Microsoft SQL Server SQL Server 2025 Update Version 17.0.4085.5

KB5122769 updates SQL Server 2025 to version 17.0.4085.5 and addresses many security vulnerabilities, including multiple CVEs affecting elevation of privilege, remote code execution, information disclosure, denial of service, and security feature bypass.

• Fixes numerous vulnerabilities in SQL Server 2025, including elevation of privilege, remote code execution, information disclosure, denial of service, and security feature bypass issues.
• CVE-2026-66814, CVE-2026-66816, CVE-2026-66818, CVE-2026-66819, CVE-2026-66820
• CVE-2026-67368, CVE-2026-67369, CVE-2026-67370, CVE-2026-67373, CVE-2026-67376
• CVE-2026-67378, CVE-2026-67379, CVE-2026-67380, CVE-2026-67381, CVE-2026-67383
• CVE-2026-67384, CVE-2026-67385, CVE-2026-67386, CVE-2026-67388, CVE-2026-67389
• CVE-2026-67390, CVE-2026-67393, CVE-2026-67624, CVE-2026-67629, CVE-2026-67630
• CVE-2026-67631, CVE-2026-67633, CVE-2026-67636, CVE-2026-67638, CVE-2026-67639
• CVE-2026-67641, CVE-2026-67642, CVE-2026-67643, CVE-2026-67645, CVE-2026-67648
• CVE-2026-68775, CVE-2026-68776, CVE-2026-68777, CVE-2026-68778, CVE-2026-68779
• CVE-2026-68780, CVE-2026-68781, CVE-2026-68784, CVE-2026-68785, CVE-2026-68786
• CVE-2026-68787, CVE-2026-73028, CVE-2026-73029, CVE-2026-77480, CVE-2026-77481
• CVE-2026-77483, CVE-2026-77484, CVE-2026-77485, CVE-2026-77487, CVE-2026-77488
• CVE-2026-47297
• Strengthens security validation in SQL Server Agent, Microsoft Entra authentication handling, Extended Events, replication stored procedures, and backup metadata processing.
• Improves protection against memory corruption, buffer overflows, and unsafe deserialization in several SQL Server components.

• Fixes linked server query failures with MSDASQL that can return error 7416.
• Fixes an access violation when querying sys.dm_exec_requests during database recovery.
• Fixes arithmetic overflow and out-of-bounds memory access in LEFT_SHIFT and RIGHT_SHIFT functions.
• Fixes XML handling issues, including DTD attribute list processing and large OPTION (USE PLAN) XML declarations.
• Fixes replication issues involving identifier handling, metadata validation, path values, and Change Event Streaming deserialization.
• Fixes In-Memory OLTP issues involving malformed DBCS input, _VSS collation handling, and nvarchar(max) truncation.
• Fixes SQL dump generation and process termination issues in query execution, XML, and replication scenarios.
• Fixes audit record population for data_sensitivity_information in SCHEMA_OBJECT_ACCESS_GROUP.

• Linked server queries that use MSDASQL with a provider string can fail with error 7416.
• Queries against sys.dm_exec_requests may raise an access violation during database recovery.
• Mitigation for the recovery-related access violation includes enabling trace flag 4696, avoiding affected queries, or uninstalling the update.

• For SQL Server on Windows, Microsoft recommends enabling encryption with Extended Protection.
• Customers using SQL Server managed backup to Azure should apply this update through the standard SQL Server servicing process.
• A downloadable Excel workbook with build and fix details is available from the release notes.
• The update applies to SQL Server 2025 on Windows and Linux, all editions.

Product Information

Vendor: Microsoft

Product: SQL Server

Product type: Software

Variant: SQL Server 2025

Version: 17.0.4085.5

Vendor information published: Sep 8, 2026

Original release notes: View on vendor site

Published on updatealert.io: Sep 29, 2026