Microsoft has released SQL Server 2022 CU24 + GDR (KB5089900) for build 16.0.4252.3. The update package contains one verified fix and also documents a known issue affecting some linked server queries that use MSDASQL.
This release is described as a security update that includes fixes and resolves vulnerabilities, and Microsoft ties it to CVE-2026-40370, a SQL Server remote code execution vulnerability.
Known issues
Microsoft says linked server queries can fail when they use MSDASQL (OLE DB Provider for ODBC Drivers) and include a provider string (@provstr). In those cases, the query can return:
Msg 7416, Level 16 Access to the remote server is denied because no login-mapping exists.
Microsoft attributes this to a stricter connection validation check in the Database Engine that can reject some linked server configurations using MSDASQL, even if earlier builds accepted them.
Improvements and fixes
This update includes 1 verified fix:
- Integration Services on Windows: Microsoft says it addresses an XML external entity (XXE) issue in the Web Service Task. The documented behavior could allow an attacker to read arbitrary files from the local file system or trigger a denial-of-service (DoS) attack. The fix is tracked as bug 5175271.
For DBAs and developers, the practical takeaway is that this CU/GDR release is relatively narrow in scope: one documented security-related fix in Integration Services, plus a separate linked server compatibility issue to be aware of when using MSDASQL configurations.