Microsoft SQL Server SQL Server 2022 Update Version 16.0.4265.3

KB5093420 delivers Cumulative Update 26 for Microsoft SQL Server 2022, including 12 fixes after CU25. It also includes a SQL injection vulnerability fix in `sys.sp_MSforeachdb` and security guidance to enable Extended Protection on Windows.

• Fixes a SQL injection vulnerability in sys.sp_MSforeachdb that could allow an authorized attacker to elevate privileges over the network.
• Removes the deprecated RSA32Lib cryptographic library as part of cryptography modernization.
• Security guidance: enable encryption with Extended Protection on SQL Server for Windows.

• Adds more detailed error information to the Windows Server Failover Cluster log when the availability group resource DLL cannot retrieve diagnostic column information.
• Adds support for removing an IP address from an availability group listener with ALTER AVAILABILITY GROUP ... MODIFY LISTENER ... REMOVE IP.
• Fixes an index rebuild maintenance plan that can stop responding because of a long-running query.
• Fixes intermittent failures in monitoring queries that use sys.dm_exec_requests or sys.sysprocesses on a secondary replica, returning errors 976 or 978.
• Fixes cardinality estimator interpolation for very large values that could cause ALTER INDEX to choose a serial plan.
• Fixes an access violation during ALTER PARTITION FUNCTION ... SPLIT RANGE for certain partitioned tables and schema-bound views.
• Fixes a nonyielding scheduler condition when SQL Server writes certain errors to the error log.
• Adjusts incremental statistics sampling when the last sampling rate was 100% and many new rows are inserted.
• Improves memory management during query compilation for columnstore indexes to reduce compilation time.
• Fixes a nonyielding scheduler condition when sys.dm_db_index_operational_stats iterates through many cached heaps or B-trees.

• Supports removing an IP address from an availability group listener using ALTER AVAILABILITY GROUP ... MODIFY LISTENER ... REMOVE IP.

• Queries that use SESSION_CONTEXT in parallel plans might return incorrect results or trigger access violation dump files, especially when the session is reset for reuse.
• Linked server queries that use MSDASQL with a provider string can fail with error 7416 due to stricter connection validation.
• Queries against sys.dm_exec_requests during database recovery can raise an access violation and generate a dump file.
• For the recovery-related access violation, Microsoft recommends trace flag 4696, avoiding sys.dm_exec_requests queries on recovering databases, or uninstalling the update.

• A downloadable Excel workbook is available with build summaries and detailed fix lists for SQL Server 2022, SQL Server 2019, and SQL Server 2017.
• Bug reference IDs in the table can be linked directly via bookmark tags in the URL.
• The update includes components for SQL Server Engine and Analysis Services; the listed SQL Server 2022 build is 16.0.4265.3.
• For the recovery-related access violation, enable trace flag 4696 to opt out of the code change, avoid querying sys.dm_exec_requests on recovering databases, or uninstall the update.

Product Information

Vendor: Microsoft

Product: SQL Server

Product type: Software

Variant: SQL Server 2022

Version: 16.0.4265.3

Vendor release date: Jul 16, 2026

Original release notes: View on vendor site

Published on updatealert.io: Aug 16, 2026