SQL Server End of Life: 2016 Was Named in 90% of SQL Server 2017 Flaws Until Support Ended. Since Then, 0 of 45

SQL Server end of life status on October 15, 2026: 2022 and 2025 are in mainstream support, 2017 and 2019 in extended support, 2014 and 2016 on paid Extended Security Updates only, and 2008, 2008 R2 and 2012 unsupported. SQL Server 2016 left extended support on Jul 14, 2026. In September, Microsoft listed 45 CVEs for SQL Server 2017 and none for 2016.

Each bar runs from release to the last day of any Microsoft security coverage (blue mainstream, light blue extended, red paid ESU, pink Azure-only ESU); the dark tick is today. “Last security update” is the newest GDR security build in Microsoft’s SQL Server build list. CVE counts run January to September 2026.

SQL Server end of life dates for every version

All dates come from Microsoft’s Lifecycle pages. The pages store UTC timestamps, which Microsoft displays in Pacific time; we converted them the same way. Every extended support end and ESU end matches the endoflife.date API, and so does every mainstream end we could compare.

SQL Server 2019’s mainstream support ended on February 28, 2025, not on a Patch Tuesday. Microsoft’s SQL Server ESU FAQ says 2014 ESUs run “until July 8, 2027”, but its lifecycle page and its ESU planning page both say July 12, 2027, which is the date used here. Likewise, the FAQ gives July 9, 2023 for the end of 2008 and 2008 R2 support in Azure, while the lifecycle pages say Jul 11, 2023.

A stepped timeline: how many versions still get free fixes

The step chart counts SQL Server versions in each support phase, month by month. Each blue step up is a release; each step down is a version leaving extended support, the point after which security fixes cost money. As of October 2026, 4 versions get security updates for every customer and 2 get them only for paying ESU customers.

The next three steps come close together. SQL Server 2014’s last ESU year ends Jul 12, 2027, 270 days from now. SQL Server 2017 leaves extended support Oct 12, 2027, and its lifecycle page lists no ESU years at all. After that, the oldest version with free security fixes will be SQL Server 2019, until Jan 8, 2030.

SQL Server 2016 end of life: what changed on July 14, 2026

Microsoft’s July 14, 2026 security release was SQL Server 2016’s last in extended support. It listed 2016 as affected by 4 of the month’s 7 SQL Server CVEs, and Microsoft’s build list shows the last 2016 security builds (GDR for SP3 and for the Azure Connect feature pack) that month. ESU Year 1 runs Jul 15, 2026 to Jul 13, 2027, and Year 3 ends Jul 17, 2029.

Then the listings stopped. The next SQL Server release, in September 2026, was the largest in our data: 62 CVEs, 4 rated Critical. Microsoft listed 45 of them for SQL Server 2017 and none for 2016. From January 2017 to July 2026, 100 of the 111 CVEs Microsoft listed for SQL Server 2017 (90%) were also listed for 2016. The code did not change on July 14. The support status did.

Does an out-of-support SQL Server still get vulnerabilities?

To test it, we downloaded every monthly Microsoft security release from January 2017 to September 2026 through the MSRC CVRF API and recorded, for each CVE, the SQL Server versions Microsoft lists as known affected. The matrix shows every release from 2021 on that included a SQL Server CVE. Read across a row and the pattern is plain: a version is listed in nearly every batch while it is supported, then drops to zero at the end of extended support, even in years when it is still sold ESUs.

Numbers are unique CVEs Microsoft lists as affecting each version in that monthly release. The top row is all SQL Server CVEs in the release. Cells outlined in red were ESU years. The boxed cell is September 2026 for SQL Server 2016. Months with no SQL Server CVE are omitted.

So how many CVEs hit out-of-support SQL Server versions after their end of support? By Microsoft’s own listings, very few: 5 CVEs across all five versions, all in February and April 2023, and none since. In the same windows Microsoft published dozens to hundreds of SQL Server CVEs for newer versions:

“Before end” covers January 2017 to the month extended support ended. The 2008 and 2012 windows include CVEs listed during ESU years; every one of the 5 came in February or April 2023. For 2014, the “before” share was 9 of 9 through June 2024; the drop came in July 2024, as described below.

The zero is not evidence that old versions are safe. It is evidence that Microsoft stops assessing them. SQL Server 2014 is the clearest case. From January 2021 to June 2024, all 9 of the 9 CVEs listed for SQL Server 2016 were also listed for 2014. On July 9, 2024, 2014’s final day of extended support, Microsoft listed 37 CVEs for 2016 and 0 for 2014. Since then: 52 more for 2016 (1 Critical), and 0 for 2014. Microsoft’s build list shows the last SQL Server 2014 security build in October 2023.

What SQL Server ESU buyers actually get

Microsoft’s SQL Server ESU FAQ is specific: ESUs “include Security Updates and Bulletins rated Critical” by MSRC, delivered “if and when available”, with “no regular release cadence”. Most SQL Server CVEs are rated Important. Of the 77 SQL Server CVEs from January to September 2026, 6 were Critical.

That rule makes September 2026 a useful test. Microsoft listed 4 Critical remote code execution flaws in SQL Server that month, the kind of fix ESUs exist to deliver. None lists SQL Server 2016:

• CVE-2026-67378 Critical remote code execution listed for SQL Server 2019, 2022, 2025
• CVE-2026-67631 Critical remote code execution listed for SQL Server 2017, 2019, 2022, 2025
• CVE-2026-67636 Critical remote code execution listed for SQL Server 2019, 2022, 2025
• CVE-2026-67643 Critical remote code execution listed for SQL Server 2022, 2025

Microsoft does not say whether 2016 is affected by any of them; it simply does not list it. Two months earlier, CVE-2026-54118, also a Critical SQL Server remote code execution flaw, was listed for every version from 2016 to 2025, but not for 2014, which was then in its second paid ESU year. SQL Server 2012’s ESU years looked different: Microsoft listed 5 CVEs for 2012 during them, all rated Important, in February and April 2023.

SQL Server CVEs per version per year

SQL Server is a small slice of Microsoft’s patch load, but it is growing fast. The 77 SQL Server CVEs from January to September 2026 are seven times the 11 in the same months of 2025, in line with the jump in total fixes in our Patch Tuesday statistics for 2026 and the rise in published vulnerabilities in our CVE statistics for 2026. Most of the increase came in one release: 62 CVEs in September 2026.

Unique CVEs Microsoft lists as affecting each version, with Critical counts below. Shading marks ESU years (red) and unsupported years (grey), judged at mid-year (2026 at September). *2026 is January to September. Each CVE is counted once, in the first monthly release that lists a SQL Server version for it. “Any version” is not the sum of the rows, because most CVEs affect several versions.

What SQL Server Extended Security Updates cost

Microsoft publishes its Arc ESU rates in the Azure price list, per core per hour. We confirmed the unit against the Arc pay-as-you-go license meter, which matches the per-core hourly rate on Microsoft’s SQL Server pricing page ($0.100 Standard, $0.375 Enterprise).

USD list prices from the Azure Retail Prices API (Global region; 2016 meters effective April 2026). Yearly figures use 8,760 hours. The smallest billable Standard VM (4 cores) comes to about $6,658 a year, Enterprise to about $25,930. The price list also carries “Azure ESU 2016” meters at the same $0.19 and $0.74 rates, but Microsoft’s documentation does not say which deployments they bill. Microsoft’s current pages do not publish a volume-licensing ESU price for SQL Server; they direct buyers to their account team. Partner pricing may differ.

For comparison, Microsoft’s open no-level price for a new SQL Server 2022 Standard license is $3,945 per 2-core pack, and $15,123 for Enterprise. One year of Standard ESU per core costs 84% of a perpetual Standard core license; Enterprise, 86%. Running SQL Server 2022 Standard pay-as-you-go through Arc costs $0.100 per core-hour, about half the 2016 ESU rate.

Which SQL Server versions run on which Windows Server

SQL Server and Windows Server deadlines overlap. Windows Server 2016 leaves extended support on January 12, 2027, as covered in our Windows Server end of life report. Microsoft’s compatibility matrix limits where an old SQL Server can land:

From Microsoft’s “Version requirements for SQL Server in Windows operating system” (KB 2681562). “Yes (SP3)” means the service pack level required. SQL Server 2008 and 2008 R2 are not supported on any of these four; SQL Server 2012 SP4 is supported on Windows Server 2016 and 2019 only.

A SQL Server 2016 or 2017 instance cannot move to Windows Server 2025 in a supported way. Moving the database engine to SQL Server 2019 or later is the precondition for retiring Windows Server 2016 on time.

What this means for MSPs

Frequently asked questions

Is SQL Server end of life?

Some versions are. On October 15, 2026, SQL Server 2022 and 2025 are in mainstream support, 2017 and 2019 are in extended support, 2014 and 2016 get only paid Extended Security Updates, and 2008, 2008 R2, and 2012 get no updates at all. SQL Server 2016 left extended support on July 14, 2026.

When does SQL Server 2016 reach end of life?

Extended support for SQL Server 2016 ended on July 14, 2026. Paid Extended Security Updates run until July 17, 2029. In September 2026, the first SQL Server release after that date, Microsoft listed 45 CVEs for SQL Server 2017 and none for 2016.

When does SQL Server 2017 support end?

Extended support for SQL Server 2017 ends on October 12, 2027, 362 days after October 15, 2026. Microsoft’s lifecycle page lists no Extended Security Update years for 2017. Mainstream support ended on October 11, 2022.

Does SQL Server 2017 work on Windows Server 2025?

Not as a supported combination. Microsoft’s compatibility matrix lists SQL Server 2017, 2016, and 2014 as not supported on Windows Server 2025. SQL Server 2019, 2022, and 2025 are supported there. SQL Server 2017 is supported on Windows Server 2022 and 2019.

How much do SQL Server Extended Security Updates cost?

Through Azure Arc, Microsoft’s price list charges $0.19 per core per hour for Standard edition and $0.74 for Enterprise, for both 2014 and 2016. That is about $1,664 and $6,482 per core per year, with a 4-core minimum per VM. SQL Server 2014 ESUs are free on Azure VMs; 2016 ESUs are not.

What happens when SQL Server reaches end of support?

Microsoft stops listing the version in its security data. Across 2008, 2008 R2, 2012, 2014, and 2016, Microsoft has listed only 5 CVEs for any of them after extended support ended, the last in April 2023, while 226 SQL Server CVEs were published from August 2019 to September 2026.

Methodology

References

1. Microsoft Lifecycle, SQL Server 2008. Accessed October 2026.
2. Microsoft Lifecycle, SQL Server 2008 R2. Accessed October 2026.
3. Microsoft Lifecycle, SQL Server 2012. Accessed October 2026.
4. Microsoft Lifecycle, SQL Server 2014. Accessed October 2026.
5. Microsoft Lifecycle, SQL Server 2016. Accessed October 2026.
6. Microsoft Lifecycle, SQL Server 2017. Accessed October 2026.
7. Microsoft Lifecycle, SQL Server 2019. Accessed October 2026.
8. Microsoft Lifecycle, SQL Server 2022. Accessed October 2026.
9. Microsoft Lifecycle, SQL Server 2025. Accessed October 2026.
10. Microsoft, SQL Server end of support options. Accessed October 2026.
11. Microsoft, What are Extended Security Updates for SQL Server? Accessed October 2026.
12. Microsoft, SQL Server Extended Security Updates: Frequently asked questions. Accessed October 2026.
13. Microsoft, SQL Server Extended Security Updates enabled by Azure Arc. Accessed October 2026.
14. Microsoft, Plan your Windows Server and SQL Server end of support. Accessed October 2026.
15. Microsoft, Latest updates and version history for SQL Server. Accessed October 2026.
16. Microsoft, Version requirements for SQL Server in Windows operating system (KB 2681562). Accessed October 2026.
17. Microsoft, SQL Server 2022 pricing. Accessed October 2026.
18. Azure Retail Prices API. Accessed October 2026.
19. MSRC CVRF API v3.0 and Security Update Guide API. Accessed October 2026.
20. endoflife.date API, Microsoft SQL Server (cross-check). Accessed October 2026.