Skip to content
anavem.com logoanavem.com logo
About
LatestAll updates
ResolvedMicrosoft SQL Server 2019High severityNewsCVE-2026-32167CVE-2026-32176Microsoft

KB5084816 Patches SQL Injection and PolyBase EoP in SQL Server 2019 CU32

April 2026 security update for SQL Server 2019 CU32 patches CVE-2026-32167 (CVSS 6.7, internal SQL injection EoP) and CVE-2026-32176 (PolyBase linked server EoP). Build 15.0.4465.1. Same MSDASQL breaking change as May update.

By Emanuel De Almeida

3 min readUpdated
Microsoft security update KB5084816 protecting SQL Server 2019 CU32 from SQL injection and PolyBase elevation-of-privilege.
On this page

Key takeaways

  • CVE-2026-32167: CVSS 6.7, SQL injection in internal stored procedures (CWE-89), high-priv to sysadmin.
  • CVE-2026-32176: PolyBase linked server EoP.
  • Build 15.0.4465.1. Superseded by KB5090407 (May) and KB5102335 (July).
  • MSDASQL linked server breaking change (Msg 7416).

What to do now

High urgency
  1. Install KB5102335 (July, latest GDR).
  2. Test MSDASQL linked servers before production.
  3. Restrict high-privilege database access.

Microsoft released KB5084816 on April 14, 2026, a security update for SQL Server 2019 CU32 patching two elevation of privilege vulnerabilities. Per CVE Reports and sqlfingers.com, CVE-2026-32167 (CVSS 6.7, CWE-89) is a SQL injection in internal stored procedures allowing high-privileged users to escalate to sysadmin. CVE-2026-32176 affects the PolyBase linked server component.

The SQL injection EoP is particularly dangerous because sysadmin access enables xp_cmdshell for OS command execution, per CVE Reports. This is a common lateral movement vector. The MSDASQL linked server breaking change also affects this update.

KB5084816 patches SQL injection EoP and PolyBase EoP in SQL Server 2019 CU32.

SQL Server 2019 CU32: CVE-2026-32167 SQL injection (CVSS 6.7, sysadmin escalation) + CVE-2026-32176 PolyBase EoP. Build 15.0.4465.1. MSDASQL breaking change. Superseded by KB5102335 (July).

Affected & context

Event summary

April 2026 security update for SQL Server 2019 CU32 patching CVE-2026-32167 (SQL injection EoP, CVSS 6.7) and CVE-2026-32176 (PolyBase EoP). Build 15.0.4465.1.

Why it matters

SQL injection EoP enables sysadmin escalation and OS command execution. PolyBase EoP affects linked server configurations.

Who is affected

SQL Server 2019 RTM with any CU applied, Windows and Linux, all editions.

Vendors
Microsoft
Products
SQL Server 2019 (Windows)SQL Server 2019 (Linux)
CVEs
CVE-2026-32167CVE-2026-32176

KB5084816 Patches SQL Injection and PolyBase EoP in SQL Server 2019

Microsoft released KB5084816 on April 14, 2026, a security update for SQL Server 2019 CU32. Per Microsoft's KB article, it patches CVE-2026-32167 and CVE-2026-32176, both elevation of privilege vulnerabilities. The product version updates to 15.0.4465.1.

Per CVE Reports and sqlfingers.com analysis, CVE-2026-32167 (CVSS 6.7, CWE-89) is a SQL injection flaw in SQL Server's own internal system stored procedures. The engine constructs dynamic SQL in elevated routines without fully neutralizing special characters, allowing a high-privileged database user to inject T-SQL and escalate to sysadmin.

CVE-2026-32176 affects the PolyBase linked server component. Per sqlfingers.com, the accompanying bug reference in Microsoft's KB describes a fix allowing a SQL Server user to gain sysadmin permissions through linked servers. The update also introduces the MSDASQL linked server breaking change (Msg 7416) seen in subsequent SQL Server 2019 updates.

SQL Injection Enables Sysadmin Escalation and OS Command Execution

CVE-2026-32167 carries a CVSS 6.7 (Medium) but the concrete impact is high, per CVE Reports. Successful exploitation yields full confidentiality, integrity, and availability impact. Attackers with sysadmin access can enable xp_cmdshell for OS command execution, which serves as a common pivot for lateral movement.

KB5084816 is superseded by KB5090407 (May 2026, Build 15.0.4470.1) which adds CVE-2026-40370 (CVSS 8.8 RCE). Both are now superseded by KB5102335 (July, Build 15.0.4480.2). Install the latest available GDR.

All SQL Server 2019 Editions

SQL Server 2019 RTM with any CU applied, Windows and Linux, all editions. Build 15.0.4465.1. MSDASQL linked server queries with @provstr fail with Msg 7416. Superseded by KB5090407 and KB5102335.

Timeline

  1. KB5084816 released

    Microsoft releases KB5084816 for SQL Server 2019 CU32, patching CVE-2026-32167 and CVE-2026-32176.

    Source: Microsoft Support

    Confidence: High

  2. Superseded by KB5090407

    KB5090407 (Build 15.0.4470.1) supersedes KB5084816 with CVE-2026-40370 RCE.

    Source: Microsoft Support

    Confidence: High

  3. Superseded by KB5102335

    KB5102335 (Build 15.0.4480.2) is the latest GDR for SQL Server 2019.

    Source: Microsoft Support

    Confidence: High

Impact

Two EoP vulnerabilities in SQL Server 2019 CU32: SQL injection in internal procedures and PolyBase linked server escalation. MSDASQL breaking change.

Business impact

SQL injection EoP enables sysadmin escalation and OS command execution via xp_cmdshell. MSDASQL failures break linked server integrations.

Security impact

CVE-2026-32167 allows sysadmin escalation via SQL injection. CVE-2026-32176 enables escalation through PolyBase linked servers.

Affected audience: SQL Server 2019 DBAs, Environments with MSDASQL linked servers

Action required.

Technical details

CVEs
CVE-2026-32167, CVE-2026-32176
CVSS
6.7
Attack vector
Local (CVE-2026-32167: AV:L/AC:L/PR:H/UI:N)
Affected versions
SQL Server 2019 (before 15.0.4465.1)
Patched versions
SQL Server 2019 Build 15.0.4465.1
CWEs
CWE-89

Mitigations

  • Install KB5102335 (latest GDR).
  • Restrict database high-privilege access.
  • Disable xp_cmdshell where not required.

Technical references

Response

Response status: Patched

Patch available: Yes

Workaround available: No

Patch / advisory

FAQ

What does KB5084816 fix?

CVE-2026-32167 (CVSS 6.7, SQL injection in internal stored procedures enabling sysadmin escalation) and CVE-2026-32176 (PolyBase linked server EoP). Build 15.0.4465.1.

Is KB5084816 the latest update?

No. KB5102335 (July 2026, Build 15.0.4480.2) is the latest. KB5090407 (May) and KB5102335 supersede KB5084816.

Is there a known breaking change?

Yes. MSDASQL linked server queries with @provstr fail with Msg 7416 due to stricter connection validation. Same issue in KB5090407.

The bottom line

KB5084816 patches CVE-2026-32167 (SQL injection EoP, CVSS 6.7) and CVE-2026-32176 (PolyBase EoP) in SQL Server 2019 CU32. Build 15.0.4465.1. Superseded by KB5090407 and KB5102335.

Two EoP vectors patched: SQL injection in internal procedures and PolyBase linked server escalation. Install KB5102335 (July) for latest protection.

What happens next

KB5090407 (May) adds CVE-2026-40370 RCE. KB5102335 (July) is the latest GDR.

What to do

Install KB5102335 (July). Test MSDASQL linked servers. Restrict high-privilege database access.

Sources

  1. KB5084816 - Security update for SQL Server 2019 CU32: April 14, 2026Official

    Microsoft · Apr 14, 2026 · Primary source

    Claims supported
    • CVE-2026-32167 and CVE-2026-32176 EoP
    • Build 15.0.4465.1
    • MSDASQL breaking change
  2. CVE-2026-32167: Microsoft SQL Server Elevation of Privilege via Internal SQL Injection

    CVE Reports · Apr 14, 2026

    Claims supported
    • CVSS 6.7
    • CWE-89
    • SQL injection in internal procedures
    • sysadmin escalation enables xp_cmdshell
  3. Patch Tuesday: SQL Server 2022 Gets a Network RCE

    sqlfingers.com · Apr 14, 2026

    Claims supported
    • CVE-2026-32176 PolyBase linked server component
    • Low-priv to sysadmin via linked servers
Reader actions
Was this helpful?
Rate this articleRate
5 readers viewed this article

Reader reviews

Rate this articleBe the first to rate
No written reviews yetRate the article above, or be the first to share your experience.