Microsoft has released SQL Server 2019 CU32 + GDR (KB5084816), a security update that updates SQL Server 2019 to build 15.0.4465.1. The package combines two fixes tied to security-related behavior and includes a documented known issue affecting certain linked server connections.
The release notes describe the update as containing fixes and resolving vulnerabilities. Microsoft also identifies two SQL Server security advisories associated with the release:
- CVE-2026-32167
- CVE-2026-32176
Improvements and fixes
Microsoft lists 2 fixes in this update.
The fixes are split across two areas:
- SQL Server Engine / Linked Server on Linux and Windows: a fix for an elevation of privilege vulnerability in SQL Server linked servers, where a low-privileged SQL Server user could gain sysadmin permissions. Microsoft associates this fix with bug reference 5034282.
- SQL Server Engine / SQL Agent on Windows: a fix for an issue involving improper neutralization of special elements in SQL commands, described by Microsoft as a SQL injection condition that could allow an authorized attacker to elevate privileges over a network. Microsoft associates this fix with bug reference 4999189.
Known issues
Microsoft documents one known issue in this release:
- Linked server queries that use MSDASQL can fail with error 7416 when a provider string (
@provstr) is specified. Microsoft says these connections may be rejected by a stricter validation check in the Database Engine, even if earlier builds allowed them.
Microsoft does not list a workaround in the packet. A source-page removal would not, by itself, prove the issue was resolved.
Release details
- KB: KB5084816
- Update name: CU32 + GDR
- Product version: SQL Server 2019
- Build: 15.0.4465.1
- Official release date: 2026-04-14