Microsoft has published KB5101346 for SQL Server 2025, delivering CU6 + GDR on build 17.0.4060.2. The update is a security release that includes seven verified fixes and addresses several vulnerabilities across the Database Engine, Integration Services, replication, and SQL Agent.

For teams running SQL Server 2025, the update is notable not just for the version bump but for the mix of engine, programmability, and security-related changes it brings together in one package.

Known issues

Microsoft documents one known issue in this release:

  • Linked server queries that use MSDASQL and specify a provider string can fail with Msg 7416: Access to the remote server is denied because no login-mapping exists. The documented behavior is tied to a stricter connection validation check in the Database Engine for certain linked server configurations. Microsoft also notes that the issue has its own article with more information and workarounds.

Improvements and fixes

This update contains 7 verified fixes.

Integration Services

Two fixes target MessageQueueTask in Integration Services on Windows. Microsoft says these changes remove or restrict unsafe deserialization paths involving Microsoft Message Queuing (MSMQ) messages:

  • Support for the legacy BinaryMessageFormatter (2000 format) is removed.
  • SoapFormatter deserialization is restricted with an allow-list binder.

SQL Server Engine

Several fixes apply to the Database Engine across Linux and Windows:

  • Metadata: prevents unintended EXECUTE permission inheritance for EXTERNAL MODEL objects when a newly created principal reuses the ID of a previously existing principal.
  • Programmability: addresses a vector-intrinsics issue involving VECTOR_DISTANCE, VECTOR_NORM, and VECTOR_NORMALIZE that could leak sqlservr.exe process memory to low-privilege authenticated users when the distance metric or norm algorithm is specified as varchar(max).
  • Query Execution: resolves a memory leak that can occur when using sys.dm_exec_input_buffer or DBCC INPUTBUFFER.
  • Replication: improves input validation and sanitization for a parameter passed to an internal replication stored procedure.

SQL Agent

  • A fix in SQL Agent addresses SQL injection behavior where improper neutralization of special elements in SQL Server commands could allow an authenticated attacker to elevate privileges over a network.

Release details

  • KB: KB5101346
  • Update name: CU6 + GDR
  • SQL Server version: 2025
  • Build: 17.0.4060.2
  • Official release date: 2026-07-14

Microsoft describes this release as a security update that contains fixes and resolves vulnerabilities across SQL Server components.

Official source