Microsoft has released SQL Server 2025 CU2 + GDR (KB5077466), which updates SQL Server to build 17.0.4020.2. The update is categorized as a security release and includes three verified fixes.

The release notes describe changes in the SQL Server engine that address security-related behavior in internal metadata handling, merge replication upgrade processing, and user-management checks involving the system Administrator account.

Improvements and fixes

KB5077466 includes 3 fixes across the SQL Server Engine:

  • Internal System Metadata: removes an internal system stored procedure to fix a potential SQL injection vulnerability.
  • Replication: addresses an elevation of privilege vulnerability in the version upgrade process for merge replication.
  • Security Infrastructure: blocks the ALTER USER operation when the target login is the system Administrator account.

These fixes are documented with bug references 4991631, 4973077, and 4992231.

Known issues

Microsoft lists no known issues for this release.

Build information

  • KB: KB5077466
  • Update name: CU2 + GDR
  • Product version: SQL Server 2025
  • Build number: 17.0.4020.2
  • File version: 2025.170.4020.2

Official source