SQL Server October 2026 security updates (CVE-2026-96956 and 21 more) - which build to install, known issues to read first, and a safe rollout

#What's in this round

Released 13 October 2026 for SQL Server 2017, 2019, 2022 and 2025. For SQL Server 2025 the package is KB5126967 (CU9 + GDR), build 17.0.5015.4, which fixes 22 CVEs:

For other versions, find the October 2026 KB for your branch on the SQL Server update centre page. Each KB lists the exact build.

#Known issues to read before installing

The SQL Server 2025 KB lists two known issues (the same ones appeared in the September 2026 updates):

1. MSDASQL linked server queries fail with error 7416 when the linked server uses a provider string (@provstr). See MSDASQL linked server error 7416.
2. Access violation when querying sys.dm_exec_requests while a database is recovering, which creates a dump file. See sys.dm_exec_requests access violation.

If you use MSDASQL linked servers (ODBC-based links to other databases) or run monitoring that polls sys.dm_exec_requests (most monitoring tools do), test those specifically before production.

#1. Pick the right package

SQL Server servicing has two branches:

Check where you are:

SELECT SERVERPROPERTY('ProductVersion')     AS build,
       SERVERPROPERTY('ProductUpdateLevel') AS cu_level,
       SERVERPROPERTY('ProductUpdateReference') AS kb;

Once you've installed a CU, you can't go back to the GDR branch without uninstalling.

#2. Pre-checks

• Full backups (and log backups) completed and restorable.
• Enough free disk on the system drive for the installer.
• For AGs: all replicas healthy and synchronised; note the current primary.
• Agent jobs that run during the window paused or moved.
• Test server patched first with your monitoring tool connected (it exercises the DMV issue).

#3. Patch an availability group

1. Patch secondary replicas first, one at a time. Set them to manual failover if your AG uses automatic failover with only two synchronous replicas.
2. Confirm each secondary is back and synchronised:

SELECT ar.replica_server_name, drs.database_id, drs.synchronization_state_desc, drs.synchronization_health_desc
FROM sys.dm_hadr_database_replica_states drs
JOIN sys.availability_replicas ar ON ar.replica_id = drs.replica_id;

3. Fail over to a patched synchronous secondary.
4. Patch the old primary.
5. Optionally fail back; restore automatic failover settings.

Avoid querying sys.dm_exec_requests for databases in recovery during the failover window; that's when the known access violation can fire.

#4. After installing

SELECT @@VERSION;
SELECT name, state_desc FROM sys.databases WHERE state_desc <> 'ONLINE';

• Check the SQL Server error log and the \Log\ folder for new dump files.
• Run a test query through each linked server.
• Confirm Agent jobs ran on schedule after the window.

#Checklist

• Correct package for GDR or CU branch identified
• Known issues reviewed against MSDASQL and DMV use
• Patched on a test server with monitoring connected
• AG secondaries first, then failover, then old primary
• Build, database state, dump files and linked servers checked afterwards

#Sources

• KB5126967 - Security update for SQL Server 2025 CU9 (13 Oct 2026)
• DBA Services: October 2026 SQL Server security updates