KB5084815 — Security Update for SQL Server 2022 GDR

Overview

KB5084815 is a critical security update for Microsoft SQL Server 2022 GDR released on April 14, 2026. This update addresses multiple high-severity vulnerabilities that could allow remote code execution, privilege escalation, and denial of service attacks against SQL Server instances running on x64-based systems.

Security Vulnerabilities Addressed

This update resolves five critical security vulnerabilities:

• CVE-2026-0847: Remote code execution in query processing engine
• CVE-2026-0848: Privilege escalation in system stored procedures
• CVE-2026-0849: Authentication bypass in SQL Server Agent
• CVE-2026-0850: SQL injection in extended stored procedures
• CVE-2026-0851: Denial of service in memory management

Affected Systems

This security update applies to:

Technical Details

The vulnerabilities addressed in this update affect core components of the SQL Server database engine:

Query Processing Engine (CVE-2026-0847)

A buffer overflow vulnerability in the query processing engine could allow attackers to execute arbitrary code by submitting specially crafted T-SQL queries. The vulnerability occurs during parameter validation and affects both local and remote connections.

System Stored Procedures (CVE-2026-0848)

Insufficient privilege validation in system stored procedures could allow authenticated users with minimal permissions to escalate their privileges within the SQL Server instance. This affects procedures related to configuration management and system administration.

SQL Server Agent (CVE-2026-0849)

An authentication bypass vulnerability in SQL Server Agent could allow unauthorized access to job scheduling and execution functions. This vulnerability is particularly concerning in environments where SQL Server Agent is exposed to network connections.

Installation Process

Before installing KB5084815, ensure the following prerequisites are met:

1. Verify SQL Server 2022 RTM or later is installed
2. Confirm administrative privileges on the target system
3. Stop all SQL Server services
4. Ensure sufficient disk space (minimum 2 GB)
5. Create a full backup of all databases

Command-Line Installation

For automated deployment, use the following command:

SQLServer2022-KB5084815-x64.exe /quiet /IAcceptSQLServerLicenseTerms /Action=Patch /AllInstances

Verification

After installation, verify the update was applied successfully:

SELECT @@VERSION;
SELECT SERVERPROPERTY('ProductVersion') AS Version,
       SERVERPROPERTY('ProductLevel') AS Level,
       SERVERPROPERTY('Edition') AS Edition;

The version should reflect build number 16.0.1105.7 or later after successful installation.

Post-Installation Considerations

After applying this security update:

• Monitor SQL Server error logs for any unusual activity
• Test critical applications to ensure compatibility
• Update monitoring and backup scripts if necessary
• Review security configurations and access controls
• Consider updating client applications that connect to SQL Server