SQL Server 2016 Extended Security Updates: Stay Protected While You Modernize
SQL Server 2016 reaches the end of extended support on July 14, 2026. After that date, instances that remain on SQL Server 2016 no longer receive regular security updates unless they are covered through Extended Security Updates (ESUs)). ESUs provide a time-bound security bridge for customers who need to maintain existing workloads while they upgrade to a supported SQL Server release or modernize to Azure SQL. SQL Server 2016 Extended Security Updates can be managed across multiple deployment models, including SQL Server enabled by Azure Arc for on-premises and other clouds, and SQL Server on Azure Virtual Machines. This provides a consistent protection path while customers assess modernization options and operational readiness. Today, we are making the Extended Security Updates subscription experience available in Azure so customers can enroll ahead of SQL Server 2016 reaching end of support, and be ready to receive Extended Security Updates when they are released. Why this matters now SQL Server follows a fixed lifecycle policy with mainstream support followed by extended support. Once SQL Server 2016 exits extended support, Extended Security Updates become the only for continued security coverage on that version. Extended Security Updates are intended as a temporary option for risk reduction, not as a long-term alternative to upgrade or modernization. For many production environments, the constraint is not awareness of the deadline but the complexity of the upgrade path. Application dependencies, validation requirements, change windows, and compliance controls sometimes make immediate migration impractical. Extended Security Updates help teams maintain security coverage during that transition period while they sequence remediation, testing, and platform changes. How SQL Server 2016 Extended Security Updates work Support window: SQL Server 2016 exits extended support on July 14, 2026. Extended Security Updates are available for up to three additional years, with coverage periods defined by the SQL Server 2016 lifecycle schedule through July 17, 2029. Supported scope and update model Eligible versions: SQL Server 2016. Extended Security Updates are also available for SQL Server 2014 until July 12, 2027. Eligible editions: Standard and Enterprise Update content: Extended Security Updates deliver critical security updates when applicable. They do not include new features, non-security bug fixes, non-critical security updates, or design changes. Operational note: SQL Server ESUs are not published on a fixed monthly cadence. They are released when qualifying vulnerabilities require a release. For Azure Arc-connected environments, Extended Security Updates subscriptions can be aligned to the deployment model, including virtual cores for VM-based deployments and physical cores for host-based scenarios. This gives organizations flexibility to match ESU coverage to how SQL Server is deployed and managed. How to acquire Extended Security Updates coverage Customers can acquire SQL Server ESU coverage in different ways depending on where SQL Server is running and how they prefer to purchase. For on-premises, edge, and other cloud environments, SQL Server enabled by Azure Arc provides the control plane to onboard instances, manage eligibility, and apply ESU subscription settings. For workloads already running on Azure Virtual Machines, customers can subscribe to ESU coverage through Azure-based controls. Customers can purchase that coverage as pay-as-you-go through Azure or through Volume Licensing on an annual basis for eligible licenses with active Software Assurance. When customers choose Volume Licensing, Azure Arc registration is still required to activate access to ESUs. SQL Server enabled by Azure Arc: Use Azure Arc to onboard eligible SQL Server instances outside Azure, manage Extended Security Updates subscription settings, and support both connected and qualifying disconnected scenarios. SQL Server on Azure Virtual Machines: Use Azure-based controls to subscribe to Extended Security Updates coverage for workloads running on Azure Virtual Machines. For SQL Server 2016, this now requires a paid ESU subscription rather than the previous no-additional-cost experience. Supported regions: Subscribing to Extended Security Updates for SQL Server on Azure VMs is only available in the supported regions listed. To subscribe to ESUs in an unsupported region, contact Microsoft Support to determine the appropriate ESU acquisition path. Volume Licensing: If you cannot subscribe to Extended Security Updates via Azure Arc, you can purchase through the Volume Licensing channel on an annual basis for eligible licenses with active Software Assurance. Talk to your Microsoft seller for more information. Azure Arc registration is still required to activate access to ESUs. Migrate to Azure SQL: Customers that are ready to modernize further can move to Azure SQL Database or Azure SQL Managed Instance, which removes Extended Security Updates dependency by moving to fully supported, cloud-managed SQL services. The following diagram summarizes how customers can obtain SQL Server 2016 Extended Security Updates coverage through Azure Arc and Azure Virtual Machines. What to do next Organizations still running SQL Server 2016 should use the remaining support window to assess estate readiness, determine the right Extended Security Updates subscription model, and define the target modernization path for each workload. For some environments, that means upgrading in place to a supported SQL Server version. For others, it means migrating and upgrading to Azure Virtual Machines or Azure SQL to simplify long-term operations. The important step is to make the transition plan executable before support ends. Learn more SQL Server end of support options SQL Server Extended Security Updates enabled by Azure Arc SQL Server enabled by Azure Arc Extend support for SQL Server with Azure VM SQL Server on Azure VM overview Migrate to Azure SQL
Cumulative Update #6 for SQL Server 2025 RTM
The 6th cumulative update release for SQL Server 2025 RTM is now available for download at the Microsoft Downloads site. Please note that registration is no longer required to download Cumulative updates. To learn more about the release or servicing model, please visit: CU6 KB Article: https://learn.microsoft.com/troubleshoot/sql/releases/sqlserver-2025/cumulativeupdate6 Starting with SQL Server 2017, we adopted a new modern servicing model. Please refer to our blog for more details on Modern Servicing Model for SQL Server Microsoft® SQL Server® 2025 RTM Latest Cumulative Update: https://www.microsoft.com/download/details.aspx?familyid=69e0b8fc-1c50-41bd-a576-b9c66b2f302a Update Center for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates
Cumulative Update #5 for SQL Server 2025 RTM
The 5th cumulative update release for SQL Server 2025 RTM is now available for download at the Microsoft Downloads site. Please note that registration is no longer required to download Cumulative updates. To learn more about the release or servicing model, please visit: CU5 KB Article: https://learn.microsoft.com/troubleshoot/sql/releases/sqlserver-2025/cumulativeupdate5 Starting with SQL Server 2017, we adopted a new modern servicing model. Please refer to our blog for more details on Modern Servicing Model for SQL Server. Microsoft® SQL Server® 2025 RTM Latest Cumulative Update: https://www.microsoft.com/download/details.aspx?familyid=69e0b8fc-1c50-41bd-a576-b9c66b2f302a Update Center for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2016 SP3
The Security Update for SQL Server 2016 SP3 GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2016 SP3, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-40370 - Security Update Guide - Microsoft - SQL Server Remote Code Execution Vulnerability Security Update of SQL Server 2016 SP3 GDR KB Article: KB5089271 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=07b113c3-1315-444e-b442-b0297f0cebe1 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5089271 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2016 SP3 Azure Connect Feature Pack
The Security Update for SQL Server 2016 SP3 Azure Connect Feature Pack is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2016 SP3 Azure Connect Feature Pack, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-40370 - Security Update Guide - Microsoft - SQL Server Remote Code Execution Vulnerability Security Update of SQL Server 2016 SP3 Azure Connect Feature Pack KB Article: KB5089270 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=f9014a03-feca-41c1-bc64-fb801e0e9799 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5089270 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2017 RTM
The Security Update for SQL Server 2017 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2017 RTM, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-40370 - Security Update Guide - Microsoft - SQL Server Remote Code Execution Vulnerability Security Update of SQL Server 2017 RTM GDR KB Article: KB5090347 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=09c81e42-2942-4fb8-b84b-f0905fcd3b33 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5090347 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2017 RTM CU31
The Security Update for SQL Server 2017 RTM CU31 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2017 RTM CUs, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-40370 - Security Update Guide - Microsoft - SQL Server Remote Code Execution Vulnerability Security Update of SQL Server 2017 RTM CU31 KB Article: KB5090354 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=3d1a0db7-cdd3-4021-be11-73f43c870fac Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5090354 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2019 RTM
The Security Update for SQL Server 2019 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2019 RTM, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-40370 - Security Update Guide - Microsoft - SQL Server Remote Code Execution Vulnerability Security Update of SQL Server 2019 RTM GDR KB Article: KB5090408 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=ad8a836a-cf79-44c9-b361-d94a8fe698e1 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5090408 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2019 RTM CU32
The Security Update for SQL Server 2019 RTM CU32 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2019 RTM CUs, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-40370 - Security Update Guide - Microsoft - SQL Server Remote Code Execution Vulnerability Security Update of SQL Server 2019 RTM CU32 KB Article: KB5090407 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=bb9b5d10-84c4-4cca-85bf-abb93a453f57 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5090407 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2022 RTM
The Security Update for SQL Server 2022 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2022 RTM, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-40370 - Security Update Guide - Microsoft - SQL Server Remote Code Execution Vulnerability Security Update of SQL Server 2022 RTM GDR KB Article: KB5091158 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=9edbb614-c56a-4c5a-b4dc-157d4036f44c Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5091158 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates
