KB5090408 is the May 2026 GDR security update for SQL Server 2019 instances on the RTM servicing branch. It patches CVE-2026-40370, the same CVSS 8.8 RCE patched in KB5090407 for the CU32 branch.
Key takeaways
- CVE-2026-40370: CVSS 8.8 RCE via path manipulation (CWE-73).
- GDR branch: Build 15.0.2170.1. For instances without CUs.
- Same CVE and MSDASQL breaking change as KB5090407 (CU32).
- Superseded by KB5102336 (July GDR).
KB5090408 Patches CVSS 8.8 RCE in SQL Server 2019 GDR Branch
Microsoft released KB5090408 on May 12, 2026, the GDR security update for SQL Server 2019 instances that haven't applied cumulative updates. Per the official KB, it patches CVE-2026-40370, the same CVSS 8.8 RCE via path manipulation (CWE-73) patched in KB5090407 for the CU branch. Build updates to 15.0.2170.1.
This is the GDR counterpart to KB5090407 (CU32 branch, Build 15.0.4470.1). The same MSDASQL linked server breaking change (Msg 7416) applies. Superseded by KB5102336 (July GDR, Build 15.0.2180.2).
Same CVSS 8.8 RCE as CU32 Branch
CVE-2026-40370 is rated CVSS 8.8 High with attack vector AV:N/AC:L/PR:L/UI:N. Per GitHub Advisory, it exploits improper path validation (CWE-73) in internal stored procedures, allowing authenticated users to execute code within the SQL Server service account.
SQL Server 2019 GDR Branch Only
SQL Server 2019 RTM instances on the GDR servicing branch (no CUs applied). Windows and Linux, all editions. Build 15.0.2170.1. Superseded by KB5102336 (July). Install the latest available GDR.
FAQ
What does KB5090408 fix?
CVE-2026-40370, a CVSS 8.8 RCE via path manipulation in internal stored procedures. Same CVE as KB5090407 (CU32 branch).
What is the difference between KB5090408 and KB5090407?
KB5090408 is for the GDR branch (RTM without CUs). KB5090407 is for the CU32 branch. Both patch the same CVE but target different servicing branches.
Is KB5090408 the latest GDR update?
No. KB5102336 (July, Build 15.0.2180.2) supersedes it.
