Tuesday 14 July 2026 is this month's Patch Tuesday — and for SQL Server 2016 it is the last appointment of its life: with extended support ending, the updates shipped this week are the last Microsoft will ever publish for this version. We covered the exit strategy — upgrading to SQL Server 2022, Azure SQL, Extended Security Updates — in last week's guide. This piece is more down to earth: what to do this week, in the right order. We will update this article with the details of the updates as soon as Microsoft publishes them on Tuesday evening.
Why the last patch matters more than the others
After Tuesday, every new vulnerability discovered in SQL Server 2016 stays open forever— unless you pay for ESU. And new vulnerabilities will come: SQL Server 2017, 2019 and 2022 share large parts of their codebase with 2016, and every time Microsoft fixes an issue in those versions, researchers and attackers will check whether the flaw also exists in 2016 — where, however, no patch will ever arrive. This is the mechanism that makes out-of-support systems easier targets month after month: you don't need to find a new flaw, you just wait for an old one to surface.
That is why the final update must be installed everywhere, even on instances that will migrate soon: it is the safest possible starting point for the transition months.
The inventory: the instances you don't know you have
Field experience says something precise: SQL Server 2016 rarely survives on the main database, which someone watches — and far more often in the SQL Express instances installed by business applications: accounting, production, time and attendance, badge systems, antivirus consoles, phone systems. They are the same engine, with the same vulnerabilities, but nobody thinks of them as “a database”: they are part of the application, and that is why nobody patches them.
- Look for services, not icons. On every server (and on clients used as mini-servers) check the Windows services:
MSSQLSERVERis the default instance,MSSQL$NAMEare named instances — typical of Express installs shipped with business software. - Verify the version with a query.
SELECT @@VERSIONon the instance: if the build starts with 13.0, it is SQL Server 2016. The last supported servicing level is Service Pack 3: anyone behind must reach SP3 first to receive the final update. - Ask your application vendors.For every Express you find, there is one question for the vendor: “is the application certified on SQL Server 2019 or 2022?”. The answer decides that instance's path — and its timeline.
This week's checklist
| When | What to do |
|---|---|
| Today and tomorrow | Inventory the instances (services + @@VERSION) and verify your backups: a tested backup before patching is not bureaucracy, it is the safety net. |
| From Tuesday evening | Apply the final security update (GDR) to all 2016 instances, Express included — planning restarts with your application vendors. |
| By the end of the month | Decide the path for each instance: upgrade to SQL Server 2022, Azure SQL, or ESU via Azure Arc as a bridge. The criteria are in the dedicated guide. |
| While you stay on 2016 | Reduce exposure: no access from the Internet, network segmentation, minimal access rights, active monitoring. An out-of-support database must be treated as a delicate guest, not as any other service. |
ESU via Azure Arc, in practice
For instances that cannot migrate quickly — typically because the business application is not yet certified on later versions — Extended Security Updates are the official bridge: security-only updates until 17 July 2029, subscribed by connecting the server to Azure Arc, which delivers and bills them as a monthly subscription — no enterprise agreements, with a cost that increases year over year precisely to remind you it is a bridge, not a destination. Arc onboarding takes a few hours and brings centralised inventory and monitoring for on-premises servers as a bonus.
Our model
For those without an internal IT contact who can dedicate this week to it: we do exactly this — instance inventory, final update rollout, ESU activation where needed and a migration plan, as part of our support and operations service and server virtualisation projects.
Sources
- Microsoft Learn — “SQL Server 2016 end of support” and “Extended Security Updates for SQL Server”
- Microsoft Lifecycle — SQL Server 2016 (extended support ends: 14 July 2026)
- Microsoft Security Update Guide (MSRC) — July 2026 Patch Tuesday updates
Dig deeper
Frequently asked questions
Answers to the most common questions about the final SQL Server 2016 patches.
No: it keeps working exactly as before. What ends is extended support — and with it, security patches. Every vulnerability discovered from 15 July onwards stays open forever, unless you subscribe to Extended Security Updates (ESU) via Azure Arc, available until 17 July 2029. The risk is not a shutdown: it is exposure that grows over time.
The most direct way is to run SELECT @@VERSION on the instance: SQL Server 2016 reports build 13.0.x. Alternatively, look for Windows services starting with MSSQL$ (named instances, typical of Express installs shipped with business applications) or MSSQLSERVER. The last supported servicing level is Service Pack 3: anyone behind must reach SP3 first to receive the final update.
Yes — probably more than those with a DBA: Express is the same engine as SQL Server, with the same vulnerabilities, but nobody looks after it because “it is part of the application”. It is the most common way SQL 2016 survives in a company. It must be inventoried, updated with the last patch and included in the migration plan — coordinating with the application vendor on compatibility with later versions.
Yes, without hesitation. A migration takes weeks or months, and during that time the instance stays in production: the final update is the safest possible starting point. Moreover, when Microsoft fixes future vulnerabilities in SQL 2017, 2019 and 2022, researchers and attackers will check whether they also affect 2016: an instance stuck on an old build is the easiest target in the chain.
Extended Security Updates are security-only updates (critical and important) that Microsoft sells after end of support. For SQL Server 2016 you subscribe by connecting the server to Azure Arc, which delivers and bills them as a subscription: they cover until 17 July 2029, with a cost that increases year over year. They are a bridge to plan the migration calmly, not a destination.