Microsoft has published SQL Server 2019 CU32 + GDR KB5090407 for build 15.0.4470.1. This security update includes one documented fix in Integration Services and also documents a known issue affecting certain linked server queries that use MSDASQL.
The release notes say the update contains fixes and resolves vulnerabilities, and they identify CVE-2026-40370 as part of the advisory coverage for this package.
Known issues
Microsoft documents one known issue in this release:
- Linked server queries that use MSDASQL can fail with error 7416 when a provider string (
@provstr) is specified. The documented message is:Msg 7416, Level 16 Access to the remote server is denied because no login-mapping exists.Microsoft says a stricter connection validation check in the Database Engine can reject some linked server configurations that use the MSDASQL provider, including ones that worked in earlier builds.
Improvements and fixes
This release includes 1 verified fix:
- Integration Services on Windows: a fix for an XML external entity (XXE) issue in the Web Service Task. Microsoft says the issue could allow an attacker to read arbitrary files from the local file system or trigger a denial-of-service (DoS) condition.
In practical terms, the release is narrowly scoped: it pairs the security update with a single documented product fix in Integration Services, while also calling out a linked server compatibility issue for MSDASQL-based configurations.
Release details
- KB: KB5090407
- Update name: CU32 + GDR
- Product version: SQL Server 2019
- Build number: 15.0.4470.1
- Official release date: 2026-05-12