Microsoft has released SQL Server 2022 KB5077464, a CU23 + GDR security update that moves SQL Server to build 16.0.4240.4. According to Microsoft, the release contains 2 fixes and addresses security vulnerabilities in SQL Server components.

The update specifically calls out fixes in the SQL Server engine for merge replication and security infrastructure. For teams running SQL Server 2022, this is a targeted update that is useful to track because it changes security-related behavior in both Windows-only and cross-platform scenarios.

Improvements and fixes

Microsoft lists 2 verified fixes in this release:

  • Replication on Windows: fixes an elevation of privilege vulnerability in the version upgrade process for merge replication. This item is tracked as bug reference 4945509.
  • Security infrastructure on Linux and Windows: blocks the ALTER USER operation when the target login is the system Administrator account. This item is tracked as bug reference 4934194.

Microsoft also says the update resolves vulnerabilities, and it references the following advisories:

  • CVE-2026-21262 — SQL Server Elevation of Privilege Vulnerability
  • CVE-2026-26115 — SQL Server Elevation of Privilege Vulnerability

Known issues

Microsoft did not list any known issues for this update.

Build information

  • Product version: SQL Server 2022
  • Build number: 16.0.4240.4
  • KB article: KB5077464
  • Update type: Security
  • Release name: CU23 + GDR

Official source