Skip to content
anavem.com logoanavem.com logo
About
LatestAll updates
ResolvedMicrosoft SQL Server 2019High severityNewsCVE-2026-40370Microsoft

KB5090407 Patches CVSS 8.8 Path Manipulation RCE in SQL Server 2019 CU32

The May 2026 security update patches CVE-2026-40370 (CVSS 8.8, RCE via path manipulation) in SQL Server 2019 CU32. Build 15.0.4470.1. Known MSDASQL linked server breaking change.

By Emanuel De Almeida

3 min readUpdated
Microsoft security update KB5090407 protecting SQL Server 2019 CU32 from a CVSS 8.8 path manipulation remote code execution.
On this page

Key takeaways

  • CVE-2026-40370: CVSS 8.8 High RCE via path manipulation in stored procedures (CWE-73).
  • Build 15.0.4470.1. Supersedes KB5084816 (April) and KB5077469 (March).
  • MSDASQL linked server queries with @provstr fail with Msg 7416.
  • Not in CISA KEV. EPSS approximately 1%, per Rapid7.

What to do now

High urgency
  1. Install KB5102335 (July, latest) on all SQL Server 2019 instances.
  2. Test MSDASQL linked server queries in staging.
  3. Block outbound SMB (TCP 139, 445) from SQL Server hosts as defense-in-depth.

Microsoft released KB5090407 on May 12, 2026, a security update for SQL Server 2019 CU32 patching CVE-2026-40370, a CVSS 8.8 remote code execution vulnerability. Per Microsoft and NVD, the flaw exploits external control of file name or path (CWE-73) in internal stored procedures, allowing a low-privileged authenticated user to execute code over the network within the SQL Server service account context.

The CVSS vector (AV:N/AC:L/PR:L/UI:N) means any authenticated user with basic database access can exploit this without user interaction. The MSDASQL linked server breaking change (Msg 7416) adds deployment risk for organizations using OLE DB linked servers.

KB5090407 patches CVE-2026-40370, a CVSS 8.8 path manipulation RCE in SQL Server 2019 CU32.

Patch SQL Server 2019 to Build 15.0.4470.1. CVE-2026-40370 is a CVSS 8.8 RCE via path manipulation. Test MSDASQL linked servers first (Msg 7416). Now superseded by KB5102335 (July).

Affected & context

Event summary

Microsoft released KB5090407 on May 12, 2026, a security update for SQL Server 2019 CU32 patching CVE-2026-40370, a CVSS 8.8 RCE caused by path manipulation (CWE-73) in internal stored procedures. Build 15.0.4470.1. MSDASQL linked server breaking change.

Why it matters

CVSS 8.8 network-exploitable RCE with low privileges and no user interaction. Any SQL Server 2019 instance with non-admin users is exposed.

Who is affected

SQL Server 2019 RTM with any CU applied, Windows and Linux, all editions.

Vendors
Microsoft
Products
SQL Server 2019 (Windows)SQL Server 2019 (Linux)
CVEs
CVE-2026-40370

KB5090407 Patches CVSS 8.8 Path Manipulation RCE

Microsoft released KB5090407 on May 12, 2026, a security update for SQL Server 2019 CU32. It patches CVE-2026-40370, a remote code execution vulnerability with a CVSS base score of 8.8 (High). Per Microsoft, the flaw stems from external control of file name or path (CWE-73) in SQL Server, allowing an authorized attacker to execute code over a network.

Per GitHub Advisory analysis, CVE-2026-40370 exploits improper path validation in internal stored procedures. An authenticated user with low privileges can achieve RCE through crafted UNC paths, executing code within the SQL Server service account context. The update brings the product version to 15.0.4470.1.

Network RCE with Low Privileges, No User Interaction

CVE-2026-40370 carries a CVSS vector of AV:N/AC:L/PR:L/UI:N/S:U. Network-exploitable with low complexity, it needs only low privileges and no user interaction. The vulnerability is not in the CISA KEV catalog and has an EPSS of about 1%, per Rapid7.

The MSDASQL linked server breaking change is operationally significant. Queries using the OLE DB Provider for ODBC with a provider string fail with Msg 7416 after this update. Test linked server connectivity in staging before deploying.

All SQL Server 2019 Editions

SQL Server 2019 RTM with any CU applied, Windows and Linux, all editions. Supersedes KB5084816 (April) and KB5077469 (March). Now superseded by KB5102335 (July, Build 15.0.4480.2). Install the latest available GDR.

Timeline

  1. KB5090407 released

    Microsoft releases KB5090407 as May Patch Tuesday security update for SQL Server 2019 CU32, patching CVE-2026-40370.

    Source: Microsoft Support

    Confidence: High

  2. CVE-2026-40370 published

    NVD publishes CVE-2026-40370 with CVSS 8.8 High. CWE-73 (external control of file path).

    Source: NVD

    Confidence: High

  3. Superseded by KB5102335

    SQL Server 2019 CU32 GDR Build 15.0.4480.2 supersedes KB5090407.

    Source: Microsoft Support

    Confidence: High

Impact

CVSS 8.8 RCE in SQL Server 2019 exploitable by any authenticated user with low privileges via path manipulation in stored procedures. MSDASQL breaking change affects linked server integrations.

Business impact

RCE enables arbitrary code execution under the SQL Server service account. MSDASQL failures can break data integration workflows.

Security impact

CVE-2026-40370 allows low-privileged authenticated users to execute arbitrary code within the SQL Server service account via path manipulation.

Affected audience: SQL Server 2019 DBAs and administrators, Organizations using MSDASQL linked servers

Action required.

Technical details

CVEs
CVE-2026-40370
CVSS
8.8
EPSS
0.01
Attack vector
Network (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected versions
SQL Server 2019 (all builds before 15.0.4470.1)
Patched versions
SQL Server 2019 Build 15.0.4470.1
CWEs
CWE-73

Mitigations

  • Install KB5090407 or latest GDR KB5102335.
  • Block outbound SMB from SQL Server hosts.
  • Enforce least privilege for SQL Server service accounts.

Technical references

Response

Vendor statement

Microsoft recommends installing this update immediately.

Response status: Patched

Patch available: Yes

Workaround available: No

Patch / advisory

FAQ

What vulnerability does KB5090407 patch?

CVE-2026-40370, a CVSS 8.8 remote code execution vulnerability caused by improper path validation (CWE-73) in SQL Server internal stored procedures. A low-privileged authenticated user can execute code within the SQL Server service account.

Which SQL Server versions are affected?

SQL Server 2019 RTM with any CU applied, on Windows and Linux, all editions. CVE-2026-40370 also affects SQL Server 2016 through 2025, per GitHub Advisory.

What is the MSDASQL breaking change?

Linked server queries using the MSDASQL OLE DB Provider for ODBC with a provider string (@provstr) fail with Msg 7416 after installation due to stricter connection validation.

Is KB5090407 the latest update?

No. KB5102335 (July 2026, Build 15.0.4480.2) supersedes KB5090407. Install the latest available GDR for complete protection.

The bottom line

KB5090407 patches CVE-2026-40370, a CVSS 8.8 RCE exploitable via path manipulation in SQL Server 2019 CU32 stored procedures. Build 15.0.4470.1. MSDASQL linked server breaking change (Msg 7416).

CVSS 8.8 RCE exploitable by any low-privileged authenticated user. Install the latest GDR (KB5102335) and test MSDASQL linked servers before production deployment.

What happens next

KB5102335 (July 2026) supersedes KB5090407 with additional security fixes for SQL Server 2019.

What to do

Install KB5102335 (latest). Test MSDASQL linked servers. Block outbound SMB from SQL Server hosts.

Sources

  1. KB5090407 - Security update for SQL Server 2019 CU32: May 12, 2026Official

    Microsoft · May 12, 2026 · Primary source

    Claims supported
    • CVE-2026-40370 RCE
    • Build 15.0.4470.1
    • MSDASQL Msg 7416
  2. CVE-2026-40370 - GitHub Advisory Database

    GitHub · May 12, 2026

    Claims supported
    • CVSS 8.8
    • CWE-73 path manipulation
    • Affects SQL Server 2016-2025
  3. CVE-2026-40370 Vulnerability Details

    Rapid7 · May 12, 2026

    Claims supported
    • EPSS 1%
    • Not in CISA KEV
Reader actions
Was this helpful?
Rate this articleRate
5 readers viewed this article

Reader reviews

Rate this articleBe the first to rate
No written reviews yetRate the article above, or be the first to share your experience.