Applies To
SQL Server 2025 on Windows (all editions), SQL Server 2025 on Linux (all editions)
Release date: September 8, 2026
Version: 17.0.4085.5
- Summary
- Known issues in this update
- Improvements and fixes included in this update
- How to obtain and install the update
- How to obtain or download the latest cumulative update package for Linux
- More information
- File information
- Information about protection and security
Summary
This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories:
- CVE-2026-66814 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-66816 - Microsoft SQL Server Security Feature Bypass Vulnerability
- CVE-2026-66818 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-66819 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-66820 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-67368 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-67369 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67370 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-67373 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67376 - Microsoft SQL Server Denial of Service Vulnerability
- CVE-2026-67378 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67379 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67380 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67381 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-67383 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67384 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67385 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67386 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67388 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67389 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67390 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67393 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67624 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67629 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67630 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67631 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67633 - Microsoft SQL Server Denial of Service Vulnerability
- CVE-2026-67636 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67638 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67639 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67641 - Microsoft SQL Server Denial of Service Vulnerability
- CVE-2026-67642 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67643 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67645 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-67648 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-68775 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-68776 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-68777 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-68778 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-68779 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-68780 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-68781 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-68784 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-68785 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-68786 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-68787 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-73028 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-73029 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-77480 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-77481 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-77483 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-77484 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-77485 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-77487 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-77488 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-47297 - Microsoft SQL Server Remote Code Execution Vulnerability
The Microsoft SQL Server components are updated to the following builds in this security update:
- SQL Server - product version: 17.0.4085.5, file version: 2025.170.4085.5
Important
To help secure SQL Server on Windows, enable encryption with Extended Protection.
Known issues in this update
Linked server queries that use MSDASQL fail with error 7416
Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message:
Msg 7416, Level 16
Access to the remote server is denied because no login-mapping exists.
A stricter connection validation check in the Database Engine can reject connections for certain linked server configurations that use the MSDASQL provider, even if earlier builds allowed those connections.
For more information and workarounds, see Linked server queries that use MSDASQL fail with error 7416.
Access violation when you query sys.dm_exec_requests during database recovery
Queries against sys.dm_exec_requests might raise an access violation and generate a dump file if they run while a database is still recovering. This issue can occur during a database RESTORE operation, during startup recovery, or before an availability group replica finishes coming online.
The SQL Server error log contains entries that resemble the following text:
The database '<DatabaseName>' is marked RESTORING and is in a state that does not allow recovery to be run.
***Stack Dump being sent to <SQLServerLogFolder>\SQLDump0215.txt
SqlDumpExceptionHandler: Process 77 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Server is terminating this process.
*******************************************************************************
BEGIN STACK DUMP:
07/30/26 07:37:23 spid 77
Exception Address = <frame id="00" address="0x7FFDED94970D" pdb="sqlmin.pdb" age="2" guid="E1039014-237E-4DB6-88FD-4A2AB31C651F" module="sqlmin" rva="0x2970D" />
Exception Code = c0000005 EXCEPTION_ACCESS_VIOLATION
Access Violation occurred reading address 00000000000000F0
Input Buffer <size> bytes -
<dbo.sp_YourMonitoringStoredProcedure>
This issue occurs because of a change that causes internal in-memory structures to be referenced before they're fully initialized.
Microsoft is aware of this issue and is investigating a fix. Until a fix is available, use one of the following mitigations:
- Enable trace flag 4696 to opt out of the code change that causes this issue. If you enable this trace flag, monitoring queries that query
sys.dm_exec_requestsorsys.sysprocesseson secondary replicas might return error "976" or error "978" as they did before you installed this update. - Avoid queries against
sys.dm_exec_requestsfor databases that are recovering. - Uninstall this update.
Improvements and fixes included in this update
A downloadable Excel workbook that contains a summary list of builds, together with their current support lifecycle, is available. The Excel file also contains detailed fix lists. Download this Excel file now.
Note
Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format. You can then share this URL with others so that they can jump directly to the desired fix in the table.
| Bug Reference | Description | Fix area | Component | Platform |
|---|---|---|---|---|
| 5442241 | This fix addresses a security validation issue in SQL Server Agent if SQL Server Agent loads task-agent components. This fix strengthens security validation. | SQL Agent | Windows | |
| 5456053 | This fix addresses reliability and security issues in SQL Server Agent if it processes specific input. | SQL Server Engine | SQL Agent | Linux;Windows |
| 5459621 | This fix addresses an issue in which the SQL WMI Provider processes malformed input incorrectly while preserving existing behavior for valid input. | SQL Server Engine | Linux;Windows | |
| 5481777 | This fix addresses an issue that affects the security and reliability of SQL Server Agent under specific operating conditions. | SQL Server Engine | SQL Agent | Linux;Windows |
| 5488560 | This fix improves the validation of responses from S3-compatible external storage endpoints during external data access. | SQL Server Engine | PolyBase | Linux;Windows |
| 5488792 | This fix addresses a security vulnerability in Microsoft Entra authentication login handling in SQL Server. | SQL Server Engine | Linux;Windows | |
| 5490415 | This fix addresses the internal validation of backup metadata that's processed by the SQL Server Volume Shadow Copy Service (VSS) Writer to improve the handling of malformed or undersized metadata and ensure that it's rejected safely. | SQL Server Engine | Backup Restore | Windows |
| 5496453 | This fix addresses arithmetic overflow and out-of-bounds memory access issues in the SQL Server LEFT_SHIFT and RIGHT_SHIFT functions if these functions process specially crafted shift values or binary inputs. These issues can cause the SQL Server process to terminate unexpectedly. | SQL Server Engine | ||
| 5496924 | This fix addresses a security issue in SQL Server by updating how SQL Server processes and outputs certain internal event data to help protect information. | SQL Server Engine | Linux;Windows | |
| 5497382 | This fix addresses a buffer overflow that occurs during an authenticated Tabular Data Stream (TDS) remote procedure call (RPC) and causes the SQL Server process to terminate unexpectedly. | SQL Server Engine | SQL Server Engine | Linux;Windows |
| 5497456 | This fix addresses an issue that affects the reliability and security of SQL Server Agent if it processes specific input. | SQL Server Engine | SQL Agent | Linux;Windows |
| 5497754 | This fix addresses a vulnerability that affects the SQL Server managed backup to the Microsoft Azure stored procedures, managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup. Customers who use managed backup should apply this update through the standard SQL Server servicing process. | SQL Server Engine | Backup Restore | Linux;Windows |
| 5497891 | This fix addresses a security issue in SQL Server in which insufficient validation in Extended Events can cause memory corruption. | SQL Server Engine | Extended Events | Linux;Windows |
| 5497995 | This fix resolves several security vulnerabilities that allow information disclosure or a denial of service if the database engine reads a specially crafted Extended Events (.xel) file. | SQL Server Engine | Extended Events | Linux;Windows |
| 5499779 | This fix addresses a remote code execution vulnerability in which a user who has administrative permissions modifies PolyBase service command-line parameters to activate a deprecated feature that runs the Data Warehouse (DW) Engine and Data Movement Service (DMS) control and data channels on raw Transmission Control Protocol (TCP) listeners. This deprecated feature is intended to run under a single SQL Platform Abstraction Layer (SQLPAL) instance in Kubernetes by having only the SQL Server port exposed outside the pod. The fix prevents PolyBase services from opening raw TCP listeners for the DW Engine and DMS control and data channels if the services start by having modified command-line parameters. | SQL Server Engine | PolyBase | Linux;Windows |
| 5499900 | This fix addresses an XML data type handling bug in Document Type Definition (DTD) attribute lists. | SQL Server Engine | XML | Linux;Windows |
| 5500478 | This fix addresses identifier handling and input validation in replication stored procedures to ensure that supplied and stored values are processed correctly. | SQL Server Engine | Replication | Linux;Windows |
| 5500479 | This fix addresses replication stored procedures that incorrectly process identifiers that contains longer or special characters. | SQL Server Engine | Replication | Linux;Windows |
| 5500480 | This fix addresses replication stored procedures that incorrectly process identifiers that contain special characters. | SQL Server Engine | Replication | Linux;Windows |
| 5500481 | This fix addresses input validation for a merge replication metadata stored procedure to ensure that supplied values are processed reliably. | SQL Server Engine | Replication | Linux;Windows |
| 5500482 | This fix addresses a replication stored procedure that handles a caller-supplied path value. | SQL Server Engine | Replication | Linux;Windows |
| 5500483 | This fix addresses input validation for parameters that are used by replication stored procedures to ensure that supplied values are processed reliably. | SQL Server Engine | Replication | Linux;Windows |
| 5501050 | This fix improves internal validation and security checks for SQL Server replication stored procedures to ensure that replication operations are processed by using the expected security safeguards. | SQL Server Engine | Replication | Linux;Windows |
| 5501457 | This fix addresses an issue where the SUBSTRING function reads beyond the allocated buffer if a natively compiled In-Memory Online Transaction Processing (OLTP) procedure processes malformed double-byte character set (DBCS) varchar input. The issue occurs because of an unsigned integer underflow in the string length calculation. | SQL Server Engine | In-Memory OLTP | Linux;Windows |
| 5501458 | This fix addresses an issue in which converting or truncating an NVARCHAR value that contains an Ideographic Variation Sequence (IVS) under a Variation Selector Sensitive (_VSS) collation causes an access violation. The issue occurs in a natively compiled In-Memory Online Transaction Processing (OLTP) procedure and causes the server to stop responding. | SQL Server Engine | In-Memory OLTP | Linux;Windows |
| 5501459 | This fix addresses an issue in which a natively compiled stored procedure causes a heap buffer overwrite while streaming nvarchar(max) data with SET TEXTSIZE truncation under a Variation Selector Sensitive (_VSS) collation. The issue causes the server to stop responding if the procedure uses small Tabular Data Stream (TDS) packet sizes. | SQL Server Engine | In-Memory OLTP | Linux;Windows |
| 5501667 | This fix addresses an error condition that causes an incorrectly formatted error message. | SQL Server Engine | Linux;Windows | |
| 5502642 | This fix addresses an improper input validation issue in SQL Server that allows an authenticated user to disclose a limited amount of memory. This fix strengthens input validation. | SQL Server Engine | Query Execution | Linux;Windows |
| 5503122 | This fix addresses an integer overflow in the SQL Server XML reader that occurs if SQL Server processes a specially crafted XML format file through OPENROWSET(BULK...) or BULK INSERT. The integer overflow can cause the SQL Server process to stop responding or terminate unexpectedly. | SQL Server Engine | XML | Linux;Windows |
| 5503129 | This fix addresses an access violation that occurs if SQL Server processes a query with an extremely large OPTION (USE PLAN) XML declaration. This access violation can cause the SQL Server process to terminate unexpectedly. | SQL Server Engine | XML | Linux;Windows |
| 5503977 | Fixes an issue in which the data_sensitivity_information field is not consistently populated in audit records that are generated by SCHEMA_OBJECT_ACCESS_GROUP. This update ensures that sensitivity information is reliably included in all applicable audit records. | SQL Server Engine | Security Infrastructure | Linux;Windows |
| 5504191 | This fix strengthens Object Store Format (OSF) deserialization against malformed or malicious stream data. | SQL Server Engine | Replication | Windows |
| 5505183 | This fix addresses an issue in which the class ID lookup call reads arbitrary memory. | SQL Server Engine | Replication | Windows |
| 5505438 | This fix adds bounds validation for embedded attestation fields. | SQL Server Engine | Replication | Windows |
| 5505447 | This fix strengthens Object Store Format (OSF) deserialization against malformed or malicious stream data. | SQL Server Engine | Replication | Windows |
| 5505473 | This fix strengthens buffer length validation checks within enclave code. | SQL Server Engine | Replication | Windows |
| 5506051 | This fix addresses an improper input validation issue in SQL Server that allows an authenticated user to disclose in‑memory information. This fix strengthens input validation. | SQL Server Engine | Query Execution | Linux;Windows |
| 5506111 | This fix addresses an improper input validation issue in SQL Server in which an authenticated user can provide a pointer that SQL Server dereferences and reads but does not execute. This issue can cause dump file generation or out-of-memory conditions. This fix strengthens input validation. | SQL Server Engine | Query Execution | Linux;Windows |
| 5529169 | This fix addresses improper field offset validation in the SqlDataRecord.SetBytes API for sql_variant values. This fix prevents an out-of-bounds heap write that can cause denial of service or elevation of privilege in SQL Server installations and Azure SQL Managed Instances that have common language runtime (CLR) enabled. | SQL Server Engine | Windows | |
| 5529202 | This fix improves the handling of input to Showplan to enhance security and reliability. | SQL Server Engine | Query Store | Windows |
| 5529343 | This fix addresses an issue that affects the protection of internal replication data during processing operations. | SQL Server Engine | Replication | Linux;Windows |
| 5529356 | This fix addresses an issue in Merge Replication that affects the handling of text data during processing operations. | SQL Server Engine | Replication | Linux;Windows |
| 5529367 | This fix addresses an issue in replication operations that affects validation and handling to enhance security and reliability. | SQL Server Engine | Replication | Linux;Windows |
| 5529379 | This update includes security and reliability improvements for the Queued Updating Subscriptions in Transactional Replication. | SQL Server Engine | Replication | Windows |
| 5529392 | This update includes security and reliability improvements for the Queued Updating Subscriptions in Transactional Replication. | SQL Server Engine | Replication | Windows |
| 5529456 | This fix addresses an issue in Change Event Streaming (CES) that prevents event deserialization if event data payloads contain certain characters. | SQL Server Engine | Replication | Linux;Windows |
| 5529460 | This fix addresses SQL dump files that might be created during data serialization when Change Event Streaming is used to stream large object (LOB) data. | SQL Server Engine | Replication | Linux;Windows |
How to obtain and install the update
Method 1: Windows Update
This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Windows Update: FAQ.
Method 2: Microsoft Update Catalog
To get the standalone package for this update, go to the Microsoft Update Catalog website.
Note
- The detection logic has been updated for this and future security releases that are posted to the Microsoft Update Catalog website. For more information, see Updates to the Microsoft Update detection logic for SQL Server servicing.
- This update is made available through the Microsoft Update Catalog for all servers that are running SQL Server, even if Power BI Report Server is not installed. Installing this security update is optional for computers that do not host Power BI Report Server. For more information, see Download Power BI Report Server.
Method 3: Microsoft Download Center
The following file is available for download from the Microsoft Download Center:
How to obtain or download the latest cumulative update package for Linux
To update SQL Server 2025 on Linux to the latest CU, you must first have the Cumulative Update repository configured. Then, update your SQL Server packages by using the appropriate platform-specific update command.
For installation instructions and direct links to the CU package downloads, see the SQL Server 2025 Release Notes.
More information
Prerequisites
To apply this update, you must have SQL Server 2025 or any SQL Server 2025 CU release through this SQL Server 2025 CU8 GDR installed.
Security update deployment information
For deployment information about this update, see Deployments - Security Update Guide.
File hash information
| File name | SHA256 hash |
|---|---|
| SQLServer2025-KB5122769-x64.exe | 6E23BA9E542DF038D57383568C0AEE7D2F59AAD6413D08C6AADA72FBD7F87CD0 |
File information
The English version of this package has the file attributes (or later file attributes) that are listed in the following worksheet. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it's converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
For all supported x64-based versions - Download the list of files that are included in security update 5122769.
Information about protection and security
Protect yourself online: Windows Security support
Learn how we guard against cyber threats: Microsoft Security