Skip to the content
The Update Bureau

SQL Server

SQL Server updates

All published releases for SQL Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 12, 2026.

9 active known issues →

SQL Server updates

  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5042217

    Twelve security flaws addressed; CDC column loss remains possible

    Addresses 12 Important vulnerabilities in SQL Server 2017. It also introduces a known CDC issue that can leave columns missing and cause capture jobs or applications to fail; a KEEP_CDC restore can report an error near the end even when the database restores successfully.

    Check the newer update, KB5046058
    Known issues: 1 open Organizations and IT administrators
    • CDC capture job might fail if columns are missing in CDC change tables

    Key changes 12 CVEs · 3 changes

    • Improved Query Execution: Using PREDICT with an incorrect model now gets a validation check to help avoid errors.
    • Improved Replication: CDC can block data-definition operations through a new metadata protection capability.
    • Fix Temporal: Stored procedures that manage temporal tables correctly quote table and column names in cases where they previously might not.

    Read update Source: Microsoft

    Build
    14.0.2060.1
    Security
    12 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5042209

    SQL privilege flaws addressed; CDC upgrades may drop columns

    Addresses three SQL Server elevation-of-privilege vulnerabilities and adds a CDC metadata safeguard. CDC jobs or upgrade and restore steps might still fail when CDC tracking columns have certain names.

    Check the newer update, KB5046062
    Known issues: 1 open Organizations and IT administrators
    • CDC capture job might fail if columns are missing in CDC change tables

    Key changes 3 CVEs · 2 changes

    • Improved Replication: CDC metadata has an added safeguard against changes that could affect its definitions.
    • Fix Temporal: Table and column names are quoted correctly in internal batches used by stored procedures that manage temporal tables.
    • CVSS 8.8 CVE-2024-37965: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7040.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5042207

    SQL privilege flaws addressed; CDC upgrades may lose columns

    Addresses three SQL Server vulnerabilities and fixes a temporal-table quoting problem. CDC upgrades can still drop columns with commas in their names or fail on other symbols.

    Check the newer update, KB5046063
    Known issues: 1 open Organizations and IT administrators
    • CDC capture job might fail if columns are missing in CDC change tables

    Key changes 3 CVEs · 2 changes

    • Improved Replication: CDC gets a security safeguard that blocks certain database-definition changes.
    • Fix Temporal: Stored procedures that manage temporal tables handle table and column names correctly when building internal database commands.
    • CVSS 8.8 CVE-2024-37965: Microsoft SQL Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6445.1
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU28 SQL Server 2019 CU28 Cumulative update

    KB5039747

    SESSION_CONTEXT errors in parallel plans; backup and patching issues

    CU28 adds 13 fixes, but queries using SESSION_CONTEXT in parallel plans might return incorrect results or trigger access violations. Two other listed issues are fixed in CU29.

    Check the newer update, KB5042749
    SQL Server 2019 cumulative updates are scheduled to end on February 28, 2025; security updates are scheduled to end on January 8, 2030.
    Known issues: 2 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans
    • Issue two: SQL Server VSS Writer might fail to perform a backup because no database is available to freeze

    Key changes 13 changes

    • Improved Analysis Services: Intel Threading Building Blocks assemblies are digitally signed with a Microsoft certificate.
    • Improved Command Line Tools: SQL Server 2019 container images use the new mssql-tools18 package and tools directory. The previous tools directory is phased out.
    • Improved SQL OS: A high-I/O-latency warning is logged less often, reducing excessive entries in the SQL Server error log.

    Read update Source: Microsoft

    Build
    15.0.4385.2
    Restart
    Required
  • SQL Server 2022 CU14 SQL Server 2022 CU14 Cumulative update

    KB5038325

    SQL backups can fail; parallel queries may return wrong results

    Includes 12 fixes for SQL Server 2022, but it also lists backup and parallel-query problems. The backup issue is fixed in CU15; the parallel-query issue remains open.

    Check the newer update, KB5042578
    Known issues: 2 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans
    • Issue two: SQL Server VSS Writer might fail to perform a backup because no database is available to freeze

    Key changes 12 changes

    • New High Availability and Disaster Recovery: The cluster log report includes performance-monitor counters when a health-check timeout is reported.
    • Improved Command Line Tools: Linux container images use the newer Microsoft command-line tools directory; the former directory is being phased out.
    • Improved Query Optimizer: SQL Server estimates results more accurately for certain filters when its data statistics contain only one histogram step.

    Read update Source: Microsoft

    Build
    16.0.4135.4
    Restart
    Required
  • SQL Server 2022 CU13 + GDR SQL Server 2022 CU13 + GDR Security update

    KB5040939

    Unused Stretch DB components removed from Setup

    The update resolves 38 Important-severity vulnerabilities and removes unused Stretch DB components from Setup. It can request a restart.

    Check the newer update, KB5042578

    Key changes 38 CVEs · 1 change

    • Removed Stretch DB: Unused Stretch DB components are removed from SQL Server Setup.
    • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.4131.2
    Security
    38 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5040936

    38 OLE DB vulnerabilities addressed; unused Stretch DB components removed

    Resolves 38 vulnerabilities, all rated Important, including remote-code-execution flaws in OLE DB components. It also removes unused Stretch DB components from setup.

    Check the newer update, KB5042211

    Key changes 38 CVEs · 1 change

    • Removed Stretch DB: Unused Stretch DB components are removed from SQL Server Setup.
    • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.1121.4
    Security
    38 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU27 + GDR SQL Server 2019 CU27 + GDR Security update

    KB5040948

    38 vulnerabilities addressed; unused setup components removed

    Addresses 38 Important-severity vulnerabilities and removes unused components from SQL Server Setup.

    Check the newer update, KB5042749
    SQL Server 2019 cumulative updates end on February 28, 2025.

    Key changes 38 CVEs · 1 change

    • Removed Stretch DB: Unused components are removed from SQL Server Setup.
    • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4382.1
    Security
    38 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5040986

    Unused Stretch DB components removed from Setup

    The update addresses 38 Important-severity vulnerabilities and removes unused Stretch DB components from Setup. It may require a restart.

    Check the newer update, KB5042214
    Cumulative updates for version 2019 end February 28, 2025; security updates are scheduled through January 8, 2030.

    Key changes 38 CVEs · 1 change

    • Removed Stretch DB: Unused Stretch DB components are removed from SQL Server Setup.
    • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2116.2
    Security
    38 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update

    KB5040940

    Native Client OLE DB flaws patched; unused Stretch DB components removed

    The update addresses 37 Important vulnerabilities in the Native Client OLE DB Provider and removes unused Stretch DB components from Setup.

    Check the newer update, KB5042215

    Key changes 37 CVEs · 1 change

    • Removed Stretch DB: Unused Stretch DB components are removed from SQL Server Setup.
    • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14.0.3471.2
    Security
    37 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2017 GDR SQL Server 2017 GDR Security update

    KB5040942

    Native Client OLE DB flaws addressed; unused Stretch DB parts removed

    Resolves 37 vulnerabilities: 36 rated Important and one unrated, with none rated Critical. It also removes unused Stretch DB components from SQL Server Setup.

    Check the newer update, KB5042217

    Key changes 37 CVEs · 1 change

    • Removed Stretch DB: Unused Stretch DB components are removed from SQL Server Setup.
    • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14.0.2056.2
    Security
    37 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update

    KB5040944

    37 database security flaws addressed; unused setup components removed

    The update addresses 37 important security vulnerabilities in SQL Server, including flaws that could let attackers run code, and removes unused setup components.

    Check the newer update, KB5042209

    Key changes 37 CVEs · 1 change

    • Removed Stretch DB: Unused components are removed from SQL Server Setup.
    • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    13.0.7037.1
    Security
    37 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update

    KB5040946

    Unused Stretch DB components removed from Setup

    The update addresses 37 Important vulnerabilities and removes unused Stretch DB components from SQL Server Setup.

    Check the newer update, KB5042207

    Key changes 37 CVEs · 1 change

    • Removed Stretch DB: Unused Stretch DB components are removed from SQL Server Setup.
    • CVSS 8.8 CVE-2024-20701: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    13.0.6441.1
    Security
    37 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU27 SQL Server 2019 CU27 Cumulative update

    KB5037331

    Thirteen fixes include availability group and logging changes

    Includes 13 fixes for SQL Server 2019. It also leaves an open issue where `SESSION_CONTEXT` queries in parallel plans might return incorrect results or cause access violations.

    Check the newer update, KB5040948
    SQL Server 2019 cumulative updates are scheduled to end February 28, 2025. Security updates are scheduled to continue through January 8, 2030.
    Known issues: 1 open Organizations and IT administrators
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 13 changes

    • New SQL OS: A warning is added to the error log when high I/O latencies are detected in Bufferpool Lazy Writer.
    • Improved High Availability and Disaster Recovery: The cluster log report includes performance monitor counters when a health check timeout is reported.
    • Fix Master Data Services: Using a domain account on a computer that is not a domain controller no longer causes the “Network path not found” error.

    Read update Source: Microsoft

    Build
    15.0.4375.4
    Restart
    Required
  • SQL Server 2022 CU13 SQL Server 2022 CU13 Cumulative update

    KB5036432

    Availability-group patch failure can recover; SESSION_CONTEXT issue remains

    CU13 includes 15 fixes, including fixes for availability groups and replication. Setup might initially fail on some availability-group databases, while parallel SESSION_CONTEXT queries can still return incorrect results or cause access violations.

    Check the newer update, KB5040939
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 15 changes

    • New Query Execution: A new advanced option lets you limit memory used to handle remote procedure call parameters.
    • Improved Query Optimizer: Creating statistics on temporary tables can involve fewer registry waits.
    • Improved Replication: The change-tracking history records an error message to help explain cleanup failures.

    Read update Source: Microsoft

    Build
    16.0.4125.3
    Restart
    Required
  • SQL Server 2019 CU26 SQL Server 2019 CU26 Cumulative update

    KB5035123

    Parallel SESSION_CONTEXT queries can return incorrect results

    CU26 includes 23 fixes, but parallel queries using SESSION_CONTEXT might return incorrect results or cause access violations. It also introduces a lock-escalation regression that can cause error 1204.

    Check the newer update, KB5037331
    SQL Server 2019 cumulative updates end on February 28, 2025.
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 19 changes

    • New Query Execution: A new setting lets administrators limit the memory used to handle remote procedure call parameters.
    • New Search: The full-text filter usage event reports four additional input and output size measurements.
    • Improved Security Infrastructure: The number of extra user tokens created by SQL Server process views is limited when trace flag 4673 is used.

    Read update Source: Microsoft

    Build
    15.0.4365.2
    Restart
    Required
  • SQL Server 2022 CU12 + GDR SQL Server 2022 CU12 + GDR Security update

    KB5036343

    Remote-code-execution flaws in SQL drivers addressed

    Addresses 38 Important vulnerabilities in the Microsoft ODBC and OLE DB drivers for SQL Server. SQL Server components move to build 16.0.4120.1.

    Check the newer update, KB5040939

    Key changes 38 CVEs · 1 change

    • Improved SQL Server: SQL Server components are updated to build 16.0.4120.1.
    • CVSS 8.8 CVE-2024-28906: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-28908: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.4120.1
    Security
    38 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5035432

    ODBC and OLE DB driver code-execution flaws closed

    Addresses remote code execution vulnerabilities in SQL Server's ODBC and OLE DB drivers.

    Check the newer update, KB5040936

    Key changes 38 CVEs · 1 change

    • Fix ODBC Driver and OLE DB Driver for SQL Server: The update resolves remote code execution vulnerabilities in the SQL Server ODBC and OLE DB drivers.
    • CVSS 8.8 CVE-2024-28906: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2024-28908: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.1115.1
    Security
    38 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 CU25 + GDR SQL Server 2019 CU25 + GDR Security update

    KB5036335

    Remote-code flaws addressed in ODBC and OLE DB drivers

    Addresses 38 Important vulnerabilities, including remote code execution flaws in the ODBC and OLE DB drivers for SQL Server.

    Check the newer update, KB5040948
    SQL Server 2019 cumulative updates end February 28, 2025; security updates continue through January 8, 2030.

    Key changes 38 CVEs · 2 changes

    • Fix Microsoft ODBC Driver for SQL Server: Remote code execution vulnerabilities in the ODBC driver are addressed.
    • Fix Microsoft OLE DB Driver for SQL Server: Remote code execution vulnerabilities in the OLE DB driver are addressed.
    • CVSS 8.8 CVE-2024-28906: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.0.4360.2
    Security
    38 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2019 GDR SQL Server 2019 GDR Security update

    KB5035434

    ODBC and OLE DB driver vulnerabilities addressed

    Addresses 38 vulnerabilities in SQL Server-related drivers and updates SQL Server 2019 to build 15.0.2110.4. A restart might be requested.

    Check the newer update, KB5040986
    Cumulative updates for SQL Server 2019 end on February 28, 2025; security updates continue until January 8, 2030.

    Key changes 38 CVEs · 2 changes

    • Improved SQL Server: SQL Server 2019 is updated to build 15.0.2110.4.
    • Fix ODBC Driver for SQL Server and OLE DB Driver for SQL Server: Remote code execution vulnerabilities in the SQL Server drivers are addressed.
    • CVSS 8.8 CVE-2024-28906: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.0.2110.4
    Security
    38 vulnerabilities fixed
    Restart
    Required
  • SQL Server 2022 CU12 SQL Server 2022 CU12 Cumulative update

    KB5033663

    Replication authentication and stronger password verifiers arrive

    CU12 brings 51 fixes, makes Microsoft Entra authentication for replication generally available, and adds iterated, salted password verifiers. Queries using SESSION_CONTEXT might return incorrect results or trigger access violation dumps in parallel plans.

    Check the newer update, KB5036343
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 48 changes

    • New Linux: SQL Server on Linux gains support for Extensible Key Management.
    • New Security Infrastructure: Password verifiers can use an iterated and salted hash process instead of storing only a SHA-512 hash.
    • New SQL OS: Trace flag 2616 enables the stack signature feature when a dump occurs, helping avoid multiple dumps for the same exception.

    Read update Source: Microsoft

    Build
    16.0.4115.5
    Restart
    Required
  • SQL Server 2019 CU25 SQL Server 2019 CU25 Cumulative update

    KB5033688

    Availability databases return in SSMS; parallel SESSION_CONTEXT remains risky

    Fixes 14 issues in SQL Server 2019, including missing availability databases in SSMS. Queries using SESSION_CONTEXT can still return incorrect results or trigger access violations in parallel plans.

    Check the newer update, KB5036335
    SQL Server 2019 cumulative updates end February 28, 2025; security updates continue through January 8, 2030.
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 14 changes

    • Improved High Availability and Disaster Recovery: Creating a read-scale availability group with a large number of databases is prevented to avoid a subsequent assertion failure.
    • Improved Query Execution: A mitigation reduces the chance of an assertion failure during some complex queries using large-value data types; it does not apply in...
    • Improved SQL OS: Compressed memory dumps use I/O more efficiently, limit excessive file-cache growth, and can make better use of available CPU cores.

    Read update Source: Microsoft

    Build
    15.0.4355.3
    Restart
    Required
  • SQL Server 2022 CU11 SQL Server 2022 CU11 Cumulative update

    KB5032679

    SESSION_CONTEXT errors remain; 16 fixes included

    Includes 16 fixes for SQL Server 2022. An issue that can make SESSION_CONTEXT return wrong results or produce access-violation dumps in parallel queries remains open.

    Check the newer update, KB5033663
    Known issues: 1 open
    • Incorrect behavior of SESSION_CONTEXT in parallel plans

    Key changes 18 changes

    • Improved SQL Server: The SQL Server product build updates to 16.0.4105.2.
    • Improved Analysis Services: The Analysis Services build updates to 16.0.43.222.
    • Fix Master Data Services: Find Parent works when its target is a node found by search.

    Read update Source: Microsoft

    Build
    16.0.4105.2
    Restart
    Required
  • SQL Server 2022 CU10 + GDR SQL Server 2022 CU10 + GDR Security update

    KB5033592

    SQL data provider security bypass vulnerability resolved

    Resolves a security feature-bypass vulnerability in the SQL data providers. It also updates SQL Server 2022 to build 16.0.4100.1.

    Check the newer update, KB5036343

    Key changes 1 CVE · 1 change

    • Fix SQL data providers: A security feature-bypass vulnerability in the SQL data providers is resolved.
    • CVSS 8.7 CVE-2024-0056: Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

    Read update Source: Microsoft

    Build
    16.0.4100.1
    Security
    1 vulnerability fixed
    Restart
    Required
  • SQL Server 2022 GDR SQL Server 2022 GDR Security update

    KB5032968

    SQL data provider security bypass vulnerability addressed

    The update addresses one Important security vulnerability, CVE-2024-0056, involving a security feature bypass in the SQL data providers.

    Check the newer update, KB5035432

    Key changes 1 CVE · 1 change

    • Fix Microsoft.Data.SqlClient and System.Data.SqlClient: A security feature bypass vulnerability in the SQL data providers is addressed.
    • CVSS 8.7 CVE-2024-0056: Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

    Read update Source: Microsoft

    Build
    16.0.1110.1
    Security
    1 vulnerability fixed
    Restart
    Required