Microsoft SQL Server SQL Server 2017 Update Version 14.0.2120.1

KB5102338 updates SQL Server 2017 to build 14.0.2120.1 and fixes multiple security issues, including CVE-2026-47295, CVE-2026-47296, CVE-2026-54118, and CVE-2026-55002. It also addresses a linked server validation issue and several engine and integration fixes.

• Fixes CVE-2026-47295, CVE-2026-47296, CVE-2026-54118, and CVE-2026-55002 affecting SQL Server 2017.
• Resolves an insecure deserialization issue in MessageQueueTask that could allow remote code execution from untrusted MSMQ messages.
• Addresses an SQL injection issue in SQL Server Agent that could let an authenticated attacker elevate privileges over the network.
• Adds input validation and sanitization for a parameter passed to an internal replication stored procedure.

• Fixes a memory leak when using sys.dm_exec_input_buffer or DBCC INPUTBUFFER.
• Resolves a linked server validation issue that can cause MSDASQL queries with @provstr to fail with error 7416.

• Linked server queries that use MSDASQL with a provider string (@provstr) may fail with error 7416 due to stricter connection validation.

• To apply this update, SQL Server 2017 or a later SQL Server 2017 GDR release must already be installed.
• Microsoft recommends enabling encryption with Extended Protection to help secure SQL Server on Windows.
• The update is available through Windows Update, Microsoft Update Catalog, and Microsoft Download Center.
• Installing the update is optional for computers that do not host Microsoft SQL Server Reporting Services.

• Microsoft Download Center package
  https://www.microsoft.com/en-us/download/details.aspx?id=???
• Microsoft Update Catalog
  https://www.catalog.update.microsoft.com/

Product Information

Vendor: Microsoft

Product: SQL Server

Product type: Software

Variant: SQL Server 2017

Version: 14.0.2120.1

Vendor information published: Jul 14, 2026

Original release notes: View on vendor site

Published on updatealert.io: Aug 16, 2026