38255: SQL Server Native Client Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2130.3
    Security
    31 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5046858

    Native Client remote-code flaws patched; DLL planting fixed

    Addresses 31 Important-severity vulnerabilities, including remote-code execution flaws in SQL Server Native Client. It also fixes two SQL Server Engine issues involving remote code execution.

    Check the newer update, KB5058714

    Key changes 31 CVEs · 2 changes

    • Fix SQL OS: Remote code execution through DLL planting on a SQL Server instance is fixed.
    • Fix SQL OS: A vulnerability in a SQL Server assembly that might allow remote code execution is fixed.
    • CVSS 8.8 CVE-2024-38255: SQL Server Native Client Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3485.1
    Security
    31 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5046857

    Native Client flaws could let attackers run code on SQL servers

    Patches 31 Important-rated vulnerabilities, including flaws that could let attackers run code on SQL Server systems. It also fixes two SQL Server Engine issues.

    Check the newer update, KB5058716

    Key changes 31 CVEs · 2 changes

    • Fix SQL OS: A security flaw that could let someone run their own code on a SQL Server instance through a planted file is addressed.
    • Fix SQL OS: A security flaw in a SQL Server component that could let someone run code on the server is addressed.
    • CVSS 8.8 CVE-2024-38255: SQL Server Native Client Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2070.1
    Security
    31 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5046856

    SQL OS remote-code execution flaws addressed; SQL Agent failure fixed

    Addresses remote-code-execution vulnerabilities and fixes an “unknown token” failure in SQL Agent jobs after the October 2024 security update.

    Check the newer update, KB5058717

    Key changes 31 CVEs · 3 changes

    • Fix SQL OS: Remote code execution through DLL planting on a SQL Server instance is addressed.
    • Fix SQL OS: A SQL Server assembly vulnerability that might allow remote code execution is addressed.
    • Fix SQL OS: SQL Agent jobs no longer fail with an “unknown token” error after the October 2024 security update.

    Read update Source: Microsoft

    Build
    13.0.7050.2
    Security
    31 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5046855

    Native Client flaws patched; SQL Agent error needs another update

    Addresses 31 vulnerabilities: 30 Important and one unrated. If SQL Agent jobs show an “unknown token” error after the October update, install KB5046856 to fix it.

    Check the newer update, KB5058718

    Key changes 31 CVEs · 3 changes

    • Fix SQL Connectivity: The fix list addresses an “unknown token” failure in SQL Agent jobs after KB5046063; the page directs affected systems to install KB504...
    • Fix SQL OS: Addresses an issue that might allow remote code execution on a SQL Server instance through DLL planting.
    • Fix SQL OS: Addresses an issue in which a vulnerability in a SQL Server assembly might allow remote code execution.

    Read update Source: Microsoft

    Build
    13.0.6455.2
    Security
    31 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU29 SQL Server 2019 CU29 Cumulative update

    KB5046365

    18 fixes included; SESSION_CONTEXT can misbehave in parallel plans

    Includes 18 fixes for SQL Server 2019. Queries using SESSION_CONTEXT might return incorrect results or generate access violation dumps in parallel plans.

    Check the newer update, KB5046860
    SQL Server 2019 cumulative updates are scheduled to end on February 28, 2025; security updates are scheduled to continue through January 8, 2030.
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 18 changes

    • New Integration Services: A digitally signed catalog file is added to support catalog signing for specified Attunity CDC assemblies.
    • New Replication: You can disable OLE DB streaming for the Replication Distribution Agent to avoid the described error.
    • New Search: Trace flag 7617 is available to skip dropping full-text index fragments marked for deletion during database recovery.

    Read update Source: Microsoft

    Build
    15.0.4405.4
    Restart
    Required
  • SQL Server 2022 CU15 + GDR SQL Server 2022 CU15 + GDR Security update

    KB5046059

    Elevation-of-privilege flaw addressed; CDC issues fixed

    Addresses an SQL Server elevation-of-privilege vulnerability and fixes known Change Data Capture issues introduced by the September GDR.

    Check the newer update, KB5046862

    Key changes 1 CVE · 1 change

    • Fix Replication: Known functional issues in Change Data Capture introduced by the September GDR are fixed.
    • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.4150.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5046057

    Change Data Capture issues fixed; elevation flaw addressed

    Addresses an elevation-of-privilege vulnerability in SQL Server and fixes known Change Data Capture issues introduced in the September GDR.

    Check the newer update, KB5046861

    Key changes 1 CVE · 1 change

    • Fix Replication: Fixes known functional issues in Change Data Capture that were introduced in the September GDR.
    • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.1130.5
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2019 CU28 + GDR SQL Server 2019 CU28 + GDR Security update

    KB5046060

    VSS Writer backup failures remain; privilege flaw fixed

    Fixes an important SQL Server elevation-of-privilege vulnerability and a CDC issue. Backups of some virtual machines might still fail because of a SQL Server VSS Writer issue.

    Check the newer update, KB5046860
    SQL Server 2019 cumulative updates are scheduled to end February 28, 2025; security updates are scheduled to continue through January 8, 2030.
    Known issues: 1 open Organizations and IT administrators
    • Issue two: SQL Server VSS Writer might fail to perform a backup because no database is available to freeze

    Key changes 1 CVE · 1 change

    • Fix Replication: Change Data Capture (CDC) no longer has the functional issues introduced in the September GDR.
    • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4395.2
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5046056

    Elevation-of-privilege flaw fixed; CDC problems corrected

    Fixes one Important SQL Server elevation-of-privilege vulnerability and corrects Change Data Capture functional issues introduced in the September GDR.

    Check the newer update, KB5046859
    SQL Server 2019 cumulative updates end February 28, 2025; security updates continue through January 8, 2030.

    Key changes 1 CVE · 1 change

    • Fix Replication: Change Data Capture (CDC) no longer has the functional issues introduced in the September GDR.
    • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2125.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5046061

    Replication CDC issues fixed alongside an elevation-of-privilege flaw

    Resolves an important SQL Server elevation-of-privilege vulnerability and fixes functional issues in Change Data Capture that the September GDR introduced.

    Check the newer update, KB5046858

    Key changes 1 CVE · 2 changes

    • Improved Microsoft Update Catalog: The update detection logic changes for this and future security releases in the Microsoft Update Catalog.
    • Fix Replication: Change Data Capture functional issues introduced by the September GDR are fixed.
    • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3480.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5046058

    Elevation-of-privilege flaw resolved; Change Data Capture fixed

    Resolves an Important SQL Server elevation-of-privilege vulnerability and fixes Change Data Capture functional issues introduced in the September GDR.

    Check the newer update, KB5046857

    Key changes 1 CVE · 1 change

    • Fix Replication: Change Data Capture no longer has the functional issues introduced in the September GDR.
    • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2065.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5046062

    Database privilege flaw fixed; changed-data capture issues corrected

    A security flaw could allow elevated access to the database. Problems capturing changed data are corrected, but scheduled database jobs might show an “unknown token” error until KB5046856.

    Check the newer update, KB5046856
    Known issues: 2 open Organizations and IT administrators
    • Symptoms
    • Resolution

    Key changes 2 CVEs · 1 change

    • Fix Replication: Problems capturing changed data that began with the September update are fixed.
    • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability
    • CVSS 8.8 CVE-2024-49000: SQL Server Native Client Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7045.2
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5046063

    CDC issues fixed; SQL Agent jobs can show an unknown-token error

    Fixes one Important SQL Server elevation-of-privilege vulnerability, CVE-2024-37341, and functional issues in Change Data Capture. SQL Agent jobs might show an “unknown token” error; KB5046856 is the fix.

    Check the newer update, KB5046855
    Known issues: 2 open Organizations and IT administrators
    • Symptoms
    • Resolution

    Key changes 1 CVE · 1 change

    • Fix Replication: Change Data Capture works correctly after functional issues introduced in the September GDR.
    • CVSS 8.8 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6450.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2022 CU15 SQL Server 2022 CU15 Cumulative update

    KB5041321

    VSS backups and replication errors fixed; SESSION_CONTEXT issue remains

    Includes 14 fixes for SQL Server 2022, including problems with VSS backups and replication. Queries using SESSION_CONTEXT can still return incorrect results or cause access violation dumps in parallel plans.

    Check the newer update, KB5046059
    Known issues: 1 open Organizations and IT administrators
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 14 changes

    • New Replication: A new CDC metadata security feature helps prevent errors when upgrading a database that has CDC disabled.
    • Improved Master Data Services: Master Data Services uses updated checks to identify the current machine type and whether it is a domain controller.
    • Improved Query Execution: PREDICT checks that its MODEL parameter is valid, helping avoid errors caused by an incorrect model.

    Read update Source: Microsoft

    Build
    16.0.4145.4
    Restart
    Required
  • SQL Server 2022 CU14 + GDR SQL Server 2022 CU14 + GDR Security update

    KB5042578

    CDC capture jobs can fail; temporal-table quoting fixed

    Addresses 12 vulnerabilities and fixes temporal-table name quoting. In databases with CDC enabled, some column names might be missing from tracking tables, which can cause capture jobs to fail.

    Check the newer update, KB5046059
    Known issues: 1 open Organizations and IT administrators
    • CDC capture job might fail if columns are missing in CDC change tables

    Key changes 12 CVEs · 3 changes

    • Improved Query Execution: Running PREDICT with an incorrect model gets validation to help avoid errors.
    • Improved Replication: CDC gains a capability to lock down metadata definitions and block DDL operations.
    • Fix Temporal: Stored procedures that manage temporal tables quote table and column names correctly when building internal SQL batches.

    Read update Source: Microsoft

    Build
    16.0.4140.3
    Security
    12 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5042211

    CDC upgrades risk missing columns; 12 vulnerabilities addressed

    Addresses 12 vulnerabilities. Applying it can also expose a CDC issue that causes missing tracking-table columns and failed capture jobs, upgrades, or restores.

    Check the newer update, KB5046057
    Known issues: 1 open
    • CDC capture job might fail if columns are missing in CDC change tables

    Key changes 12 CVEs · 3 changes

    • Improved Query Execution: PREDICT checks the MODEL parameter to help avoid errors caused by an incorrect model.
    • Improved Replication: CDC can block changes to database definitions, improving security for the feature.
    • Fix Temporal: Stored procedures that manage temporal tables correctly quote table and column names read from database metadata.

    Read update Source: Microsoft

    Build
    16.0.1125.1
    Security
    12 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU28 + GDR SQL Server 2019 CU28 + GDR Security update

    KB5042749

    Twelve vulnerabilities patched; CDC and VSS backup issues remain

    Fixes 12 vulnerabilities, including 11 rated Important. After installing it, CDC capture jobs might fail and SQL Server VSS Writer might fail to create application-consistent backups.

    Check the newer update, KB5046060
    SQL Server 2019 cumulative updates end February 28, 2025; security updates continue through January 8, 2030.
    Known issues: 2 open Organizations and IT administrators
    • Issue two: SQL Server VSS Writer might fail to perform a backup because no database is available to freeze
    • CDC capture job might fail if columns are missing in CDC change tables

    Key changes 12 CVEs · 3 changes

    • Improved Query Execution: PREDICT checks the MODEL parameter to help avoid errors caused by an incorrect model.
    • Improved Replication: CDC can lock down metadata definitions to block changes to data definitions.
    • Fix Temporal: Stored procedures that manage temporal tables correctly quote table and column names read from database metadata.

    Read update Source: Microsoft

    Build
    15.0.4390.2
    Security
    12 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5042214

    Machine Learning Services flaws addressed; CDC upgrades can fail

    Addresses 12 Important vulnerabilities, including flaws in Machine Learning Services. It also adds a CDC upgrade safeguard, but CDC databases with certain column names might encounter missing columns or restore and upgrade errors.

    Check the newer update, KB5046056
    Cumulative updates for SQL Server 2019 are scheduled to end on February 28, 2025.
    Known issues: 1 open
    • CDC capture job might fail if columns are missing in CDC change tables

    Key changes 12 CVEs · 3 changes

    • Improved Query Execution: PREDICT checks the MODEL parameter before running, helping avoid errors caused by an incorrect model.
    • Improved Replication: CDC gains a capability to block data-definition changes that could affect its metadata.
    • Fix Temporal: Stored procedures that manage temporal tables quote table and column names correctly when building internal SQL batches.

    Read update Source: Microsoft

    Build
    15.0.2120.1
    Security
    12 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5042215

    CDC metadata safeguards added; temporal-table quoting fixed

    Fixes 13 vulnerabilities and includes a known CDC issue: columns with commas might disappear from CDC tracking tables and cause capture jobs to fail.

    Check the newer update, KB5046061
    Known issues: 1 open Organizations and IT administrators
    • CDC capture job might fail if columns are missing in CDC change tables

    Key changes 13 CVEs · 3 changes

    • Improved Query Execution: A check of the model used by PREDICT helps avoid errors caused by an incorrect model.
    • Improved Replication: CDC gets a safeguard that can block data definition changes to its metadata.
    • Fix Temporal: Stored procedures that manage temporal tables correctly quote table and column names when building internal SQL batches.

    Read update Source: Microsoft

    Build
    14.0.3475.1
    Security
    13 vulnerabilities fixed
    Restart
    Required