Microsoft SQL Server SQL Server 2025 Update Version 17.0.1135.8

KB5122770 delivers the September 8, 2026 security update for SQL Server 2025, version 17.0.1135.8. It fixes many vulnerabilities, including multiple CVEs, and includes a known issue affecting linked server queries that use MSDASQL.

• Fixes numerous vulnerabilities across SQL Server 2025, including elevation of privilege, remote code execution, information disclosure, denial of service, and security feature bypass issues.
• CVE-2026-66814, CVE-2026-66816, CVE-2026-66818, CVE-2026-66819, CVE-2026-66820, CVE-2026-67368, CVE-2026-67369, CVE-2026-67370, CVE-2026-67373, CVE-2026-67376, CVE-2026-67378, CVE-2026-67379, CVE-2026-67380, CVE-2026-67381, CVE-2026-67383, CVE-2026-67384, CVE-2026-67385, CVE-2026-67386, CVE-2026-67388, CVE-2026-67389, CVE-2026-67390, CVE-2026-67393, CVE-2026-67624, CVE-2026-67629, CVE-2026-67630, CVE-2026-67631, CVE-2026-67633, CVE-2026-67636, CVE-2026-67638, CVE-2026-67639, CVE-2026-67641, CVE-2026-67642, CVE-2026-67643, CVE-2026-67645, CVE-2026-67648, CVE-2026-68775, CVE-2026-68776, CVE-2026-68777, CVE-2026-68778, CVE-2026-68779, CVE-2026-68780, CVE-2026-68781, CVE-2026-68784, CVE-2026-68785, CVE-2026-68786, CVE-2026-68787, CVE-2026-73028, CVE-2026-73029, CVE-2026-77480, CVE-2026-77481, CVE-2026-77483, CVE-2026-77484, CVE-2026-77485, CVE-2026-77487, CVE-2026-77488, CVE-2026-47297.
• Strengthens security validation in SQL Server Agent, replication stored procedures, Extended Events, PolyBase, and authentication handling, including Microsoft Entra authentication login handling.
• Addresses memory corruption, buffer overflow, and out-of-bounds access issues that could lead to code execution, denial of service, or information disclosure.
• Improves protection of internal event data, audit records, and internal replication data.

• Fixes a known issue where linked server queries that use MSDASQL with a provider string fail with error 7416.
• Improves validation of backup metadata processed by the SQL Server VSS Writer.
• Fixes XML handling issues, including malformed DTD attribute lists and very large OPTION (USE PLAN) XML declarations.
• Fixes query execution issues involving LEFT_SHIFT and RIGHT_SHIFT with specially crafted inputs.
• Fixes In-Memory OLTP issues involving malformed DBCS varchar input, IVS conversion/truncation, and nvarchar(max) streaming with SET TEXTSIZE truncation.
• Improves validation for S3-compatible external storage responses during external data access.
• Fixes SQL Server Agent reliability issues under specific operating conditions.
• Fixes replication stored procedure handling for identifiers, paths, parameters, and special characters.
• Fixes improper input validation issues that could cause memory disclosure, dump generation, or out-of-memory conditions.

• Linked server queries that use the MSDASQL provider and specify a provider string can fail with error 7416 because stricter connection validation may reject some linked server configurations.

• To help secure SQL Server on Windows, enable encryption with Extended Protection.
• Customers who use managed backup should apply this update through the standard SQL Server servicing process.
• A downloadable Excel workbook is available with build summaries and detailed fix lists.
• Bug reference IDs in the fix table can be linked directly using the #bkmk_NNNNNNN bookmark format.

Product Information

Vendor: Microsoft

Product: SQL Server

Product type: Software

Variant: SQL Server 2025

Version: 17.0.1135.8

Vendor information published: Sep 8, 2026

Original release notes: View on vendor site

Published on updatealert.io: Sep 29, 2026