Microsoft SQL Server SQL Server 2025 Update Version 17.0.4060.2

KB5101346 updates SQL Server 2025 to version 17.0.4060.2 and addresses multiple security vulnerabilities, including CVE-2026-54117 and CVE-2026-54118. It also includes fixes for linked server validation, memory leaks, replication input handling, and SQL Agent injection issues.

• Fixes insecure deserialization in MessageQueueTask to prevent remote code execution from untrusted MSMQ messages by removing legacy BinaryMessageFormatter support.
• Restricts SoapFormatter deserialization in MessageQueueTask with an allow-list binder to prevent remote code execution from untrusted MSMQ messages.
• Prevents unintended EXECUTE permission inheritance for EXTERNAL MODEL objects when a principal ID is reused.
• Fixes a vector intrinsic memory disclosure issue affecting VECTOR_DISTANCE, VECTOR_NORM, and VECTOR_NORMALIZE for low-privilege authenticated users.
• Addresses input validation and sanitization for a parameter passed to an internal replication stored procedure.
• Fixes an SQL injection issue in SQL Server that could allow an authenticated attacker to elevate privileges over a network.
• CVE-2026-47295
• CVE-2026-47296
• CVE-2026-50468
• CVE-2026-54116
• CVE-2026-54117
• CVE-2026-54118
• CVE-2026-55002

• Fixes a memory leak when sys.dm_exec_input_buffer or DBCC INPUTBUFFER is used.

• Linked server queries that use MSDASQL with a provider string (@provstr) can fail with error 7416 due to stricter connection validation.

• For SQL Server on Windows, Microsoft recommends enabling encryption with Extended Protection.
• Applies to SQL Server 2025 on Windows and Linux, all editions.
• A downloadable Excel workbook with build and fix details is referenced in the release notes.

Product Information

Vendor: Microsoft

Product: SQL Server

Product type: Software

Variant: SQL Server 2025

Version: 17.0.4060.2

Vendor information published: Jul 14, 2026

Original release notes: View on vendor site

Published on updatealert.io: Sep 29, 2026