Microsoft has released Cumulative Update 27 (CU27) for SQL Server 2022. The update moves the product to build 16.0.4295.3 and includes 42 fixes that were issued after CU26.

The release touches a wide range of areas, including the Database Engine, backup and restore, high availability, replication, PolyBase, XML handling, Query Store, SQL Agent, and client tools. Microsoft also notes several known issues that remain under review.

Known issues

Microsoft documents three known issues in this release:

  • SESSION_CONTEXT in parallel plans: Queries that use SESSION_CONTEXT may return incorrect results or generate access violation dump files when they run in parallel query plans, especially if the session is reset for reuse.
  • Linked server queries using MSDASQL: Linked server queries that use the MSDASQL provider and a provider string can fail with Msg 7416 about missing login mapping.
  • sys.dm_exec_requests during recovery: Queries against sys.dm_exec_requests can raise an access violation while a database is still recovering, such as during restore, startup recovery, or while an availability group replica is coming online.

For the sys.dm_exec_requests issue, Microsoft lists mitigation options in the release notes. The article also says Microsoft is investigating a fix. If a known issue is removed from the source later, that removal alone does not prove it has been resolved.

Improvements and fixes

CU27 contains 42 fixes. The changes fall into a few broad areas:

  • Storage, backup, and restore: fixes for a rare corruption case during transaction rollback when Accelerated Database Recovery is disabled, a long-running or timing-out VSS restore with WITH MOVE, and safer validation of VSS backup metadata.
  • Security and validation hardening: updates across SQL Server Agent, Microsoft Entra authentication, audit record handling, Extended Events, enclave code, attestation parsing, OSF deserialization, and several query optimizer paths that strengthen input validation or protect against malformed input.
  • In-Memory OLTP and programmability: fixes for buffer overreads, access violations, heap buffer overwrites, and other issues involving native compilation, SUBSTRING, shift functions, and SqlDataRecord.SetBytes.
  • High availability and replication: a fix for a secondary replica joining an availability group with a 64-character name under certain cluster types, plus several replication updates that improve validation, handling, and protection of internal replication data.
  • PolyBase, XML, and Query Store: improvements to S3-compatible endpoint response validation, a fix for a raw TCP listener issue in PolyBase startup scenarios, XML parsing fixes, and better handling of Showplan input in Query Store.
  • Backup, WMI, and client tools: fixes for the SQL Server WMI Provider and additional checks in areas exposed to malformed input.

A few representative fixes include:

  • managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup received a security-related update.
  • SQL Server Agent got multiple security and reliability improvements.
  • The update addresses several memory-safety issues, including access violations and out-of-bounds reads or writes in XML, In-Memory OLTP, and query processing paths.
  • Managed Instance link now adds multiple-database link mode so an existing Always On availability group with multiple databases can be extended to Azure SQL Managed Instance and failed over together.

Release details

CU27 updates the following components:

  • SQL Server: product version 16.0.4295.3
  • Analysis Services: product version 16.0.43.252

Microsoft describes this as the cumulative update package for SQL Server 2022 after CU26, with fixes spanning engine behavior, security hardening, and service reliability.

Official source