If your accounting system runs on a server at your premises with a SQL Server database, this month brings three pieces of news worth a few minutes: on 13 October 2026 Microsoft released security updates for several SQL Server versions, fixing flaws that include remote code execution; SQL Server 2016 has been out of support since July; and Windows Server 2016 reaches end of support on 12 January 2027. This article summarises the official sources and sets out a practical plan for business owners and IT staff.
What did Microsoft release on 13 October 2026?
As part of Patch Tuesday, Microsoft published security updates for supported SQL Server versions. For example:
| Version | Update | Build | What it fixes |
|---|---|---|---|
| SQL Server 2022 | CU27 GDR – KB5126934 | 16.0.4305.5 | 21 CVEs: 8 remote code execution, 7 elevation of privilege, 4 information disclosure, 2 denial of service |
| SQL Server 2017 | GDR – KB5128497 | 14.0.2140.2 | 13 CVEs |
| SQL Server 2025 | CU9 GDR – KB5126967 | 17.0.5015.4 | Security update in the same cycle |
SQL Server 2019 updates were released too. The key point: choose the package that matches the servicing branch you have installed (GDR or CU), not just the release year, as AxioWorks’ summary of these updates points out.
Known issues to read before installing
- Linked servers using MSDASQL: Microsoft documents that linked-server queries using the MSDASQL provider with a provider string may fail with error 7416 because of stricter connection validation.
- SQL Server 2022: an access violation can occur when querying sys.dm_exec_requests during database recovery; Microsoft documents workarounds on the update page.
So never install straight onto a production server without a verified backup and a rollback plan.
Support dates that affect business servers
From Microsoft’s 2026 end-of-support page and the Windows Server blog:
| Product | Status | Date |
|---|---|---|
| SQL Server 2016 | End of support | 14 July 2026 |
| SQL Server 2014 (Extended Security Updates, year 2) | Ended | 14 July 2026 |
| Windows Server 2012 and 2012 R2 (ESU, year 3) | Ended | 13 October 2026 |
| Windows Server 2022 | Moved to extended support | 13 October 2026 |
| Windows Server 2016 | End of extended support | 12 January 2027 |
Microsoft has announced paid Extended Security Updates (ESU) for Windows Server 2016, delivered through Azure Arc, and recommends upgrading to Windows Server 2025 or moving to Azure. The blog does not state ESU pricing or duration.
Why this matters to a business owner
The database server holds everything: invoices, customer balances, payroll and employee data. An unpatched server, or one on a version that is out of support, leaves every new vulnerability open. It is not only about security: e-invoices and accounting records must be kept for many years, and a compromised or failed server puts that whole archive at risk.
A practical plan for your ERP server
- Know what you run: the Windows Server version, the SQL Server version and build (a SERVERPROPERTY query shows it), and the GDR or CU servicing branch.
- Take a verified backup before any update, and test an actual restore on another machine.
- Install the October update in an out-of-hours maintenance window, then confirm the new build, error logs and scheduled jobs.
- Test afterwards: log in to the system, post an invoice, print a report, and check scheduled backups and any linked servers.
- Plan for out-of-support versions: if you run SQL Server 2016 or Windows Server 2016, budget and schedule the upgrade before January 2027 rather than waiting.
- Make it a monthly habit: Microsoft ships updates every month, and a production server deserves a monthly review, not a yearly one.
Backups: the last line of defence
Updates lower the chance of a breach, but they do not protect you from a failed disk, ransomware or human error. So:
- Three copies: one on the server, one on separate media, and one off-site or offline.
- At least daily backups of the accounting database, plus an extra copy before month-end close.
- Test restores every quarter: a backup that has never been restored cannot be relied on.
- Restrict access to the backup location, so whoever reaches the server does not automatically reach the backups.
RivDesktop or Riv-ERP Cloud? A question of who runs the server
RivDesktop is a Windows application with a SQL Server database, installed on your own server, so the data stays with you and under your control, with local-network speed at the cashier and warehouse. It also means server updates and backups are your responsibility, which suits businesses that want full control over their data. Read the RivDesktop guide.
If you would rather not buy a server or manage in-house backups, Riv-ERP Cloud runs in the browser on Oracle Cloud servers with an Oracle database and no server at your premises. For a detailed comparison, read the edition comparison.
Frequently Asked Questions
When did Microsoft release the latest SQL Server security updates?
On 13 October 2026, covering versions including SQL Server 2025, 2022, 2019 and 2017. The SQL Server 2022 update alone fixes 21 CVEs, eight of them remote code execution.
Is SQL Server 2016 still supported?
No. SQL Server 2016 reached end of support on 14 July 2026, according to Microsoft’s product lifecycle page.
When does Windows Server 2016 support end?
On 12 January 2027, with paid Extended Security Updates available through Azure Arc and Microsoft recommending an upgrade to Windows Server 2025.
Do I need a server to use Riv-ERP?
RivDesktop is installed on a server at your premises with SQL Server, while Riv-ERP Cloud runs in the browser on Oracle Cloud servers and needs no in-house server.
Book a demo: 📲 +966 55 200 7190 · ✉️ Info@riv-erp.com
See Riv-ERP in action
Two editions: RivDesktop on your own server, or Riv-ERP Cloud on Oracle Cloud.
Book a demo
