Microsoft has released SQL Server 2022 CU26 + GDR (KB5122768), version 16.0.4275.2. This is a security update that includes 40 fixes and addresses a broad set of SQL Server areas, including SQL Server Agent, replication, PolyBase, XML processing, query execution, backup and restore, and the SQL Server management and security stack.

The update notes also list multiple security advisories, covering issues such as elevation of privilege, security feature bypass, denial of service, remote code execution, and information disclosure. Microsoft’s release details group the changes into both security-oriented fixes and product behavior improvements.

Known issues

Microsoft lists two known issues with this release:

  • Linked server queries that use MSDASQL can fail with error 7416 when a provider string (@provstr) is specified. Microsoft says a stricter connection validation check in the Database Engine can reject some linked server configurations that use the MSDASQL provider, even if earlier builds allowed them.
  • Queries against sys.dm_exec_requests can raise an access violation during database recovery. Microsoft says this can happen during RESTORE, startup recovery, or before an availability group replica finishes coming online. Microsoft is investigating a fix.

Improvements and fixes

The 40 verified fixes span several practical areas:

  • SQL Server Agent: validation and reliability/security updates for task-agent component loading and specific input processing.
  • Replication: multiple fixes for identifier handling, input validation, caller-supplied path values, metadata processing, and protection of internal replication data.
  • In-Memory OLTP: corrections for malformed input handling, _VSS collation conversions, and NVARCHAR(MAX) streaming cases that could lead to memory corruption or the server stopping.
  • PolyBase: improved validation for S3-compatible external storage responses, configuration processing, and raw TCP listener behavior in a deprecated feature path.
  • XML and query execution: fixes for XML reader integer overflow, large OPTION (USE PLAN) XML handling, LEFT_SHIFT/RIGHT_SHIFT overflow and out-of-bounds access issues, and other input-validation improvements.
  • Backup and restore: safer validation of backup metadata processed by the SQL Server VSS Writer.
  • Security infrastructure and programmability: updates to Microsoft Entra authentication login handling, internal event data processing, audit record population, and CLR-related SqlDataRecord.SetBytes validation.

A few representative fixes include:

  • stronger validation in SQL Server Agent and WMI Management Provider (SqlMgmProvider),
  • multiple replication fixes for special characters, long identifiers, and metadata validation,
  • safer handling of malformed XML and query execution inputs,
  • and updates to Extended Events, Query Store, and backup restore processing.

Taken together, this CU26 + GDR release is notable for combining security updates with a wide spread of engine fixes across features that many administrators and developers rely on regularly.

Official source