Latest updates on cloud, security, Microsoft and the tools that keep your infrastructure running.
Stay informed with the latest IT news, security updates and product changes.
KB5094140 is the June 2026 ESU security update for Exchange 2019 CU14/CU15 patching 8 CVEs including actively exploited OWA spoofing. Same CVEs as Exchange SE SU7 (KB5094139). Requires ESU Period 2 eligibility.
KB5094144 is the June 2026 ESU update for Exchange 2016 CU23 patching 8 CVEs including actively exploited OWA spoofing. Exchange 2016 is deep in extended support. Requires ESU Period 2.
KB5094139 patches 8 CVEs in Exchange Server SE including RCE, spoofing, info disclosure, and EoP. At least one actively exploited. Max CVSS 8.8. Also available for Exchange 2019 and 2016 via ESU.
KB5090408 patches CVE-2026-40370 (CVSS 8.8 RCE via path manipulation) in SQL Server 2019 GDR. Build 15.0.2170.1. For instances on the GDR servicing branch (no CUs). MSDASQL Msg 7416 breaking change. Superseded by KB5102336.
KB5090407 patches CVE-2026-40370 (CVSS 8.8 RCE via path manipulation) in SQL Server 2019 CU32. Build 15.0.4470.1. MSDASQL linked server queries with @provstr fail with Msg 7416 after installation.
KB5083252 patches CVE-2026-32167 (SQL injection EoP), CVE-2026-32176 (PolyBase EoP), and a SQL injection in system stored procedures in SQL Server 2022 CU24. Build 16.0.4250.1. MSDASQL breaking change.
KB5084816 patches CVE-2026-32167 (CVSS 6.7, SQL injection in internal stored procedures) and CVE-2026-32176 (PolyBase linked server EoP) in SQL Server 2019 CU32. Build 15.0.4465.1. Superseded by KB5090407.
Microsoft released KB5083252 on April 14, 2026, a security update for SQL Server 2022 CU24 patching CVE-2026-32167 (PolyBase EoP), CVE-2026-32176 (EoP), and SQL injection in stored procedures. Build 16.0.4250.1.
KB5077469 patches CVE-2026-21262 (merge replication EoP) and CVE-2026-26115 in SQL Server 2019 CU32. Build 15.0.4460.4. First of three consecutive monthly SQL Server 2019 EoP patches. Now superseded by KB5102335 (July).
Starting with the May 2026 security update, Windows Autopatch enables hotpatch security updates by default for eligible Intune-managed (and Microsoft Graph) devices - applying monthly fixes without a restart. Tenant opt-out controls arrived April 1, 2026, with a grace period to May 11.
Microsoft's January 2026 Patch Tuesday cumulative updates for Windows Server — KB5073379, KB5073457, and KB5073723 — deliver security fixes and quality improvements across supported Windows Server releases. Administrators should review the applicable build for their environment before deploying.
