September 2026 SQL Server Security Updates

The cost of a properly planned SQL Server maintenance window is measurable and manageable. The cost of a database compromise or database-service outage is much harder to contain.

Microsoft released SQL Server security updates on September 8, 2026, for SQL Server 2017, SQL Server 2019, SQL Server 2022, and SQL Server 2025. The release addresses 55 unique SQL Server CVEs across remote code execution, elevation of privilege, information disclosure, denial of service, and security-feature-bypass categories.

Not every CVE applies to every SQL Server instance. Exposure depends on the version, servicing branch, installed features, and configuration. However, the updates address vulnerabilities in components used by many production SQL Server environments, including SQL Server Agent, PolyBase, Backup and Restore, VSS Writer, the SQL WMI Provider, XML processing, replication, Extended Events, Query Store, managed backup, and core query execution paths.

For most organizations, treat this as a priority security-maintenance cycle: inventory your SQL Server instances, identify the correct servicing branch, test the update against critical application workflows, deploy the update, and verify the installed build afterward.

Why this update matters

SQL Server is often the system of record for financial, customer, operational, employee, and application data. A vulnerability in SQL Server can create more than a technical problem. It can create a business problem.

The September updates address issues that can affect the confidentiality, integrity, and availability of SQL Server workloads.

Confidentiality: Information-disclosure vulnerabilities can expose limited memory-resident information or internal processing details. Microsoft’s fixes include strengthened validation for scenarios in which an authenticated user could disclose a limited amount of memory.
Integrity: Elevation-of-privilege and remote-code-execution vulnerabilities can allow an attacker with an existing foothold or valid access to do more than they should be able to do. That can increase the impact of compromised credentials, overly broad permissions, or vulnerable application access paths.
Availability: Denial-of-service vulnerabilities can cause SQL Server to stop responding or terminate unexpectedly. Microsoft’s fixes include protections for malformed XML input, oversizedOPTION (USE PLAN) XML declarations, specially crafted shift values, and other input-validation scenarios.
Operational resilience: Depending on the version and features in use, this update strengthens security handling in Agent, PolyBase, replication, Extended Events, backup-related components, WMI, XML, and other SQL Server subsystems.

This is why patching matters even when a server is not directly exposed to the public Internet. An attacker may reach SQL Server through a compromised application account, a lower-trust network segment, a privileged service account, a linked server connection, or credentials obtained elsewhere in the environment.

The September 2026 SQL Server update release addresses 55 SQL Server CVEs across SQL Server 2017, 2019, 2022, and 2025. It includes vulnerabilities across remote code execution, elevation of privilege, information disclosure, denial of service, and security-feature-bypass categories. Treat this update as a priority security-maintenance initiative: assess immediately, test intelligently, deploy promptly, and verify every production instance reaches its appropriate patched build.

Supported Versions and Builds

Microsoft issued updates for every currently supported major on-premises SQL Server version: SQL Server 2017, SQL Server 2019, SQL Server 2022, and SQL Server 2025. Each major version received a CU branch package and a GDR branch package.

SQL Server version	Servicing branch	September 2026 Patched build	Microsoft KB article
SQL Server 2025	CU8	17.0.4085.5	KB5122769
SQL Server 2025	GDR	17.0.1135.8	KB5122770
SQL Server 2022	CU26	16.0.4275.2	KB5122768
SQL Server 2022	GDR	16.0.1200.5	KB5122771
SQL Server 2019	CU32	15.0.4490.9	KB5122772
SQL Server 2019	GDR	15.0.2190.7	KB5122773
SQL Server 2017	CU31	14.0.3550.4	KB5122774
SQL Server 2017	GDR	14.0.2130.4	KB5122775

The CU packages include the security fixes plus the normal cumulative set of product fixes for that branch. The GDR packages provide a narrower, security-focused servicing path for organizations that are intentionally remaining on GDR.

What to prioritize first

Every supported SQL Server instance should be assessed, but the following systems should move to the front of the patching queue:

Production instances that hold sensitive customer, employee, financial, healthcare, or proprietary business data
SQL Server instances reachable from lower-trust network segments or large application environments
Servers using SQL-authenticated application accounts, shared service accounts, or broad database permissions
Instances that use PolyBase, replication, SQL Server Agent, CLR, Extended Events, linked servers, VSS-based backup tooling, or managed backup
Systems that support customer-facing applications, order processing, financial operations, reporting, manufacturing, or other business-critical workloads
Instances where a database outage would have a material operational or financial impact

The practical risk is not limited to anonymous Internet attacks. Several types of SQL Server vulnerabilities become more concerning when an attacker already has valid credentials, an application identity, or a foothold in the environment. That is one reason security patching and least-privilege access controls need to work together.

Test before production deployment

Security updates should be deployed promptly, but “promptly” does not mean “without testing.”

For this release, Microsoft documents a known issue affecting some linked-server queries that use the MSDASQL provider with a provider string. After applying the update, those queries can fail with error 7416 because of stricter connection validation. If your environment uses ODBC-linked servers, test that workload before production deployment.

Microsoft also documents a SQL Server 2022 CU26 issue in which queries against sys.dm_exec_requests can cause an access violation and dump generation while a database is recovering, during restore operations, startup recovery, or before an Availability Group replica has completed its transition to online status. Microsoft provides mitigations, including avoiding those queries during recovery or enabling trace flag 4696.

Verify the installed build

After patching, verify that the SQL Server instance is at the applicable fixed build or a later supported build that supersedes it.

SELECT

@@SERVERNAME AS InstanceName,

CAST(SERVERPROPERTY('ProductVersion') AS nvarchar(128)) AS ProductVersion,

CAST(SERVERPROPERTY('ProductMajorVersion') AS int) AS ProductMajorVersion,

CAST(SERVERPROPERTY('ProductLevel') AS nvarchar(128)) AS ProductLevel,

CAST(SERVERPROPERTY('ProductUpdateLevel') AS nvarchar(128)) AS ProductUpdateLevel,

CAST(SERVERPROPERTY('ProductUpdateReference') AS nvarchar(128)) AS ProductUpdateReference,

CAST(SERVERPROPERTY('Edition') AS nvarchar(256)) AS Edition,

SERVERPROPERTY('IsClustered') AS IsClustered,

SERVERPROPERTY('IsHadrEnabled') AS IsHadrEnabled;

The goal is not simply to prove that an update installer ran. The goal is to confirm that each production instance reached the appropriate build, restarted as required, and still supports the business workloads that depend on it.

Unsupported Versions Need a Different Plan

SQL Server 2016 reached the end of extended support in July 2026. SQL Server 2014 and earlier versions have been out of support even longer. They do not receive the September 2026 fixes.

That creates an important leadership decision: unsupported SQL Server is no longer a routine maintenance concern. It is an unremediated security exposure with no normal patch path. If a business-critical application remains on SQL Server 2016 or earlier, organizations should treat modernization, migration, isolation, and compensating controls as a time-bound risk-reduction program—not as an indefinite exception.

You Are Not Alone

If you would like guidance or help ensuring your SQL Server estate is safe and secure, contact us.