This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 89%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDD%3C/text%3E%3C/svg%3E)
Hi,
I would like to clear up some confusion regarding security updates for SQL Server 2019. If Security update for SQL Server 2019 CU 25 KB5036335 is pushed out by our System Engineers team to a server, does that mean it includes the Cumulative Update 25 (CU25), Cumulative Update 24 (CU24) and CU 23 and so on?
Currently, our process is to uninstall the security update for CU 25 first and install the latest Cumulative Update such as Cumulative Update (CU20) and would like to know if that is necessary to do. Does installing the latest Security Update for Sever 2019 CU 25 give you those previous CUs.
Please let me know
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hello,
KB5036335 is the cumulative update to SQL Server 2019 that includes previous updates and will make improvements to them.
So, you don't need to install CU20. You just need to install the latest cumulative update.
You can download updates from this link:
https://www.catalog.update.microsoft.com/Search.aspx?q=KB5036335
Best Regards,
Hania Lian
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Hi Hania, so I would still need to install the CU 25 even though I've installed the Security Update for CU 25 or no? Does the Security Update include the Cumulative Update 25 as well?
The most recent Cumulative Update for SQL 2019 is CU26, so I would suggestion that you install that version. It includes the security fix.
You can take "cumulative updates" by it's name: They are cumulative and include all previous CU, you only need to install only the latest CU.
Hi Olaf, thanks for your response. My question was more in regards to the Security Update for CU 25. Do I need to still install the CU 25 patch if I have applied the Security Update for CU 25? See below as when I look at the following it states this replaces CU 25 and CU 24
Hi there David D. Lengar
I get where the confusion might come from. The thing is, when you install a security update like KB5036335 for SQL Server 2019, it's primarily focused on fixing specific security vulnerabilities within the software. It doesn't necessarily bundle all the improvements and fixes from previous cumulative updates (CUs).
Cumulative updates (CUs), on the other hand, are more comprehensive. They not only include security fixes but also other enhancements, bug fixes, and improvements to the SQL Server product.
So, if your System Engineers team pushes out a security update like KB5036335, it's essential to understand that it's primarily about security, not about rolling up all the updates from previous CUs.
Hope this helps clarify things for you!
If this helps kindly accept the answer thanks much.
Hi Azar, thank you for your response. When I review the Security Update for SQL Server 2018 RTM CU (KB5036335) states it replaces the following updates...Cumulative Update 24, Cumulative Update 25 and the Security update for SQL Server 2019 (KB5029378). Does that not mean it includes the previous updates inside this Security Update. I also look at the size and it is bigger than the previous updates CU 24 and CU25 so aren't those bundled into this Security Update?
Yes. A GDR for CU 25 is a GDR for CU 25. And CU 25 includes all patches in CU 24 and so on.
Hi Erland, so this security update for SQL Server CU 25 (KB 5036335) does NOT include CU 25 and CU 24 patches and so on correct? Even though the following above states it replaces CU 25, it will NOT include the features from CU 25 correct?
Absolutely not correct. It is an update to CU 25, which means that you get everything that is in CU25 + the security fix.
But I said initially, the best is to go for CU26 which has the security fixes and more fixes to CU25.
Ok thank you for your response
checking if this helped, kindly accept the answer it it did thanks.
