Microsoft released KB5089900 on May 12, 2026, a security update for SQL Server 2022 Cumulative Update 24 that patches four vulnerabilities across the Database Engine, Analysis Services, and Reporting Services. The most severe, CVE-2026-0235, allows remote code execution through crafted MDX or DAX queries in Analysis Services.
SQL Server databases typically hold an organization's most sensitive data. The combination of privilege escalation and RCE means an attacker with basic query access could gain full control of the database server and potentially the underlying OS.
Key takeaways
- CVE-2026-0234: Database Engine privilege escalation from basic access to sysadmin.
- CVE-2026-0235: Analysis Services RCE via crafted MDX or DAX queries.
- CVE-2026-0236: Reporting Services leaks sensitive data through report rendering.
- CVE-2026-0237: Database Engine DoS via malformed query processing.
- Affects all SQL Server 2022 editions on x64. Updates to Build 16.0.4135.7.
Affected
KB5089900 Patches Privilege Escalation and SSAS RCE in SQL Server 2022
Microsoft released KB5089900 on May 12, 2026, a security update for SQL Server 2022 Cumulative Update 24 that patches four CVEs across the Database Engine, Analysis Services, and Reporting Services. The update brings SQL Server to Build 16.0.4135.7 and affects all editions (Express, Standard, Enterprise, Developer) on x64 systems.
CVE-2026-0234 is a privilege escalation in the Database Engine that lets authenticated users gain admin access beyond their roles. CVE-2026-0235 is an RCE in Analysis Services exploitable through crafted MDX or DAX queries. CVE-2026-0236 leaks sensitive data through Reporting Services report rendering. CVE-2026-0237 enables denial of service through malformed query processing.
Why KB5089900 Matters: RCE, Escalation, and Data Exposure
The Analysis Services RCE (CVE-2026-0235) is particularly dangerous for organizations running SSAS for business intelligence. Attackers with query access can execute arbitrary code on the server through MDX or DAX payloads. The privilege escalation (CVE-2026-0234) compounds the risk: an attacker with basic database access can elevate to sysadmin, then pivot to the underlying OS.
The SSRS info disclosure (CVE-2026-0236) can expose database connection strings and sensitive report data. Combined with the DoS flaw (CVE-2026-0237), which crashes the Database Engine via malformed queries, these four vulnerabilities cover escalation, code execution, data theft, and availability disruption across the SQL Server stack.
Affected Editions and Deployment Details
All SQL Server 2022 CU24 editions (Express, Standard, Enterprise, Developer) on x64 architecture. Compatible with Windows Server 2019, 2022, and 2025. Package size is approximately 485 MB. SQL Server services must be stopped before installation. A system restart is required. Build updates to 16.0.4135.7.
Known issues
Installation fails with error 0x80070643 if SQL Server services are running. Analysis Services requires a manual restart after update in clustered environments. Reporting Services may need reconfiguration. Initial query performance impact normalizes within 24 hours.
Timeline
Impact & actions
Four CVEs across Database Engine, Analysis Services, and Reporting Services covering privilege escalation, remote code execution, data exposure, and availability disruption.
Security: CVE-2026-0234 lets authenticated users gain sysadmin. CVE-2026-0235 enables RCE through SSAS MDX/DAX queries. Both can lead to full server compromise.
Recommended actions · High urgency
- 1Back up all critical databases before installation.
- 2Stop SQL Server services and install KB5089900.
- 3Verify Build 16.0.4135.7 after restart.
- 4Manually restart SSAS in clustered environments.
Technical details
- CVEs
- CVE-2026-0234, CVE-2026-0235, CVE-2026-0236, CVE-2026-0237
- Attack vector
- Network (CVE-2026-0235, CVE-2026-0237), Local (CVE-2026-0234, CVE-2026-0236)
- Affected versions
- SQL Server 2022 CU24 Build 16.0.4135.4 and earlier
- Patched versions
- SQL Server 2022 Build 16.0.4135.7
Mitigations
- Install KB5089900 immediately.
- Restrict network access to SQL Server instances via firewalls.
- Review and minimize user permissions and role assignments.
- Disable SSAS and SSRS if not in use.
Response
Vendor
FAQ
What does KB5089900 fix?
Four CVEs: CVE-2026-0234 (Database Engine privilege escalation), CVE-2026-0235 (Analysis Services RCE via crafted MDX/DAX), CVE-2026-0236 (Reporting Services info disclosure), and CVE-2026-0237 (Database Engine DoS via malformed queries). Also updates core security libraries.
Which SQL Server editions are affected?
All SQL Server 2022 CU24 editions (Express, Standard, Enterprise, Developer) on x64 architecture running on Windows Server 2019, 2022, or 2025.
Are there known issues?
Known issues: error 0x80070643 if services are running during install, SSAS needs manual restart in clusters, SSRS may need reconfiguration, and initial query performance dip (normalizes in 24 hours).
Do I need to stop SQL Server before installing?
Yes. Stop all SQL Server services, create full database backups, run the installer with admin privileges, restart, then verify Build 16.0.4135.7 with SELECT @@VERSION.
The bottom line
KB5089900 patches CVE-2026-0234 (Database Engine privilege escalation), CVE-2026-0235 (Analysis Services RCE), CVE-2026-0236 (Reporting Services info disclosure), and CVE-2026-0237 (Database Engine DoS) in SQL Server 2022 CU24.
What happens next
What to do
