Release date: October 13, 2026
Version: 14.0.2140.2
- Summary
- Known issues in this update
- Improvements and fixes included in this update
- How to obtain and install the update
- More information
- File information
- Information about protection and security
Summary
This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories:
- CVE-2026-94512 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-96956 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-94520 - Microsoft SQL Server Denial of Service Vulnerability
- CVE-2026-88085 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-70189 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67625 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-85886 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-68883 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-88081 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-85888 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-83945 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67628 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-88089 - Microsoft SQL Server Remote Code Execution Vulnerability
The Microsoft SQL Server components are updated to the following builds in this security update:
- SQL Server - product version: 14.0.2140.2, file version: 2017.140.2140.2
Important
To help secure SQL Server on Windows, enable encryption with Extended Protection.
Known issues in this update
Linked server queries that use MSDASQL fail with error 7416
Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message:
Msg 7416, Level 16
Access to the remote server is denied because no login-mapping exists.
A stricter connection validation check in the Database Engine can reject connections for certain linked server configurations that use the MSDASQL provider, even if earlier builds allowed those connections.
For more information and workarounds, see Linked server queries that use MSDASQL fail with error 7416.
Improvements and fixes included in this update
A downloadable Microsoft Excel workbook that contains a summary list of builds, together with their current support lifecycle, is available. The Excel file also contains detailed fix lists. Download this Excel file now.
Note
Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format. You can then share this URL with others so that they can jump directly to the desired fix in the table.
| Bug reference | Description | Fix area | Component | Platform |
|---|---|---|---|---|
| 5521334 | Fixes multiple memory-corruption and memory-disclosure vulnerabilities in the SQL Server SQL Satellite protocol message parsing logic that's used by Machine Learning Services and Language Extensions. | Linux, Windows | ||
| 5524465 | Adds validation of FILESTREAM fragment size on Availability Group secondary replicas to reject oversized fragments. | SQL Server Engine | Linux, Windows | |
| 5533870 | Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. | SQL Server Engine | Replication | Windows |
| 5533874 | Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. | SQL Server Engine | Replication | Windows |
| 5541131 | Improves Showplan input handling to enhance security and reliability. | SQL Server Engine | Query Store | Windows |
| 5571556 | Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds write action potentially occurs while opening a virtual device set. | SQL Server Engine | Backup Restore | Windows |
| 5572076 | Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds read or write action potentially occurs while processing transferred data during backup or restore operations. | SQL Server Engine | Windows | |
| 5582165 | Fixes an issue in which MSDASQL linked server connections fail if the provider string doesn't include a user ID (UID). | SQL Server Engine | Linux, Windows | |
| 5639363 | Fixes an issue in replication operations that affects data validation. | SQL Server Engine | Replication | Linux, Windows |
| 5639374 | Fixes an issue in merge replication Web Synchronization operations that affects data validation. | SQL Server Engine | Replication | Linux, Windows |
| 5639394 | Strengthens authorization checks for certain replication-related database operations to help prevent unintended disclosure of database information. | SQL Server Engine | Replication | Linux, Windows |
| 5639442 | Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent malformed trace data from causing an out-of-bounds read action. | SQL Server Engine | Programmability | Windows |
| 5644968 | Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade operations. | SQL Server Engine | Replication | Windows |
| 5645007 | Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario. | SQL Server Engine | Replication | Windows |
| 5650549 | Fixes several security vulnerabilities that allow information disclosure or a denial of service when the Database Engine reads a specially crafted Extended Events (.xel) file. | SQL Server Engine |
How to obtain and install the update
Method 1: Windows Update
This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Windows Update: FAQ.
Method 2: Microsoft Update Catalog
To get the standalone package for this update, go to the Microsoft Update Catalog website.
Note
- The detection logic has been updated for this and future security releases that are posted to the Microsoft Update Catalog website. For more information, see Updates to the Microsoft Update detection logic for SQL Server servicing.
- This update is made available through the Microsoft Update Catalog for all servers that are running SQL Server, even if Reporting Services is not installed. Installing this security update is optional for computers that do not host Microsoft SQL Server Reporting Services.
Method 3: Microsoft Download Center
The following file is available for download from the Microsoft Download Center:
More information
Prerequisites
To apply this update, you must have SQL Server 2017 or any SQL Server 2017 GDR release through this SQL Server 2017 GDR installed.
Security update deployment information
For deployment information about this update, see Deployments - Security Update Guide.
File hash information
| File name | SHA256 hash |
|---|---|
| SQLServer2017-KB5128497-x64.exe | E99FBBDF4C94DA177BA8F6E622B3459A0C837D8F1556FEA25A94C2DA6C8CCB29 |
File information
The English version of this package has the file attributes (or later file attributes) that are listed in the following worksheet. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it's converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
For all supported x64-based versions - Download the list of files that are included in security update 5128497.
Information about protection and security
Protect yourself online: Windows Security support
Learn how we guard against cyber threats: Microsoft Security