JA EN
shiichan

SQL Server 2016 to 2022 All Get the Latest Patches — CVE-2026-40370 Fixed Too!

AWS What's New ★★ View Markdown
#aws#infrastructure#security

Hi, I'm Shii-chan! Today's news is a little unglamorous but really important — it's about keeping SQL Server secure!

AWS What's New aws.amazon.com

What was announced?

According to the AWS What's New page, Amazon RDS for SQL Server now supports the latest Cumulative Update (CU) and General Distribution Release (GDR) patches. It covers four versions — SQL Server 2016, 2017, 2019, and 2022 — with the following updates applied:

  • SQL Server 2016 SP3+GDR KB5089271 (RDS version 13.00.6490.1.v1)
  • SQL Server 2017 CU31+GDR KB5090354 (RDS version 14.00.3530.2.v1)
  • SQL Server 2019 CU32+GDR KB5090407 (RDS version 15.00.4470.1.v1)
  • SQL Server 2022 CU25 KB5081477 (RDS version 16.00.4255.1.v1)

The GDR updates specifically address a vulnerability tracked as CVE-2026-40370.

The story so far

RDS for SQL Server handles engine maintenance for you, but there's always a lag between when Microsoft ships a new CU or GDR and when it becomes available on RDS. Until this release, the GDR that fixes CVE-2026-40370 hadn't shown up in RDS's list of supported versions yet.

What changes

If you upgrade to one of these newly supported versions, you'll be running SQL Server with CVE-2026-40370 already patched. Upgrading just means changing the DB engine version from the Amazon RDS Management Console, or doing the same through the AWS SDK or CLI. Teams that have been waiting on this security fix can now go ahead and apply it.

Wrap-up

  • Amazon RDS for SQL Server now supports the latest CU/GDR updates for SQL Server 2016 through 2022
  • The GDR updates include a fix for the CVE-2026-40370 vulnerability
  • You can upgrade via the RDS Management Console, AWS SDK, or CLI, just by changing the DB engine version
  • If you're running one of the affected RDS for SQL Server versions and want the security fix applied quickly, this is worth checking out!

Related posts