AxioWorks

Line illustration of a database server, security shield, and patch validation checklist

Microsoft’s 13 October 2026 SQL Server security updates cover multiple versions and branches. Check the correct build, review the SQL Server 2019 MSDASQL linked-server note, and use this rollout checklist.

SQL Server October 2026 Security Updates: Builds and Linked Server Checks

Microsoft released SQL Server security updates on 13 October 2026 for several supported versions. The packages address multiple vulnerabilities, including remote code execution, elevation of privilege, denial of service, and information disclosure issues. Database administrators should identify the right servicing branch, apply the matching update, and test the SQL Server features their applications depend on.

October update builds to check

Microsoft lists these October 13 builds:

  • SQL Server 2025 CU9 GDR: 17.0.5015.4 (KB5126967).
  • SQL Server 2022 CU27 GDR: 16.0.4305.5 (KB5126934).
  • SQL Server 2019 GDR: 15.0.2200.2 (KB5128495).
  • SQL Server 2019 CU32 GDR: 15.0.4500.2 (KB5128494).

This is not a complete list of every version or update path. Confirm the package for your installation using Microsoft’s SQL Server servicing model guidance and the matching KB: 2025 CU9 KB5126967, 2022 CU27 KB5126934, 2019 GDR KB5128495, or 2019 CU32 GDR KB5128494.

Identify the version and servicing branch

Collect the build from each instance, including test, reporting, and secondary replicas. This query gives a quick starting point:

SELECT
    SERVERPROPERTY('ProductVersion') AS ProductVersion,
    SERVERPROPERTY('ProductLevel') AS ProductLevel,
    SERVERPROPERTY('ProductUpdateLevel') AS ProductUpdateLevel,
    SERVERPROPERTY('ProductUpdateReference') AS ProductUpdateReference;

SQL Server updates can follow different servicing branches, including General Distribution Release (GDR) and cumulative update (CU) servicing. Match the package to the instance’s installed branch and update history; do not select a package based only on the SQL Server year.

Test MSDASQL linked servers on SQL Server 2019 GDR

The SQL Server 2019 GDR KB5128495 documents a linked-server case in which queries using the MSDASQL provider and a provider string can fail with error 7416 because of stricter connection validation. If your SQL Server 2019 GDR instances use MSDASQL linked servers, include those queries and login mappings in pre-production testing and review the current KB notes before rollout. This is a documented configuration-specific issue, not a claim that every linked server is affected.

A practical patch rollout

  1. Inventory: record version, build, operating system, servicing branch, high-availability role, and application dependencies.
  2. Review: read the matching KB for prerequisites, supported platforms, security details, and known issues.
  3. Test: exercise application queries, SQL Agent jobs, backup and restore, and replication, availability-group failover, or linked servers where used.
  4. Plan: agree a maintenance window, confirm recoverable backups, and document the rollback or failover procedure.
  5. Verify: check the resulting build, service health, error logs, application connections, and scheduled jobs.

A patch plan is complete when both the target build and application behavior have been checked. If SQL Server supports reporting that depends on SharePoint data, include data freshness checks too; see our guide to monitoring SharePoint-to-SQL Server synchronisation after go-live.

Official references

From the blog