Microsoft Release Notes

Release Summary

Category Description Feature Updates Updates to sleeping tabs and security alerts in Microsoft Edge. Fixes Fixed various bugs and performance issues. Security Stable channel security updates are listed here.

Feature Updates

• Sleeping tabs timer default changed. Starting with Microsoft Edge version 152.0.4188.0, the default sleeping tabs timer changed from 2 hours to 15 minutes. Users can manage the experience in Edge settings at edge://settings/system/managePerformance.
• Security Update Alerts in the Edge management service. Administrators can choose a severity threshold and receive alerts when a new Edge update includes security fixes that meet or exceed that level, including zero-day fixes. This helps organizations quickly identify updates that may require attention while avoiding unnecessary notifications for routine releases.

Original source

[1.22.0] - 2026-10-15

Important

Python 3.15 support: The core framework and root agent-framework package now support Python 3.15, but not every package, optional extra, or feature supports it yet because of upstream dependency constraints. Before upgrading, check the README for each package and extra you use. The Python README summarizes the currently known limitations.

Warning

Persisted-state compatibility: This applies to persisted artifacts that contain serialized Agent Framework Content or streamed response-update records. That includes chat and message histories; session stores and protocol snapshots when they embed those records; and workflow checkpoints only when their checkpoint state contains them. Plain session metadata and checkpoints without serialized messages, content, or response updates are unaffected.

The 1.22 runtime can read records written by earlier releases, but pre-1.22 runtimes cannot read new records containing hosted or merge_mode. Do not run old and new workers against the same affected store during a rolling deployment, and do not downgrade after 1.22 has written these records unless the new state is isolated or migrated.

Added

• agent-framework-azure-cosmos-memory: Add a dedicated Cosmos memory provider User-Agent token (#9223)
• agent-framework-foundry: Surface OAuth consent requests in non-streaming responses (#8976)
• agent-framework-ollama, agent-framework-openai: Add configurable service URLs to chat clients (#9222, #9225)
• agent-framework-oracle: Forward Oracle connection-pool configuration settings (#9233)

Changed

• agent-framework, agent-framework-a2a, agent-framework-ag-ui, agent-framework-anthropic, agent-framework-azure-ai-search, agent-framework-azure-contentunderstanding, agent-framework-azure-cosmos, agent-framework-azure-cosmos-memory, agent-framework-azure-documentdb, agent-framework-bedrock, agent-framework-chatkit, agent-framework-claude, agent-framework-copilotstudio, agent-framework-core, agent-framework-declarative, agent-framework-devui, agent-framework-duckdb, agent-framework-foundry, agent-framework-foundry-hosting, agent-framework-foundry-local, agent-framework-gemini, agent-framework-github-copilot, agent-framework-hosting, agent-framework-hosting-a2a, agent-framework-hosting-mcp, agent-framework-hosting-responses, agent-framework-hosting-telegram, agent-framework-hyperlight, agent-framework-mem0, agent-framework-mistral, agent-framework-mongodb, agent-framework-monty, agent-framework-ollama, agent-framework-openai, agent-framework-oracle, agent-framework-orchestrations, agent-framework-postgres, agent-framework-purview, agent-framework-qdrant, agent-framework-redis, agent-framework-sql-server, agent-framework-tools, agent-framework-typesafe: Add Python 3.15 compatibility metadata where supported, document package-specific limitations, and refresh shared dependencies and automation (#9363)
• agent-framework-a2a, agent-framework-ag-ui, agent-framework-anthropic, agent-framework-bedrock, agent-framework-claude, agent-framework-copilotstudio, agent-framework-core, agent-framework-devui, agent-framework-foundry, agent-framework-foundry-hosting, agent-framework-gemini, agent-framework-github-copilot, agent-framework-hosting-a2a, agent-framework-hosting-responses, agent-framework-mistral, agent-framework-ollama, agent-framework-openai: [BREAKING] Consolidate content identity, hosted execution, protocol metadata, replay, and stream-merge semantics across providers and adapters (#8886)
• agent-framework-ag-ui: [BREAKING] Enforce fail-closed request trust boundaries and bind workflow continuations and interrupts to the resolved thread ID (#9316, #9365)
• agent-framework-ag-ui: [BREAKING] Prevent client Shared State and stored Thread Snapshots from replacing tool-approval state, including when AG-UI wraps an agent that does not expose its middleware (#9368)
• agent-framework-declarative: [BREAKING] Bound HTTP response bodies and compressed decoding stages with a configurable limit (#9358)
• agent-framework-devui: Refresh frontend runtime and development dependencies (#9230, #9306, #9310)
• agent-framework-purview: Include citations and error details in Purview policy checks (#9375)
• docs, samples: Refresh response-stream, hosted-agent, security, media-detection, hosting, approval-reuse, community-project, package-promotion, and development-tooling guidance (#8985, #9107, #9201, #9229, #9232, #9311, #9188, #9360, #9356, #9390)
• tests: Consolidate dependency updates, separate optional provider development dependencies, and expand tool-role coverage (#9292, #9255, #9323)

Fixed

• agent-framework-a2a, agent-framework-core, agent-framework-openai: Preserve continuation tokens across conversions; allow empty A2A attachments and forward selected run metadata (#9002, #9056, #9192)
• agent-framework-core: Accept bare container edge targets, fold streamed text efficiently, preserve memory summaries and Mermaid node identities, correlate mixed-pause host responses, validate complex tool arguments, serialize plain enums, refresh MCP prompt catalogs, retain dictionary tool schemas, restore subworkflow sibling requests, merge single mapping tools, redact sensitive telemetry, omit tool arguments from metrics, and preserve concurrent workflow steps across pauses (#8731, #8953, #9079, #9082, #9203, #8824, #9195, #9121, #9299, #9289, #8732, #9288, #9361, #9291)
• agent-framework-core: Treat a single string passed to Message as one text content item instead of one item per character (#9327)
• agent-framework-core, agent-framework-declarative, agent-framework-foundry-hosting: Discard pending workflow state after failed or interrupted execution (#8819)
• agent-framework-core, agent-framework-openai: Concatenate overlapping code-interpreter stream deltas without duplicating content (#9142)
• agent-framework-core, agent-framework-orchestrations: Start a new streamed message when the response author changes (#9353)
• agent-framework-core: Allow switch-case branches to share a target executor (#9300)
• agent-framework-declarative: Parse scientific notation, evaluate quoted concatenations, preserve reusable model options, substitute templates at the correct positions, honor BreakLoop in Foreach, and avoid generated executor ID collisions (#9077, #9073, #9068, #9096, #9091, #9087)
• agent-framework-orchestrations: Reject out-of-scope request-info filters, reset Magentic participants on replan, parse progress ledgers with braces inside strings, await async aggregators, preserve explicit zero handoff limits, and retry ledgers that name unknown agents (#9182, #9131, #9089, #9028, #8965, #9181)
• agent-framework-bedrock, agent-framework-claude, agent-framework-gemini, agent-framework-ollama: Respect provider region, explicit zero limits, configured streamed models, and disabled tool choice (#9249, #9159, #9139, #8987)
• agent-framework-openai: Read the Azure OpenAI API version before applying defaults (#9098)
• agent-framework-azure-ai-search, agent-framework-azure-contentunderstanding: Retain image-only agentic messages and restored upload status (#9075, #9085)
• agent-framework-ag-ui, agent-framework-devui: Persist workflow HITL user text, isolate standalone FIDES session state, and redact deployment auth tokens from logs (#8273, #9367, #9118)
• agent-framework-devui: Discover entities exported through annotated assignments (#9128)
• agent-framework-hosting-responses, agent-framework-monty, agent-framework-redis, agent-framework-tools: Preserve input-image media types, block reparse points during file capture, omit null context fields, and recover queued persistent shell commands (#9298, #9364, #9069, #9047)

Full Changelog: python-1.21.0...python-1.22.0

Original source

Changes

• 1ab3430 .NET: Dotnet: Add approval reuse considerations (#9389)
• 563eb3a .NET: terminate chat completions SSE stream with data: [DONE] (#8532) [ #8526 ]
• 4964bdd .NET: Update version for 1.25.0 release (#9388)
• 5abdadf .NET: Also include citations and error details in purview checks. (#9375)
• 74db3c1 .NET: Fix reasoning remnants and handoff bounce-back (#9174)
• 6b57b5f .NET: Upgrade A2A packages to 1.0.0-preview3 (#9386)
• 95feea6 .NET: Automatically reject tool-approval requests that never receive a response (#9152)

See More

• 1b9879c .NET: feat(dotnet): support closed-list workflow questions (#9202) [ #1530 ]
• dcbbf79 Bump the agent-memory group with 2 updates (#9315)
• b53d25e .NET: fix: preserve agent continuation token when wrapped with UseOpenTelemetry (#8265) [ #8243 ]
• f72bf95 .NET: [BREAKING] Decouple Cosmos chat metadata from partition-key strategy (#9214)
• 6e630f4 .NET: Isolate Foundry toolbox response cache (#8848)
• 1e72200 Revert ".NET: [BREAKING] Request concise Harness progress without private reasoning (#9004)" (#9147)
• 8254704 .NET: [BREAKING] Request concise Harness progress without private reasoning (#9004)

This list of changes was auto generated.

Original source

Release highlights

This release adds shared canvases for agent workflows, lets you move chats without losing context, expands the Markdown editor, and gives administrators more control over agent permissions.

• Canvases (Preview): Collaborate with agents beyond chat using visual and interactive canvases.
• Move chats: Continue a chat in another folder or a new Git worktree without losing conversation history.
• Markdown editor: Work on Markdown files more efficiently with features like pasting images, renaming file links, or breadcrumb navigation.
• Enterprise management: Enforce agent sandboxing and permission policies while controlling which permission modes developers can use.
• Redesigned model picker: Quickly switch between Copilot and BYOK contributed models, and manage effort levels and context windows more intuitively.

Agents

Copilot harness

The Copilot harness is powered by the Copilot SDK, a shared foundation that helps align behavior, capabilities, and improvements across Copilot products. In VS Code, the Copilot harness runs sessions through the Agent Host, which lets sessions continue in the background and be accessed from both the VS Code editor window and the Agents window.

The Copilot harness has been available from the harness picker in the chat input. Based on overwhelmingly positive and valuable feedback, we're progressively rolling it out as the default harness for new sessions in VS Code. When you start a new session, Copilot in the harness picker indicates that the session will use the Copilot harness.

Thank you to everyone who has shared feedback. We're actively using it to shape the experience. One example is reintroducing Ask as a built-in agent in the Copilot harness. Your feedback showed that a dedicated read-only experience remains valuable. Select Ask from the agent picker to use it.

Learn how to work with the Copilot harness, or explore the architecture and workflows in the agent host blog post. If you have feedback or requests, please file an issue.

Canvases (Preview)

Setting: chat.canvases.enabled

Canvases are interactive interfaces to collaborate with an agent. A canvas opens beside the chat, where you and the agent can inspect and update the same artifact instead of coordinating solely through prompts.

For example, use a Kanban canvas to plan and track implementation work. You can create and move cards directly, while the agent can break a feature into tasks, update their status, or add newly discovered work. Canvases work in both the VS Code editor window and the Agents window, and canvas extensions are also supported in the GitHub Copilot app.

Canvases are available in Preview in the VS Code desktop app for local sessions that use the Copilot harness. Enable chat.canvases.enabled, and then start a new session with the Copilot harness.

Every canvas is provided by a canvas extension. To get started, you have two options:

• Create a canvas extension: Enter /create-canvas in the chat input and describe the user interface you want for your project. The skill then creates a canvas extension in your workspace and opens its canvas.
• Install a chat plugin: For now, install a chat plugin that includes a canvas extension through the GitHub Copilot app. Then switch to VS Code and ask the agent to list the available canvases and have it open one.

After you install a canvas extension, you can also open an available canvas in the Agents window from Add Tab (+) > Canvas.

Explore and install sample canvas extensions from the community.

Learn more about canvas support in the VS Code documentation.

Move chats between folders and worktrees

Previously, if you started investigating a task in one folder and then wanted to implement it in a Git worktree, or continue in a different repository, you had to start a new chat and rebuild the context.

In the Agents window, you can now ask the agent to move the current chat to another folder or into a new Git worktree, and it keeps the conversation history intact. Changing the workspace also works for chats that already have a workspace, and the agent can isolate work in a new worktree.

Ask the agent with a natural-language prompt, for example:

Continue this task in a new Git worktree of the current repository before implementing it.

The agent finishes the current turn, moves the chat, and shows a notice when the workspace changes. Then it continues the task automatically in the new location. Edits and commands run in the new location while your original checkout stays unchanged.

The move is available for agent sessions that use the Codex harness or Codex in Interactive mode, and that contain one chat and one local folder. For prerequisites and details about which files are available in the new location, see Move a chat to another folder or worktree.

Session-scoped layout in the Agents window (Experimental)

Setting: sessions.experimental.layoutScope (Agents window only)

Previously, when you switched between sessions in the Agents window, VS Code shared layout settings such as editor visibility, details, and panel visibility across sessions. If you're used to VS Code remembering the layout for each workspace, sharing the layout across sessions can be disruptive.

With the new experimental sessions.experimental.layoutScope setting, you can choose how much of the layout each session remembers. Reload the window after you change the setting. It supports the following values:

• session-shared (default): The current behavior. A session and its nested sessions share the same editors and selected panel views. Editor, details, and bottom panel visibility are shared across existing workspace sessions.
• chat-shared: A session and each of its nested sessions keep their own editors and selected panel views, while editor, details, and bottom panel visibility stay shared across existing workspace sessions.
• chat: A session and each of its nested sessions also keep their own editor and details composition and bottom panel visibility.

Window geometry, pane sizes, and the sidebar currently remain shared across the window.

Customize the Agents window panel layout

You can now choose how the bottom panel is aligned in the Agents window. Right-click a panel tab, select Align Panel, and choose one of the following layouts:

• Center aligns the panel beneath the chat area, leaving more room for the side pane.
• Justify extends the panel across the full width of the window.

Your selection is saved per profile and preserved when maximizing or restoring the panel.

Chat

Quickly identify the active harness

Chat titles show the active harness name, such as Copilot or Codex, so you can identify it without opening the harness picker or hovering over the session list.

Stop background shells

In Copilot harness sessions, the background shells pill above the chat input lists the commands that the agent is still running in the background. When one of those commands is no longer useful, for example a test run that you want to restart or a command that runs longer than expected, you can stop it instead of waiting for it to finish.

Select the Background Shells pill, select a shell to open its details, and then select Stop Shell next to its command. Only that command ends, and the shell leaves the list. You can reach Stop Shell with the keyboard, and screen readers announce when the shell stops.

Stopping a shell is only available for attached shells, which the agent runs as part of its current request. Detached shells run independently of the agent and can't be stopped from this interface.

Shell details also show each shell's full description above its command, even when the list truncates it. Long output is no longer cut off, and you can scroll back through earlier output, both in the shell's details and in the terminal output in the chat response.

Stateful responses for BYOK custom endpoints

If your bring-your-own-key (BYOK) model uses a stateless Responses API, set "statefulResponses": false on its model entry in chatLanguageModels.json to send full conversation history with each request.

See Custom Endpoint configuration for details.

Windows sandboxing for Local harness is no longer supported

Windows sandboxing for terminal commands in Local agent sessions has been deprecated. For sandboxed command execution on Windows, use an Agent Host session. See the Agent Host sandboxing documentation for details.

Redesigned model picker

Copilot and bring-your-own-key (BYOK) providers offer many models, each with strengths for different tasks. The redesigned model picker makes it easier to choose and switch models as your work changes.

The model picker uses a tabbed interface to separate Copilot and BYOK models.

When you hover over a model in the list, you can further configure its thinking level and context window size.

Markdown editor

Editing mode closer to the Markdown source

When you edit Markdown, each source line appears on a separate visual line, making the document structure easier to follow. Read-only mode continues to render Markdown as before.

Paste images

To add an image, for example a screenshot, to your Markdown document, simply paste it directly into the Markdown editor, like you could already do in the text editor. This makes it easier to include visual content without having to save and insert files manually.

Rename file links

The Markdown editor now supports Rename Symbol (F2), so you can rename file links in place and have the changes reflected throughout your document.

Outline and breadcrumbs

The Markdown editor integrates with the Outline view and breadcrumbs, making it easier to inspect the heading structure and jump to a section.

Copy code blocks

Like the Markdown preview, code blocks in the Markdown editor display a copy button on hover. This makes it easy to copy multiline code fragments without accidentally editing the content.

Editor experience

Merging document highlights from different providers

Setting: editor.occurrencesHighlightFromAllProviders

Enable editor.occurrencesHighlightFromAllProviders to merge document highlights from all providers. By default, VS Code uses highlights only from the highest-priority provider.

Languages

Python

This release includes fixes for environment discovery, interpreter selection, and terminal activation in the Python Environments Extension.

• Environment discovery: Python installations managed by uv now appear under Global. Selecting an interpreter by path adds its virtual environment to the environment list, and deleting a virtual environment outside VS Code updates the selection.
• Project-specific environments: Automatic selection now prefers a project's own virtual environment over nested environments. Conda environment selection and Poetry package operations respect project scope, and background refreshes no longer overwrite newer interpreter selections.
• Interpreter configuration: Fixed resolution of ${workspaceFolder}, relative paths, and commands such as python3 in python.defaultInterpreterPath. The project-view environment selector now includes Enter Interpreter Path.
• Terminal activation: Shell-startup activation now updates when the global interpreter changes and is preserved when environment files change. Environment-file notifications include Enable for Workspace or Enable for Folder actions.
• Python installation: When uv is required but missing, setup offers to install it and continues to Python version selection without requiring a PATH refresh.

Enterprise

Automatically move policy-managed chats to Copilot Agent Host

Enterprise managed settings let administrators govern agent permissions and sandboxing. When your organization configures a nonempty permissions object or sets sandbox.enabled to true, VS Code now requires the Copilot harness in Agent Host for full chat sessions, to be able to enforce these policies.

Opening an existing, unarchived Local chat automatically moves it to Copilot, preserving the transcript and unsent draft, including attachments. Nothing is sent automatically. The new chat uses its normal model and permission defaults under current organization policy.

VS Code archives the original chat only after the new chat opens successfully. If you switch away while the move is in progress, the original stays unchanged and the unopened destination is removed.

While these policies apply, Claude, Codex, and terminal chat are unavailable. Editor inline chat remains available for limited read and edit tasks. An empty permissions object or legacy policy alone does not trigger this migration. Administrators can temporarily opt out of automatic migration.

Temporarily keep the Local harness

Administrators who need more time to transition to Copilot Agent Host can set vscode.temporaryDefaultToLocalHarness to true in their unified managed settings:

{
  "vscode": {
    "temporaryDefaultToLocalHarness": true
  }
}

This keeps the Local harness available and stops automatic switching to Copilot, while preserving explicit, remembered, and current harness choices. Set the managed value to false or remove it to restore normal routing.

Note: This temporary opt-out also overrides routing required by managed sandbox and permission settings. Local does not enforce those runtime-only rules. Enforcement in Copilot Agent Host sessions is unchanged.

Manage Copilot permission modes independently

Administrators can permit Assisted while blocking Allow All, giving developers assisted approvals without bypassing permission checks. The Copilot permission picker reflects the modes permitted by your organization's managed settings.

For example, merge this configuration into your unified managed settings:

{
  "permissions": {
    "disableBypassPermissionsMode": "disable",
    "disableAssistedPermissionsMode": false
  }
}

Use permissions.disableAssistedPermissionsMode to restrict Assisted independently. permissions.defaultMode supplies a starting default, not a restriction on the modes users can select.

The legacy ChatToolsAutoApprove: false policy still blocks both Allow All and Assisted unless you configure explicit managed mode restrictions. Setting only permissions.defaultMode does not replace that legacy restriction.

Note: Assisted Permissions is not currently compatible with permissions.{allow,ask,deny}. If you are using any of permissions.allow, permissions.ask, permissions.deny, please set "disableAssistedPermissionsMode": true. In the next release, both will be supported alongside one another.

Windows numeric policies support DWORD values

On Windows, policies that accept numeric values support DWORDs and QWORDs.

Contributions to extensions

GitHub Pull Requests

There has been more progress on the GitHub Pull Requests extension, which enables you to work on, create, and manage pull requests and issues. New features include:

• Stacked pull request support is enabled by default.
• Conflict-free, locally checked-out pull requests can be updated.

Review the changelog for the 0.170.0 release of the extension to learn about everything in the release.

Deprecated features and settings

New deprecations in this release

• Windows sandboxing for Local harness is no longer supported

Thank you

Contributions to vscode:

• @bluerose73 (Shengjie Ma): Copilot NES: add ExP toggle to omit max_tokens PR #340327
• @codelovingcat (Ürem Sancaktutan): Fix/issue 337524 multidiff order PR #337565
• @denizguney (Deniz Güney Yıldırım): Fix duration calculation for agent stop command PR #338278
• @na2co3-ftw (na2co3): Modern UI: Prevent vertical scrolling when dragging connected tabs (revised) PR #338180
• @rksharma-owg (RKS): Preserve newer debugger stop details during continued cleanup PR #339530
• @sgent-epic: agentHost: preserve BYOK state through tool continuations PR #331749
• @SimonSiefke (Simon Siefke):
  • fix: memory leak in document paste edits PR #338233
  • fix: memory leak in native context menu dismissal PR #338214
  • fix: memory leak in output channel disposal listeners PR #338240
  • fix: memory leak in debug adapter descriptor factory PR #334103
  • fix: release terminal command history when clearing the normal buffer PR #326931
  • perf: reduce number of strings by 1200 PR #327689
  • fix: memory leak in MainThreadDebugService PR #334102
  • fix: memory leak in extHostTimeline PR #334098
  • fix: memory leak in debug visualization registrations PR #340046
  • fix: memory leak in hidden status bar command arguments PR #338238
  • fix: memory leak in extension host language model providers PR #340579
  • fix: memory leak in terminal disposal subscriptions PR #340037
• @Tabisharaza (TABISH AYUB RAZA): mcp: read migrated local servers from workspace configuration PR #340034
• @tuanvtdeptre199: Disable Step Out action when the active thread has only one stack frame PR #336125
• @tyrielv (Tyrie Vella): Avoid unnecessary --numstat diff for incoming changes decorations PR #339008
• @yuezhang030: Update VSC model F prompt PR #340187

Contributions to vscode-pull-request-github:

• @L4XB (Lukas ): Don't open two browser tabs when clicking the pull request number PR #8962
• @strawberry-little-bear: Fix malformed issue links in overview HTML PR #9025
• @vsharha (Viktor Sharha): Fix mergeability polling in pull request overview PR #8954

Issue tracking

Contributions to our issue tracking:

• @gjsjohnmurray (John Murray)
• @RedCMD (RedCMD)
• @IllusionMH (Andrii Dieiev)
• @albertosantini (Alberto Santini)

We really appreciate people trying our new features as soon as they are ready, so check back here often and learn what's new.

If you'd like to read release notes for previous VS Code versions, go to Updates on code.visualstudio.com.

Original source

Applies To

SQL Server 2025 on Windows (all editions), SQL Server 2025 on Linux (all editions)

Release date: October 13, 2026
Version: 17.0.5015.4

Summary

This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories:

• CVE-2026-94512 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-96956 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-83945 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-94520 - Microsoft SQL Server Denial of Service Vulnerability
• CVE-2026-88088 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-85919 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88085 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-70189 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-88086 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-85876 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88082 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-65674 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-67625 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-85886 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-68883 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88081 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-85888 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-88083 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-94530 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-67628 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-67626 - Microsoft SQL Server Denial of Service Vulnerability
• CVE-2026-88089 - Microsoft SQL Server Remote Code Execution Vulnerability

The Microsoft SQL Server components are updated to the following builds in this security update:

• SQL Server - product version: 17.0.5015.4, file version: 2025.170.5015.4

Important

To help secure SQL Server on Windows, enable encryption with Extended Protection.

Known issues in this update

Linked server queries that use MSDASQL fail with error 7416

Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message:

Msg 7416, Level 16
Access to the remote server is denied because no login-mapping exists.

A stricter connection validation check in the Database Engine can reject connections for certain linked server configurations that use the MSDASQL provider, even if earlier builds allowed those connections.

Access violation when you query sys.dm_exec_requests during database recovery

Queries against sys.dm_exec_requests might raise an access violation and generate a dump file if they run while a database is still recovering. This issue can occur during a database RESTORE operation, during startup recovery, or before an availability group replica finishes coming online.

Microsoft is aware of this issue and is investigating a fix. Until a fix is available, use one of the following mitigations:

• Enable trace flag 4696 to opt out of the code change that causes this issue. If you enable this trace flag, monitoring queries that query sys.dm_exec_requests or sys.sysprocesses on secondary replicas might return error 976 or error 978, as they did before you installed this update.
• Avoid queries against sys.dm_exec_requests for databases that are recovering.
• Uninstall this update.

Improvements and fixes included in this update

A downloadable Excel workbook that contains a summary list of builds, together with their current support lifecycle, is available. The Excel file also contains detailed fix lists.

• Bug reference 5494270: Addresses an input-validation issue in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths in which malformed size values potentially cause out-of-bounds memory access. Introduces hardened arithmetic and transfer-sized validation to reject invalid requests before unsafe memory handling occurs.
• Bug reference 5544846: Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. Adds strict bounds validation and safe size calculation checks to reject malformed or oversized inputs before memory operations occur.
• Bug reference 5563245: Adds validation of FILESTREAM fragment size on Availability Group secondary replicas to reject oversized fragments.
• Bug reference 5570179: Addresses an issue that causes the SQL Server process to terminate unexpectedly while working with external data sources.
• Bug reference 5571548: Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds write action potentially occurs while opening a virtual device set.
• Bug reference 5571951: Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds read or write action potentially occurs while processing transferred data during backup or restore operations.
• Bug reference 5574694: Resolves a security vulnerability in PolyBase by improving validation during data processing.
• Bug reference 5575377: Fixes unsafe deserialization of PolyBase rollback queue data so that malformed payloads are rejected.
• Bug reference 5578133: Addresses an input-validation issue in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths in which malformed size values potentially cause out-of-bounds memory access. Introduces hardened arithmetic and transfer-sized validation to reject invalid requests before unsafe memory handling occurs.
• Bug reference 5578372: Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. Adds strict bounds validation and safe size calculation checks to reject malformed or oversized inputs before memory operations occur.
• Bug reference 5578949: Fixes multiple memory-corruption and memory-disclosure vulnerabilities in SQL Server's SQL Satellite protocol message parsing logic that's used by Machine Learning Services and Language Extensions.
• Bug reference 5579286: Adds validation for delta table schema.
• Bug reference 5579344: Fixes invalid memory-read vulnerability in SQL Server's AI_GENERATE_EMBEDDINGS runtime parameter processing.
• Bug reference 5579729: Updates shared memory handling.
• Bug reference 5582300: Fixes an issue in which MSDASQL-linked server connections fail if the provider string does not include a user ID (UID).
• Bug reference 5601560: Updates the third-party archive-extraction component that SQL Server uses if external language and external library packages are installed. After the update is applied, package extraction uses the refreshed component.
• Bug reference 5632691: Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade.
• Bug reference 5632804: Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario.
• Bug reference 5632817: Improves security and reliability for the change feed configuration.
• Bug reference 5632852: Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries.
• Bug reference 5632878: Fixes an issue in replication operations that affects data validation.
• Bug reference 5632891: Fixes an issue in merge replication Web Synchronization operations that affects data validation.
• Bug reference 5632904: Fixes an issue in input data processing for change event streaming.
• Bug reference 5632931: Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information.
• Bug reference 5635966: Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent malformed trace data from causing an out-of-bounds read action.

How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically.

Method 2: Microsoft Update Catalog

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

The following file is available for download from the Microsoft Download Center:

Download the package now

How to obtain or download the latest cumulative update package for Linux

To update SQL Server 2025 on Linux to the latest CU, you must first have the Cumulative Update repository configured. Then, update your SQL Server packages by using the appropriate platform-specific update command.

More information

Prerequisites

To apply this update, you must have SQL Server 2025 or any SQL Server 2025 CU release through this SQL Server 2025 CU9 GDR installed.

Security update deployment information

For deployment information about this update, see Deployments - Security Update Guide.

File hash information

File name: SQLServer2025-KB5126967-x64.exe
SHA256 hash: 709AFE429AE38A64AFC0709356FDE160837EB07F2D1DD447AC40733CBC7408AF

File information

The English version of this package has the file attributes (or later file attributes) that are listed in the following worksheet. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it's converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported x64-based versions - Download the list of files that are included in security update 5126967.

Information about protection and security

Protect yourself online: Windows Security support

Learn how we guard against cyber threats: Microsoft Security

Original source

Applies To

SQL Server 2025 on Windows (all editions), SQL Server 2025 on Linux (all editions)

Release date: October 13, 2026

Version: 17.0.1145.4

Summary

This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories:

• CVE-2026-94512 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-96956 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-83945 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-94520 - Microsoft SQL Server Denial of Service Vulnerability
• CVE-2026-88088 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-85919 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88085 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-70189 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-88086 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-85876 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88082 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-65674 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-67625 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-85886 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-68883 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88081 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-85888 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-88083 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-94530 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-67628 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-67626 - Microsoft SQL Server Denial of Service Vulnerability
• CVE-2026-88089 - Microsoft SQL Server Remote Code Execution Vulnerability

The Microsoft SQL Server components are updated to the following builds in this security update:

• SQL Server - product version: 17.0.1145.4, file version: 2025.170.1145.4

Important

To help secure SQL Server on Windows, enable encryption with Extended Protection.

Known issues in this update

Linked server queries that use MSDASQL fail with error 7416

Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message:

Msg 7416, Level 16
Access to the remote server is denied because no login-mapping exists.

A stricter connection validation check in the Database Engine can reject connections for certain linked server configurations that use the MSDASQL provider, even if earlier builds allowed those connections.

For more information and workarounds, see Linked server queries that use MSDASQL fail with error 7416.

Improvements and fixes included in this update

A downloadable Microsoft Excel workbook that contains a summary list of builds, together with their current support lifecycle, is available. The Excel file also contains detailed fix lists. Download this Excel file now.

Note

Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format. You can then share this URL with others so that they can jump directly to the desired fix in the table.

Bug reference Description Fix area Component Platform 5419466 Resolves a security vulnerability in PolyBase by improving validation during data processing. SQL Server Engine PolyBase Linux, Windows 5439308 Addresses an issue that causes the SQL Server process to terminate unexpectedly while working with external data sources. SQL Server Engine PolyBase Linux, Windows 5493576 Addresses an input-validation issue in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths in which malformed size values potentially lead to out-of-bounds memory access. Introduces hardened arithmetic and transfer-size validation to reject invalid requests before unsafe memory handling occurs. SQL Server Engine Backup Restore Windows 5494358 Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. Adds strict bounds validation and safe size calculation checks to reject malformed or oversized inputs before memory operations occur. SQL Server Engine Backup Restore Windows 5498949 Fixes several security vulnerabilities that allow information disclosure or a denial of service when the Database Engine reads a specially crafted Extended Events (.xel) file. SQL Server Engine Extended Events Linux, Windows 5505573 Updates the third-party archive-extraction component that SQL Server uses if external language and external library packages are installed. After the update is applied, package extraction uses the refreshed component. SQL Server Engine Extensibility Linux, Windows 5522494 Adds validation of FILESTREAM fragment size on Availability Group secondary replicas to reject oversized fragments. SQL Server Engine High Availability and Disaster Recovery Linux, Windows 5529206 Improves Showplan input handling to enhance security and reliability. SQL Server Engine Query Store Windows 5529383 Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. SQL Server Engine Replication Windows 5529397 Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. SQL Server Engine Replication Windows 5555767 Adds validation for delta table schema. SQL Server Engine PolyBase Linux, Windows 5558725 Updates shared memory handling. SQL Server Engine PolyBase Linux, Windows 5571549 Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds write action potentially occurs while opening a virtual device set. SQL Server Engine Backup Restore Windows 5571954 Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds read or write action potentially occurs while processing transferred data during backup or restore operations. SQL Server Engine Backup Restore Windows 5574837 Fixes invalid memory-read vulnerability in SQL Server's AI_GENERATE_EMBEDDINGS runtime parameter processing. SQL Server Engine Extensibility Linux, Windows 5575379 Fixes unsafe deserialization of PolyBase rollback queue data so that malformed payloads are rejected. SQL Server Engine PolyBase Linux, Windows 5578950 Fixes multiple memory-corruption and memory-disclosure vulnerabilities in SQL Server's SQL Satellite protocol message parsing logic that's used by Machine Learning Services and Language Extensions. SQL Server Engine Extensibility Linux, Windows 5581480 Fixes an issue in which MSDASQL-linked server connections fail if the provider string does not include a user ID (UID). SQL Server Engine Distributed Query Linux, Windows 5632694 Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade. SQL Server Engine Replication Windows 5632805 Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario. SQL Server Engine Replication Windows 5632818 Improves security and reliability for the change feed configuration. SQL Server Engine Replication Windows 5632853 Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries. SQL Server Engine Replication Linux, Windows 5632879 Fixes an issue in replication operations that affects data validation. SQL Server Engine Replication Linux, Windows 5632892 Fixes an issue in merge replication Web Synchronization operations that affects data validation. SQL Server Engine Replication Linux, Windows 5632905 Fixes an issue in input data processing for change event streaming. SQL Server Engine Replication Linux, Windows 5632932 Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. SQL Server Engine Replication Linux, Windows 5635968 Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent malformed trace data from causing an out-of-bounds read action. SQL Server Engine Programmability Linux, Windows

How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Note

• The detection logic has been updated for this and future security releases that are posted to the Microsoft Update Catalog website. For more information, see Updates to the Microsoft Update detection logic for SQL Server servicing.
• This update is made available through the Microsoft Update Catalog for all servers that are running SQL Server, even if Power BI Report Server is not installed. Installing this security update is optional for computers that do not host Power BI Report Server. For more information, see Download Power BI Report Server.

Method 3: Microsoft Download Center

The following file is available for download from the Microsoft Download Center:

Download the package now

More information

Prerequisites

To apply this update, you must have SQL Server 2025 or any SQL Server 2025 GDR release through this SQL Server 2025 GDR installed.

Security update deployment information

For deployment information about this update, see Deployments - Security Update Guide.

File hash information

File name SHA256 hash SQLServer2025-KB5128492-x64.exe FEF7665DD91FF9C7D36328212F940010416BC1807B03FA40ECA900B53022B28F

File information

The English version of this package has the file attributes (or later file attributes) that are listed in the following worksheet. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported x64-based versions -

Download the list of files that are included in security update 5128492.

Information about protection and security

Protect yourself online:

Windows Security support

Learn how we guard against cyber threats:

Microsoft Security

Original source

Release date: October 13, 2026
Version: 16.0.4305.5

Summary

This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories:

• CVE-2026-94512 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-96956 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-83945 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-94520 - Microsoft SQL Server Denial of Service Vulnerability
• CVE-2026-88088 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-85919 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88085 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-70189 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-88086 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-85876 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88082 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-65674 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-67625 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-85886 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-68883 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88081 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-85888 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-88083 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-67628 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-67626 - Microsoft SQL Server Denial of Service Vulnerability
• CVE-2026-88089 - Microsoft SQL Server Remote Code Execution Vulnerability

The Microsoft SQL Server components are updated to the following builds in this security update:

• SQL Server - product version: 16.0.4305.5, file version: 2022.160.4305.5

Important

To help secure SQL Server on Windows, enable encryption with Extended Protection.

Known issues in this update

Linked server queries that use MSDASQL fail with error 7416

Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message:

Msg 7416, Level 16
Access to the remote server is denied because no login-mapping exists.

A stricter connection validation check in the Database Engine can reject connections for certain linked server configurations that use the MSDASQL provider, even if earlier builds allowed those connections.

For more information and workarounds, see Linked server queries that use MSDASQL fail with error 7416.

Access violation when you query sys.dm_exec_requests during database recovery

Queries against sys.dm_exec_requests might raise an access violation and generate a dump file if they run while a database is still recovering. This issue can occur during a RESTORE operation, during startup recovery, or before an availability group replica finishes coming online.

The SQL Server error log contains entries that resemble the following text:

The database '<DatabaseName>' is marked RESTORING and is in a state that does not allow recovery to be run.
***Stack Dump being sent to <SQLServerLogFolder>\SQLDump0215.txt
SqlDumpExceptionHandler: Process 77 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Server is terminating this process.
*******************************************************************************

BEGIN STACK DUMP:
  07/30/26 07:37:23 spid 77

Exception Address = <frame id="00" address="0x7FFDED94970D" pdb="sqlmin.pdb" age="2" guid="E1039014-237E-4DB6-88FD-4A2AB31C651F" module="sqlmin" rva="0x2970D" />
Exception Code    = c0000005 EXCEPTION_ACCESS_VIOLATION
Access Violation occurred reading address 00000000000000F0
Input Buffer <size> bytes -
          <dbo.sp_YourMonitoringStoredProcedure>

This issue occurs because of a change that causes internal in-memory structures to be referenced before they're fully initialized.

Microsoft is aware of this issue and is investigating a fix. Until a fix is available, use one of the following mitigations:

• Enable trace flag 4696 to opt out of the code change that causes this issue. If you enable this trace flag, monitoring queries that query sys.dm_exec_requests or sys.sysprocesses on secondary replicas might return error 976 or error 978, as they did before you installed this update.
• Avoid queries against sys.dm_exec_requests for databases that are recovering.
• Uninstall this update.

Improvements and fixes included in this update

A downloadable Excel workbook that contains a summary list of builds, together with their current support lifecycle, is available. The Excel file also contains detailed fix lists. Download this Excel file now.

Note

Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format. You can then share this URL with others so that they can jump directly to the desired fix in the table.

Bug reference Description Fix area Component Platform 5499822 Fixes several security vulnerabilities that allow information disclosure or a denial of service when the Database Engine reads a specially crafted Extended Events (.xel) file. SQL Server Engine Extended Events Linux, Windows 5544844 Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. Adds strict bounds validation and safe size calculation checks to reject malformed or oversized inputs before memory operations occur. SQL Server Engine Backup Restore Windows 5561725 Adds validation of FILESTREAM fragment size on Availability Group secondary replicas to reject oversized fragments. SQL Server Engine High Availability and Disaster Recovery Linux, Windows 5570189 Addresses an issue that causes the SQL Server process to terminate unexpectedly while working with external data sources. SQL Server Engine PolyBase Linux, Windows 5571550 Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds write action potentially occurs while opening a virtual device set. SQL Server Engine Backup Restore Linux, Windows 5571986 Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds read or write action potentially occurs while processing transferred data during backup or restore operations. SQL Server Engine Backup Restore Linux, Windows 5574656 Resolves a security vulnerability in PolyBase by improving validation during data processing. SQL Server Engine PolyBase Linux;Windows 5575384 Fixes unsafe deserialization of PolyBase rollback queue data so that malformed payloads are rejected. SQL Server Engine PolyBase Linux, Windows 5578134 Addresses an input-validation issue in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths in which malformed size values potentially cause out-of-bounds memory access. Introduces hardened arithmetic and transfer-sized validation to reject invalid requests before unsafe memory handling occurs. SQL Server Engine Backup Restore Windows 5578378 Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. Adds strict bounds validation and safe size calculation checks to reject malformed or oversized inputs before memory operations occur. SQL Server Engine Backup Restore Windows 5578972 Fixes multiple memory-corruption and memory-disclosure vulnerabilities in SQL Server's SQL Satellite protocol message parsing logic that's used by Machine Learning Services and Language Extensions. SQL Server Engine Extensibility Linux, Windows 5579290 Adds validation for delta table schema. SQL Server Engine PolyBase Linux;Windows 5579838 Updates shared memory handling. SQL Server Engine PolyBase Linux;Windows 5582287 Fixes an issue in which MSDASQL-linked server connections fail if the provider string does not include a user ID (UID). SQL Server Engine Distributed Query Linux, Windows 5601561 Updates the third-party archive-extraction component that SQL Server uses if external language and external library packages are installed. After the update is applied, package extraction uses the refreshed component. SQL Server Engine Extensibility Linux, Windows 5632310 Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade. SQL Server Engine Replication Windows 5632797 Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario. SQL Server Engine Replication Windows 5632811 Improves security and reliability for the change feed configuration. SQL Server Engine Replication Windows 5632846 Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries. SQL Server Engine Replication Linux, Windows 5632872 Fixes an issue in replication operations that affects data validation. SQL Server Engine Replication Linux, Windows 5632885 Fixes an issue in merge replication Web Synchronization operations that affects data validation. SQL Server Engine Replication Linux, Windows 5632925 Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. SQL Server Engine Replication Linux, Windows 5635955 Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent malformed trace data from causing an out-of-bounds read action. SQL Server Engine Programmability Linux, Windows

How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Note

• The detection logic has been updated for this and future security releases that are posted to the Microsoft Update Catalog website. For more information, see Updates to the Microsoft Update detection logic for SQL Server servicing.
• This update is made available through the Microsoft Update Catalog for all servers that are running SQL Server, even if Reporting Services is not installed. Installing this security update is optional for computers that do not host Microsoft SQL Server Reporting Services.

Method 3: Microsoft Download Center

The following file is available for download from the Microsoft Download Center:

Download the package now

How to obtain or download the latest cumulative update package for Linux

To update SQL Server 2022 on Linux to the latest CU, you must first have the Cumulative Update repository configured. Then, update your SQL Server packages by using the appropriate platform-specific update command.

For installation instructions and direct links to the CU package downloads, see the SQL Server 2022 Release Notes.

More information

Prerequisites

To apply this update, you must have SQL Server 2022 or any SQL Server 2022 CU release through this SQL Server 2022 CU27 GDR installed.

Security update deployment information

For deployment information about this update, see Deployments - Security Update Guide.

File hash information

File name: SQLServer2022-KB5126934-x64.exe
SHA256 hash: 8F1A7F0AC5F47FF98F5825687C8CCD897563AA835915F2271F908273E962E7E2

File information

The English version of this package has the file attributes (or later file attributes) that are listed in the following worksheet. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it's converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported x64-based versions - Download the list of files that are included in security update 5126934.

Information about protection and security

Protect yourself online: Windows Security support

Learn how we guard against cyber threats: Microsoft Security

Original source

Release date: October 13, 2026
Version: 16.0.1210.3

Summary

This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories:

• CVE-2026-94512 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-96956 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-83945 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-94520 - Microsoft SQL Server Denial of Service Vulnerability
• CVE-2026-88088 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-85919 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88085 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-70189 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-88086 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-85876 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88082 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-65674 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-67625 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-85886 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-68883 - Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-88081 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-85888 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-88083 - Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-67628 - Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-67626 - Microsoft SQL Server Denial of Service Vulnerability
• CVE-2026-88089 - Microsoft SQL Server Remote Code Execution Vulnerability

The Microsoft SQL Server components are updated to the following builds in this security update:

• SQL Server - product version: 16.0.1210.3, file version: 2022.160.1210.3

Important

To help secure SQL Server on Windows, enable encryption with Extended Protection.

Known issues in this update

Linked server queries that use MSDASQL fail with error 7416

Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message:

Msg 7416, Level 16
Access to the remote server is denied because no login-mapping exists.

A stricter connection validation check in the Database Engine can reject connections for certain linked server configurations that use the MSDASQL provider, even if earlier builds allowed those connections.

For more information and workarounds, see Linked server queries that use MSDASQL fail with error 7416.

Improvements and fixes included in this update

A downloadable Microsoft Excel workbook that contains a summary list of builds, together with their current support lifecycle, is available. The Excel file also contains detailed fix lists. Download this Excel file now.

Note

Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format. You can then share this URL with others so that they can jump directly to the desired fix in the table.

Bug reference Description Fix area Component Platform 5419473 Resolves a security vulnerability in PolyBase by improving validation during data processing. SQL Server Engine PolyBase Linux, Windows 5439344 Addresses an issue that causes the SQL Server process to terminate unexpectedly while working with external data sources. SQL Server Engine PolyBase Linux, Windows 5490969 Addresses an input-validation issue in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths in which malformed size values potentially cause out-of-bounds memory access. Introduces hardened arithmetic and transfer-sized validation to reject invalid requests before unsafe memory handling occurs. SQL Server Engine Backup Restore Windows 5505575 Updates the third-party archive-extraction component that SQL Server uses if external language and external library packages are installed. After the update is applied, package extraction uses the refreshed component. SQL Server Engine Extensibility Linux, Windows 5523800 Adds validation of FILESTREAM fragment size on Availability Group secondary replicas to reject oversized fragments. SQL Server Engine High Availability and Disaster Recovery Linux, Windows 5529201 Improves Showplan input handling to enhance security and reliability. SQL Server Engine Query Store Windows 5529378 Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. SQL Server Engine Replication Windows 5529391 Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. SQL Server Engine Replication Windows 5544845 Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. Adds strict bounds validation and safe size calculation checks to reject malformed or oversized inputs before memory operations occur. SQL Server Engine Backup Restore Windows 5558728 Updates shared memory handling. SQL Server Engine PolyBase Linux, Windows 5571552 Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds write action potentially occurs while opening a virtual device set. SQL Server Engine Backup Restore Windows 5571987 Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds read or write action potentially occurs while processing transferred data during backup or restore operations. SQL Server Engine Backup Restore Windows 5575395 Fixes unsafe deserialization of PolyBase rollback queue data so that malformed payloads are rejected. SQL Server Engine PolyBase Linux, Windows 5577585 Adds validation for delta table schema. SQL Server Engine PolyBase Linux, Windows 5578971 Fixes multiple memory-corruption and memory-disclosure vulnerabilities in SQL Server's SQL Satellite protocol message parsing logic that's used by Machine Learning Services and Language Extensions. SQL Server Engine Extensibility Linux, Windows 5581236 Fixes an issue in which MSDASQL-linked server connections fail if the provider string does not include a user ID (UID). SQL Server Engine Distributed Query Linux, Windows 5632311 Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade operations. SQL Server Engine Replication Windows 5632798 Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario. SQL Server Engine Replication Windows 5632812 Improves security and reliability for the change feed configuration. SQL Server Engine Replication Windows 5632847 Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries. SQL Server Engine Replication Linux, Windows 5632873 Fixes an issue in replication operations that affects data validation. SQL Server Engine Replication Linux, Windows 5632886 Fixes an issue in merge replication Web Synchronization operations that affects data validation. SQL Server Engine Replication Linux, Windows 5632926 Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. SQL Server Engine Replication Linux, Windows 5635957 Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent malformed trace data from causing an out-of-bounds read. SQL Server Engine Programmability Linux, Windows

How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Note

• The detection logic has been updated for this and future security releases that are posted to the Microsoft Update Catalog website. For more information, see Updates to the Microsoft Update detection logic for SQL Server servicing.
• This update is made available through the Microsoft Update Catalog for all servers that are running SQL Server, even if Reporting Services is not installed. Installing this security update is optional for computers that do not host Microsoft SQL Server Reporting Services.

Method 3: Microsoft Download Center

The following file is available for download from the Microsoft Download Center:

Download the package now

More information

Prerequisites

To apply this update, you must have SQL Server 2022 or any SQL Server 2022 GDR release through this SQL Server 2022 GDR installed.

Security update deployment information

For deployment information about this update, see Deployments - Security Update Guide.

File hash information

File name: SQLServer2022-KB5128493-x64.exe
SHA256 hash: 37EB03E75B9E167988A42273AE7F6E61DF918D2D78F86870C08D70D2941B0E26

File information

The English version of this package has the file attributes (or later file attributes) that are listed in the following worksheet. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported x64-based versions -

Download the list of files that are included in security update 5128493.

Information about protection and security

Protect yourself online:

Windows Security support

Learn how we guard against cyber threats:

Microsoft Security

Original source

Announcements and messages

This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.

Important

Windows 11, version 24H2 Home and Pro has reached end of updates. The October 2026 monthly security update is the last update available for these editions. Devices running these editions will no longer receive monthly security and non-security preview updates containing protections from the latest security threats. To stay protected and up to date, we recommend you upgrade to the latest version of Windows 11.

Improvements

This update includes improvements from the following previously released updates:

• September 8, 2026-KB5124008 (OS Builds 26200.9445 and 26100.9445)
• September 14, 2026—KB5129195 (OS Builds 26200.9457 and 26100.9457) Out-of-band
• September 22, 2026—KB5124010 (OS Builds 26300.9550, 26200.9550, and 26100.9550)

The following summary outlines key quality improvements addressed by this update. The bold text within the brackets indicates the item or area of the change.

• [Security updates] This update provides security improvements. For more information about the security vulnerabilities resolved by this update, see the Security Update Guide.
• [Secure Boot] This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. Deployment through Windows Update remains ongoing across supported devices.
• [Windows Explorer (Known issue)] Fixed This update fixes an issue that affects Windows Explorer in multi-user environments, such as Azure Virtual Desktop and FSLogix. After sign-in, Explorer.exe might fail to start or repeatedly crash, causing a black screen.
• [Audio (known issue)] Fixed This update fixes an issue that affects AC-3 audio playback in some applications.
• [Always On VPN] This update fixes an issue that affects Always On VPN connections after installing KB5124008. When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed. In some cases, subsequent connection attempts could display the error, "The specified port is already in use."
• [Storage Spaces] This update fixes an issue that affects tiered Storage Spaces Direct virtual disks. Some virtual disks might fail to come online after installing certain security updates, making dependent clustered workloads unavailable.
• [Date and Time] This update introduces the new (UTC-05:00) Manitoba time zone to support Manitoba’s November 1, 2026, time zone change.
• [ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. To learn more, see KB5130741.
• [Printing] This update resolves an issue where printing could fail in some applications and on devices using RAW or Generic Text Only printer drivers after installing the August 2026 security update.
• [Gaming] This update fixes an issue that could cause mouse input to stutter in some games.
• [Windows Hello] This update fixes an issue where fingerprint sign-in might not work after a cold boot on some devices.

If you've already installed previous updates, your device will download and install only the new updates included in this package.

Known issues in this update

• Remote Desktop connections might fail for non-admin users with error 0xC000000D
• USB audio devices might fail to start or produce no sound

How to get this update

Deployment

If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.

Note

The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.

To ensure the boot.stl file is included as part of the installation media, do one of the following:

• Use the Update WinPE script to update an existing Windows image. (Recommended)
• Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.

For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.

Windows Update

Available

Next Step

Available

This update downloads and installs automatically from Windows Update and Microsoft Update.

File information

For a list of the files provided in this update, download the file information for cumulative update KB5127648.

For a list of the files provided in the servicing stack update, download the file information for the SSU KB5127647 - (Build 26100.9703).

Original source

As announced at FabCon 2026 in Barcelona, we're releasing meaningful enhancements to the Capacity Metrics app in preview, designed to accelerate time to insight. This includes new and enhanced visuals and metrics across the health, compute, and storage pages—alongside improved navigation and a refreshed user interface design. A new item details page builds on the existing item history page, providing key insights for individual items running on the capacity.

The aim is to support key user journeys, including:

• Identifying issues as they happen.
• Reviewing issues that have occurred over the last two weeks.
• Identifying risks before they result in throttling.

Improved experiences

An admin can now land on the health page and quickly identify capacities most in need of review. New metrics introduce easily understandable concepts like percentage of time spent in throttling, which can be compared across capacities and time periods.

Figure: Health summary page displaying capacity health statistics for various services like Health, Compute, Storage, and Autoscale for Spark, with columns for different time periods, utilization, and various types of throttling – providing the capacity admin a view across capacities to help them keep operations smooth.

Once a capacity is identified for further review, the new compute page provides rich detail on the health state of the capacity and the biggest items impacting the capacity for the selected period. Key new visuals include:

• An updated utilization graph which expresses capacity unit (CU) consumption in CU seconds rather than a percentage, making it easy to see if your capacity has been scaled up or down, while also showing the current throttling state through conditional formatting.
• A new heat map visual that shows the capacities most utilized/overutilized state for each hour, making it easy to spot daily or hourly patterns.
• A new CU consumption table, which shows the item impacting the time window being reviewed (to a granularity of 1 hour). The visual shows smoothed CU consumption, meaning this truly reflects the highest impact items for the time being reviewed.

Figure: Compute dashboard with various metrics related to Fabric Capacity, including smoothed and unsmoothed usage percentages, time paused, and time no throttling, as well as different types of rejections and surge protection, all within a specified date range.

Once an item is identified as a possible cause of high utilization, or if the user just wants to see additional detail on the item, the new item details page provides a 14-day history. The page has been designed from the ground up to give detailed insights which were previously unavailable. One key visual is the new CU utilization chart which shows the impact the selected item had on the overall capacity.

Figure: Item details page including a column chart shows the impact the selected item is having on the capacity as a whole, aggregated CU usage across different fields such as users, and detailed information on consumption for the selected item.

Given the new experiences include changes to the existing metrics, it is being released as a preview alongside the existing app generally available experience, allowing time for you to adapt to the new app while still having access to the existing version. When you install the new version of the app, you will see the new preview as an additional option alongside the existing generally available versions of the reports.

Getting started

To support adoption of the new experience, explore the following resources for each new page:

• Existing Fabric Capacity Metrics app users will be notified when an update is available. Select Get it from the notification to update your current installation or install the latest version in a new workspace. Alternatively, you can install the app directly from the Microsoft Marketplace.
• Technical documentation with embedded video guidance:
  • Health page
  • Compute page
  • Storage page
  • Item details page
• User journey documentation, which explains how the app can be used in different situations.

We're excited to put these new capabilities into your hands and look forward to your feedback as we continue evolving the Capacity Metrics experience to help you better understand, manage, and optimize your Fabric capacities.

Original source

Custom SQL Pools in Microsoft Fabric Data Warehouse are now generally available, along with statement type classification.

Custom SQL Pools give administrators more control over how compute resources are allocated across different workloads in a Fabric workspace. You can isolate workloads into separate pools, set maximum resource allocation percentages, and help ensure that one workload doesn’t consume resources intended for another.

For example, you can create separate pools for data ingestion, reporting, and ad hoc analysis, then configure the maximum percentage of compute resources each pool can consume. Custom SQL Pools complement the autonomous workload-management capabilities built into Fabric Data Warehouse while giving organizations additional control for predictable and business-critical workloads.

Classify workloads by statement type

Statement type classification provides a simple way to separate read and write workloads. When configuring Custom SQL Pools, you can classify distributed SQL requests into two categories:

• SELECT for read queries.
• NONSELECT for statements such as data loading and modification operations.

Fabric creates separate pools for the two statement categories, with an initial maximum allocation of 50% for each pool. Administrators can adjust these percentages based on workload requirements, provided their combined maximum allocation doesn’t exceed 100%.

Statement type classification is useful when organizations want to protect interactive reporting capacity from intensive ingestion or data-transformation workloads without relying on application names or connection properties.

Custom SQL Pools also support application-based classification using an exact application name or a regular expression. Administrators can select the classification model that best reflects how workloads connect to and use their Fabric workspace.

Get started

To learn about Custom SQL Pools, supported classifiers, resource allocation, and workload behavior, review the Custom SQL Pools documentation.

For instructions to create and configure pools in the Fabric portal, review the Configure Custom SQL Pools in the Fabric Portal documentation.

Original source

Microsoft Fabric now supports workspace-level private link for SQL database, giving organizations a more targeted way to secure inbound access for sensitive data workloads. A private link is a private network connection that routes traffic over Microsoft’s backbone network instead of the public internet. With workspace-level private link, you can apply that protection to specific workspaces instead of to an entire tenant.

This matters for teams that need stronger network isolation but do not want to lock down every workspace in the environment. Some workspaces may support broad collaboration, while others handle regulated, confidential, or business-critical data. Workspace-level private link helps you protect the workspaces that need tighter controls without forcing the same network posture across the rest of your Fabric environment.

Why this capability is useful

Organizations often need to balance security, operational flexibility, and ease of administration. Tenant-wide controls are useful in some environments, but many teams need a more granular option that matches the sensitivity of a specific project or business unit. Workspace-level private link introduces that flexibility by letting you restrict inbound access at the workspace boundary.

This approach can help teams reduce public exposure, centralize how protected workspaces are managed, and support internal security requirements more precisely. It also gives workspace owners and administrators a clearer path for securing high-sensitivity data experiences without requiring a tenant-wide architecture change. For customers using SQL database in Microsoft Fabric for business applications, analytics workloads, or operational reporting, that translates into stronger control over how users and services connect.

Key benefits include:

• More granular control over which workspaces accept private traffic only.
• Better alignment between workspace security boundaries and project or data sensitivity.
• Greater flexibility than tenant-wide restrictions when only selected workspaces need stronger protection.

How workspace-level private link works

Workspace-level private link maps a workspace to a specific virtual network by using Azure Private Link. When a workspace is configured to restrict inbound public access, that workspace can be reached only through an approved private endpoint. This helps ensure that inbound traffic follows an allowed path rather than arriving from the public internet.

Fabric supports both tenant-level private links and workspace-level private links. Tenant-level private links apply network restrictions across the full tenant, while workspace-level private links secure access to selected workspaces without affecting the rest of the environment. That distinction is important for organizations that want to protect a subset of workspaces while keeping other workspaces open for broader access patterns.

For SQL database in Microsoft Fabric, this preview makes it possible to use the database experience inside workspaces that are secured with workspace-level private link. That gives teams a clearer way to combine SQL database workloads with workspace-scoped inbound network protection as part of a broader security design.

Common scenarios

Workspace-level private link is especially useful when a team needs to isolate one workspace without changing the connectivity model for the full tenant. For example, a finance, legal, or healthcare analytics team may need to restrict inbound access to a workspace that contains sensitive data, while product or reporting workspaces remain accessible through a broader model. This lets organizations align security boundaries more closely to business use.

It is also useful when different projects in the same tenant have different compliance or network requirements. One workspace may need strong inbound protection because it supports confidential customer data, while another workspace may be designed for wider collaboration. Workspace-level private link supports that mixed model more naturally than a single tenant-wide setting.

Set up workspace-level private link

You can set up workspace-level private link by using the public guidance in Set up and use workspace-level private links. The exact implementation depends on your environment, but the core flow in Fabric is straightforward once the required Azure networking configuration is in place.

Use this high-level process:

• Create a new workspace or open an existing workspace that you want to secure.
• Set up the required Azure Private Link resources by following Set up and use workspace-level private links.
• In the workspace, open Workspace settings.
• Select Inbound network.
• Under the workspace connection settings, select Allow connections from selected networks and workspace-level private links.
• Save your changes and validate access from the approved private network path.

After configuration is complete, all connections must flow through the approved private endpoint path associated with the workspace. Access then flows through the approved private endpoint path associated with the workspace. This model gives administrators a more precise way to protect inbound connectivity while keeping the implementation tied to a specific workspace instead of the entire tenant.

What customers gain

The value of this preview is not only stronger protection, but also better fit. Many organizations do not need the same inbound network posture everywhere, and they should not have to choose between leaving sensitive workspaces open or applying a tenant-wide restriction that affects every team. Workspace-level private link gives customers another option that is easier to align with real project boundaries.

For teams using SQL database in Microsoft Fabric, that means they can bring secure workspace-level network controls into environments where SQL development, administration, and data access are already happening. This can simplify security conversations across product, platform, and network teams because the protection boundary is clear and directly attached to the workspace that holds the workload. It also supports a more intentional security design for workspaces that contain data with higher sensitivity.

Plan your rollout

Before enabling workspace-level private link, identify which workspaces truly need inbound access restrictions and which workspaces are intended for broader collaboration. That planning step helps teams apply the capability where it adds value instead of widening administrative overhead unnecessarily. It also makes it easier to coordinate security, networking, and workspace ownership decisions upfront.

As part of rollout planning, review the workspace-level private links overview and the private links for Fabric overview. Those articles explain how workspace-level private links relate to tenant-level private links and how Fabric uses private endpoints for secure inbound access.

Get started

Workspace-level private link for SQL database in Microsoft Fabric gives teams a more granular way to secure inbound access for selected workspaces. If you want stronger network isolation for sensitive SQL database workloads without applying tenant-wide restrictions, this preview is a practical place to start.

To take the next step, review Set up and use workspace-level private links and the workspace-level private links overview. Then identify the workspaces in your environment that would benefit most from workspace-scoped inbound protection and begin validating the setup with your security and networking teams.

For any issues related to this preview, please create a support ticket.

Original source

[1.21.0] - 2026-10-08

Added

• agent-framework, agent-framework-core, agent-framework-purview: Add tool-result standing guidance, expose rewritten variable-expansion arguments, and support full-buffer Purview policy evaluation for streamed responses (#8784, #8506, #8702)
• agent-framework-openai: Add the maximum reasoning-effort option (#8857)
• agent-framework-oracle: Add the alpha Oracle native vector-store connector (#8676)
• samples: Demonstrate group-chat response filtering and expand the get-started sample progression (#9005, #9133)

Changed

• agent-framework-core, agent-framework-foundry, agent-framework-github-copilot: Isolate provider-owned service session state when agents are invoked as tools (#8853)
• agent-framework-anthropic: Update the Anthropic SDK to 1.11 and adapt Anthropic and Bedrock client behavior (#9119)
• agent-framework-github-copilot: Update the GitHub Copilot SDK to 1.0.16 (#9135)
• agent-framework-devui: Update source-map-js, Radix UI Scroll Area, tailwind-merge, Tailwind CSS and its Vite plugin, and patch brace-expansion 1.x (#9104, #9154, #9155, #9156, #8888)
• agent-framework-azure-contentunderstanding, agent-framework-azure-cosmos-memory, samples: Normalize Foundry project endpoint configuration and examples (#9070)
• agent-framework-foundry: Clarify Foundry agent-tool ownership and lifecycle behavior (#8852)
• agent-framework-foundry-hosting: Warn against hosting a WorkflowAgent through the agent= shortcut (#9146)
• agent-framework-hyperlight, agent-framework-monty: Warn when CodeAct tools cannot support FIDES security enforcement (#9175)
• agent-framework-hosting: Persist the session in the hosting quickstart (#9030)
• docs: Add the AI-assisted contribution policy and issue-first contribution workflow (#9134)
• samples: Update multidict and source-map-js lockfiles and make file-access samples type-check on Windows (#9105, #9145, #9161)
• tests: Update Python GitHub Actions dependencies (#9038, #9039, #9158)
• tests: Isolate the mixed-middleware warning assertion (#9001)
• tests, samples: Refresh Python development dependencies and type-checker compatibility (#9190)

Fixed

• agent-framework-core: Run local sibling tools in declaration-only mixed batches, serialize shared file edits, correct data URI validation and media detection, warn when streamed result gates lack buffering, and handle flat function mappings in progressive tool-name checks (#9050, #9032, #8918, #9029, #9117)
• agent-framework-ag-ui, agent-framework-core: Close delegated provider streams when public streams are released while preserving primary failures during cleanup (#9100)
• agent-framework-declarative: Preserve falsy values returned by Power Fx Search() (#8974)
• agent-framework-devui: Page checkpoint item listings and scope function approvals to their conversations (#9126, #9180)
• agent-framework-gemini, agent-framework-ollama: Close SDK streams when consumers stop early (#9144)
• agent-framework-hosting: Avoid retaining per-session locks after runs complete (#9172)
• agent-framework-hosting-responses: Parse input messages that omit the optional type field (#9124)
• agent-framework-openai: Preserve streamed log probabilities across empty chunks (#8997)
• agent-framework-orchestrations: Reject unknown group-chat participants and sanitize generated handoff tool names (#9026, #9035)
• agent-framework-foundry-hosting: Preserve Foundry Toolbox container-file citations and refresh stale Toolbox call IDs (#9055, #9059)
• agent-framework-typesafe: Honor proxy environment variables in connector-owned clients (#8984)
• agent-framework-bedrock: Preserve extended-thinking reasoning content across tool calls (#8936)
• agent-framework-tools: Preserve table-formatted output in persistent PowerShell sessions (#9043)

Full Changelog: python-1.20.0...python-1.21.0

Original source