KB5090354 - Description of the security update for SQL Server 2017 CU31: May 12, 2026
Applies To
SQL Server 2017 on LinuxSQL Server 2017 on Windows
Release Date:
5/12/2026
Version:
14.0.3530.2
This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories:
The Microsoft SQL Server components are updated to the following builds in this security update:
A downloadable Microsoft Excel workbook that contains a summary list of builds, together with their current support lifecycle, is available. The Excel file also contains detailed fix lists. Download this Excel file now.
Note: Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format. You can then share this URL with others so that they can jump directly to the desired fix in the table.
| Bug reference | Description | Fix area | Component | Platform | | --- | --- | --- | --- | --- | | 5131017 | This fix addresses an XML external entity (XXE) vulnerability in the Web Service Task that allows an attacker to read arbitrary files from the local file system or cause a denial-of-service (DoS) attack. | Integration Services | Integration Services | Windows |
14.0.1000.16914.0.3530.214.0.1000.16914.0.3530.2