KB5090347 — Security Update for SQL Server 2017 GDR

Overview

KB5090347 is a critical security update for Microsoft SQL Server 2017 GDR released on May 12, 2026. This update addresses five significant security vulnerabilities that could allow attackers to bypass authentication, escalate privileges, execute arbitrary code, access sensitive information, or cause denial of service conditions.

Security Vulnerabilities Addressed

This update resolves the following Common Vulnerabilities and Exposures (CVE) identifiers:

Affected Systems

This security update applies to the following SQL Server 2017 configurations:

Update Details

After installing KB5090347, SQL Server 2017 will be updated to version 14.0.2057.1. This update includes comprehensive security enhancements across multiple components of the database engine.

Authentication Security Improvements

The authentication bypass vulnerability (CVE-2026-26001) was particularly severe as it could allow attackers to gain unauthorized access to SQL Server instances without valid credentials. The fix implements multiple layers of validation in the authentication process and strengthens session management to prevent unauthorized access attempts.

Query Processing Enhancements

The privilege escalation and buffer overflow vulnerabilities in the query processor have been addressed through comprehensive input validation and memory safety improvements. These changes ensure that malformed or malicious queries cannot be used to gain elevated privileges or execute arbitrary code.

Storage Engine Stability

Memory corruption issues in the storage engine have been resolved through improved memory management routines and enhanced error handling. These changes improve overall system stability and prevent potential denial of service conditions.

Deployment Considerations

Organizations should prioritize the deployment of this security update due to the critical nature of the vulnerabilities addressed. The authentication bypass vulnerability in particular poses a significant risk to SQL Server instances that are accessible from untrusted networks.

Testing Recommendations

• Test the update in a development environment that mirrors production
• Verify application compatibility after installation
• Monitor query performance for any degradation
• Test backup and restore operations
• Validate replication functionality if applicable

Rollback Procedures

If issues occur after installation, the update can be uninstalled through Programs and Features in Windows or through the package manager on Linux systems. However, Microsoft recommends addressing any compatibility issues rather than removing the security update due to the critical nature of the vulnerabilities.

Verification Commands

To verify successful installation of the update, use the following commands:

Windows

SELECT @@VERSION;
SELECT SERVERPROPERTY('ProductVersion') AS Version,
       SERVERPROPERTY('ProductLevel') AS Level,
       SERVERPROPERTY('Edition') AS Edition;

Linux

sudo /opt/mssql/bin/mssql-conf get-version

The version should display 14.0.2057.1 after successful installation.