Overview

Microsoft released Cumulative Update 7 (CU7) for SQL Server 2025 on 16 July 2026. This update brings the product to build 17.0.4065.4 and packages 10 fixes issued since CU6. It covers the SQL Server Engine and Integration Services, and also updates Analysis Services to version 17.0.25.223.

If you are running any earlier build of SQL Server 2025, compare your current version against 17.0.4065.4. The fixes in this release include multiple JSON engine corrections, encryption upgrades, an SSIS security patch, and a stability fix for availability group monitoring. Several of these warrant prompt attention.

The KB article is KB5096981 and the download is available without registration from the Microsoft Download Centre.

What's in This Update

JSON Engine Fixes (Three Separate Issues)

This release contains three distinct fixes for the SQL Server JSON engine, and they are serious enough to treat as a group.

ALTER JSON INDEX REORGANIZE dump (bug 5349316): If you run ALTER JSON INDEX ... REORGANIZE on a JSON index that also has statistics on its internal table, SQL Server generates a dump file. This is a straightforward crash path triggered by a routine maintenance operation.

JSON_MODIFY node offset corruption (bug 5354186): The node parent offset inside the JSON binary representation was being calculated incorrectly during a JSON_MODIFY call. The result is silent JSON document corruption - the data written back to the column is structurally wrong, which can cause downstream reads to return incorrect results or fail entirely.

JSON_MODIFY merge operation corruption and dump (bug 5355051): A separate code path in JSON_MODIFY, specifically the merge operation, could also produce corruption and trigger a dump file. This is a different root cause from bug 5354186 but has the same class of consequence.

If your environment uses JSON indexes or JSON_MODIFY, these three fixes alone make CU7 worth scheduling promptly.

Security Hardening

UCS encryption upgraded to AES-256 (bug 5271098): The Universal Communication Stack (UCS) previously used AES-128 when TLS was not explicitly enabled. This fix upgrades that default to AES-256, bringing it in line with current cryptographic standards without requiring any configuration change.

Service Broker dialog encryption upgraded to AES-256 (bug 5293307): Service Broker dialog security has been strengthened by switching from a weaker algorithm to AES-256. If you use Service Broker for inter-database or inter-instance messaging, encrypted dialogs now use a stronger cipher.

EDIT_DISTANCE denial-of-service prevention (bug 5295512): The EDIT_DISTANCE function lacked logical capping on its input processing, meaning an authenticated user could craft a query that caused an overflow and crashed the SQL Server process. This fix adds bounds checking to prevent that. Because it requires an authenticated login to exploit, the risk is lower than an unauthenticated vector, but it is still a denial-of-service path worth closing.

SSIS Message Queue task remote code execution fix (bug 5295713): The Integration Services Message Queue task supported the legacy BinaryMessageFormatter (the 2000 format). Deserialising untrusted MSMQ messages using this formatter could allow remote code execution. Support for this formatter has been removed. If you have SSIS packages that use the Message Queue task with the binary formatter, those packages will need to be reviewed before applying this update.

TLS 1.3 trace flag for Windows (bug 5290707): A new trace flag is introduced that allows TLS 1.3 to be enabled for SQL Server on Windows without editing the registry directly. This is an operational improvement rather than a vulnerability fix, but it simplifies hardening for environments that need TLS 1.3.

High Availability and Disaster Recovery

Monitoring queries failing on read-intent secondary replicas (bug 5216512): Queries against sys.dm_exec_requests or sys.sysprocesses on a read-intent only secondary replica in an availability group were intermittently returning Error 976 or Error 978. This affects any monitoring tool or custom script that polls these DMVs against a secondary, which is a common pattern for offloading monitoring workloads. The fix prevents these intermittent failures.

Stability and Programmability

Non-yielding scheduler from time zone error logging (bug 5281735): If SQL Server encountered a time zone-related error and attempted to write it to the error log, a non-yielding scheduler condition could occur. A non-yielding scheduler is a serious stability event that can cause SQL Server to appear hung or trigger a failover. This fix corrects the error-logging path.

Why You Should Apply It

  • JSON data corruption risk: Bugs 5354186 and 5355051 can silently corrupt JSON column data during JSON_MODIFY operations. If you store JSON in SQL Server and modify it in place, you may be writing corrupted data without any error being raised.
  • JSON index maintenance crash: Bug 5349316 means reorganising a JSON index with statistics causes a dump file, disrupting availability during what should be a routine maintenance task.
  • SSIS remote code execution path closed: Bug 5295713 removes a deserialisation vector in the Message Queue task. Any environment running SSIS with MSMQ integration should treat this as a priority.
  • Denial-of-service path in EDIT_DISTANCE closed: Bug 5295512 prevents an authenticated user from crashing the instance using a crafted query against the EDIT_DISTANCE function.
  • Encryption defaults strengthened: Bugs 5271098 and 5293307 upgrade UCS and Service Broker encryption to AES-256 without requiring manual configuration.
  • HA monitoring restored: Bug 5216512 fixes intermittent failures in sys.dm_exec_requests and sys.sysprocesses on AG secondary replicas, restoring reliable monitoring.
  • Scheduler stability improved: Bug 5281735 eliminates a non-yielding scheduler path triggered by time zone error logging, reducing unplanned failover risk.

Known Issues to Be Aware Of

Microsoft has documented two known issues in CU7 that you should evaluate before deploying.

SESSION_CONTEXT Incorrect Results in Parallel Plans

Queries using the built-in SESSION_CONTEXT function may return incorrect results or trigger access violation dump files when executed under a parallel query plan. The issue arises from how SESSION_CONTEXT interacts with parallel execution threads, particularly when a session is reset for reuse (as happens with connection pooling).

Who is affected: Any workload that calls SESSION_CONTEXT and runs queries that may go parallel. Row-level security implementations commonly use SESSION_CONTEXT to pass the current user context, so this is worth checking carefully.

Should this stop deployment? If your environment relies on SESSION_CONTEXT for security filtering or application context, test thoroughly in a non-production environment before rolling out. As a workaround, you can force serial execution for affected queries using OPTION (MAXDOP 1) until Microsoft issues a fix.

Linked Server Queries via MSDASQL Fail with Error 7416

Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider with a provider string (@provstr) fail with: Msg 7416, Level 16 - Access to the remote server is denied because no login-mapping exists.

A stricter connection validation check introduced in the Database Engine rejects certain MSDASQL-based linked server configurations that worked in earlier builds.

Who is affected: Environments with linked servers configured using MSDASQL and a provider string. This is less common than standard linked server configurations but is used in some legacy integration scenarios.

Should this stop deployment? If you have MSDASQL-based linked servers, test the specific linked server connections before deploying to production. Check the Microsoft documentation for workarounds specific to your configuration.

Does This Affect You? How to Check

Check Your Current Build

SELECT
    SERVERPROPERTY('ProductVersion') AS Build,
    SERVERPROPERTY('ProductLevel')   AS Level,
    SERVERPROPERTY('ProductUpdateLevel') AS CULevel;

If Build is below 17.0.4065.4, you are not yet on CU7.

Check for JSON Index Usage (Bugs 5349316, 5354186, 5355051)

These three fixes only matter if your workload uses JSON indexes or JSON_MODIFY. The most reliable way to find that usage is to search your programmable objects:

SELECT
    OBJECT_SCHEMA_NAME(object_id) AS SchemaName,
    OBJECT_NAME(object_id)        AS ObjectName,
    definition
FROM sys.sql_modules
WHERE definition LIKE '%JSON_MODIFY%'
   OR definition LIKE '%JSON INDEX%';

That covers stored procedures, functions, triggers and views. Ad hoc statements issued from application code will not appear there, so also confirm with your development team whether any application path modifies JSON columns with JSON_MODIFY, and check your deployment scripts for CREATE JSON INDEX statements.

If either JSON indexes or JSON_MODIFY are in use anywhere in your environment, treat all three of these fixes as directly relevant, particularly the two corruption bugs.

Check for Service Broker Usage (Bug 5293307)

SELECT
    name,
    is_broker_enabled,
    service_broker_guid
FROM sys.databases
WHERE is_broker_enabled = 1;

Check for Availability Group Secondary Replicas (Bug 5216512)

SELECT
    ag.name                        AS AGName,
    ar.replica_server_name,
    ars.role_desc,
    ar.secondary_role_allow_connections_desc
FROM sys.availability_groups ag
JOIN sys.availability_replicas ar        ON ag.group_id = ar.group_id
JOIN sys.dm_hadr_availability_replica_states ars ON ar.replica_id = ars.replica_id
WHERE ar.secondary_role_allow_connections_desc IN ('READ_ONLY', 'ALL');

If this returns rows, your monitoring queries against secondaries may have been affected by bug 5216512.

Check for SESSION_CONTEXT Usage (Known Issue)

SELECT
    OBJECT_SCHEMA_NAME(object_id) AS SchemaName,
    OBJECT_NAME(object_id)        AS ObjectName
FROM sys.sql_modules
WHERE definition LIKE '%SESSION_CONTEXT%';

Check for MSDASQL Linked Servers (Known Issue)

SELECT
    name,
    product,
    provider,
    data_source,
    provider_string
FROM sys.servers
WHERE provider = 'MSDASQL'
  AND provider_string IS NOT NULL
  AND is_linked = 1;

If this returns rows, test those linked server connections before deploying CU7.

Check for SSIS Message Queue Task Usage (Bug 5295713)

This requires reviewing your SSIS package XML. Search your SSIS package files (.dtsx) for the string MessageQueueTask and then check whether the MessageType is set to DataFile with BinaryMessageFormatter. Packages using that formatter will need to be updated before this fix is applied.

How to Apply

  1. Download CU7 from the Microsoft Download Centre. Registration is not required.
  2. Test in non-production first. Given the two documented known issues, validate your SESSION_CONTEXT workloads and MSDASQL linked servers in a lower environment before touching production.
  3. Back up all databases before patching, including system databases.
  4. Plan for a restart. Applying a cumulative update requires a SQL Server service restart. Schedule this during a maintenance window and notify application teams.
  5. Apply in order: Patch development, then test, then staging, then production. Do not skip directly to production.
  6. Verify the build after patching:
SELECT SERVERPROPERTY('ProductVersion') AS Build;
-- Expected: 17.0.4065.4
  1. Review SSIS packages that use the Message Queue task before applying, as the binary formatter removal (bug 5295713) is a breaking change for those packages.

DBA Services Recommendation

For our managed services clients, cumulative update assessment and deployment is handled as part of your regular patching cycle. We review each release against your specific feature usage before recommending deployment timing, and we manage the scheduling, testing, and verification process end to end. If you are not on a managed plan and would like help assessing CU7 for your environment, get in touch with the DBA Services team.