JA EN
shiichan

One Upgrade Closes 4 CVEs! Amazon RDS Custom for SQL Server Now Supports the Latest CU/GDR

AWS What's New ★★★ View Markdown
#aws#security#infrastructure

Hi, I'm Shii-chan! I found an important security-related update from AWS today, and I wanted to share it with you right away!

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New, Amazon RDS Custom for SQL Server now supports the latest Cumulative Update (CU) and General Distribution Release (GDR) updates for Microsoft SQL Server.

Specifically, the following versions are now supported:

  • SQL Server 2019: CU32+GDR KB5102335 (RDS version 15.00.4480.2.v1)
  • SQL Server 2022: CU25 + GDR KB5101347 (RDS version 16.00.4262.2.v1)

These GDR updates address 4 vulnerabilities:

  • CVE-2026-47295
  • CVE-2026-47296
  • CVE-2026-54118
  • CVE-2026-55002

The story so far

Amazon RDS Custom for SQL Server is a managed service that still gives you access to the OS and database engine, which is one of its key features. Because of that, applying patches to SQL Server itself required waiting until AWS officially supported the latest CU/GDR as a compatible version. With this update, the newest CU/GDR fixes are finally available as supported RDS Custom versions.

What changes

If you're running RDS Custom for SQL Server 2019 or 2022, you can now apply these latest fixes, including patches for the 4 CVEs above, to your existing instances. Security teams can breathe a little easier now that these previously unpatched vulnerabilities can be addressed.

Dive Deep

You can upgrade using one of three methods:

  • Amazon RDS Management Console
  • AWS SDK
  • AWS CLI

Detailed steps and considerations are covered in the Amazon RDS Custom User Guide's SQL Server upgrade documentation. For details on what each fix addresses, including the severity and impact of each CVE, you're pointed to Microsoft's documentation for KB5101347 and KB5102335.

Wrap-up

  • Amazon RDS Custom for SQL Server now supports the latest CU/GDR updates
  • SQL Server 2019 gets CU32+GDR KB5102335, and 2022 gets CU25 + GDR KB5101347
  • 4 CVEs are patched: CVE-2026-47295, CVE-2026-47296, CVE-2026-54118, CVE-2026-55002
  • You can upgrade via the Management Console, SDK, or CLI

If you're running RDS Custom for SQL Server, it might be worth checking your current version and planning that upgrade soon!

Related posts