Microsoft SQL Server SQL Server 2017 Update Version 14.0.3540.1

KB5102337 updates SQL Server 2017 CU31 to build 14.0.3540.1 and fixes four vulnerabilities, including CVE-2026-54118. It also addresses a linked server MSDASQL issue and several engine, replication, and SQL Agent fixes. Reference IDs: CVE-2026-47295, CVE-2026-47296, CVE-2026-55002.

• Fixes insecure deserialization in MessageQueueTask by restricting SoapFormatter deserialization, preventing possible RCE from untrusted MSMQ messages.
• Addresses an SQL injection issue in SQL Server Agent that could let an authenticated attacker elevate privileges over the network.
• Fixes input validation and sanitization for a parameter passed to an internal replication stored procedure.
• CVE-2026-47295
• CVE-2026-47296
• CVE-2026-54118
• CVE-2026-55002

• Resolves a memory leak when sys.dm_exec_input_buffer or DBCC INPUTBUFFER is used.
• Fixes a linked server validation issue that can cause MSDASQL queries with @provstr to fail with error 7416.

• Linked server queries that use MSDASQL with a provider string (@provstr) can fail with error 7416 due to stricter connection validation.

• Prerequisite: SQL Server 2017 or any SQL Server 2017 CU release through SQL Server 2017 CU31 GDR must be installed.
• The update is available through Windows Update, Microsoft Update Catalog, and Microsoft Download Center.
• Microsoft notes that enabling encryption with Extended Protection helps secure SQL Server on Windows.
• The update is available through Microsoft Update Catalog for all servers running SQL Server, even if Reporting Services is not installed.

• Microsoft Download Center package
  https://www.microsoft.com/en-us/download/details.aspx?id=0

Product Information

Vendor: Microsoft

Product: SQL Server

Product type: Software

Variant: SQL Server 2017

Version: 14.0.3540.1

Vendor release date: Jul 14, 2026

Original release notes: View on vendor site

Published on updatealert.io: Aug 16, 2026