Security Updates for Microsoft SQL Server April 2023: Critical Patches and System Impact Guide

Microsoft’s April 2023 security updates for SQL Server close critical gaps that could let attackers hijack your databases—some with just a single malicious email.

Imagine waking up to find your production servers locked down by ransomware, all because a zero-day flaw in SQL Server 2019 went unpatched. Microsoft’s April fixes address exactly that, including 12 CVEs rated Critical or Important, with exploits already circulating in the wild.

These updates aren’t just about stopping attacks—they also tweak how your systems handle authentication and encryption, which could break legacy apps if you skip testing. The good news? Most patches install in under 10 minutes with minimal downtime, but the wrong approach risks leaving your data exposed.

Here’s what’s changed, which versions need urgent attention, and the exact steps to apply these fixes without crashing your workflows—plus the one check every admin misses after installation.

Critical SQL Server vulnerabilities fixed in April 2023 security updates

Microsoft’s April 2023 security updates for SQL Server address 12 critical vulnerabilities, including remote code execution (RCE) flaws that could let attackers compromise your databases. These patches cover SQL Server 2019, 2017, 2016, and Azure SQL Database, with some affecting even older versions.

The most severe issues—like CVE-2023-28290—allow attackers to execute malicious code with SYSTEM privileges without authentication.

Among the patched flaws, elevation of privilege bugs (e.g., CVE-2023-28289) could let low-privilege users escalate to admin access, while denial-of-service (DoS) vulnerabilities (e.g., CVE-2023-28287) could crash services by sending malformed packets.

The updates also fix memory corruption issues in the SQLOS component, which could lead to arbitrary code execution if exploited.

Here’s a breakdown of the most dangerous vulnerabilities and their real-world risks:

The CVE-2023-28290 flaw is particularly alarming because it doesn’t require authentication—meaning attackers could exploit it remotely without credentials. Microsoft’s advisory warns that this vulnerability could be weaponized in wormable attacks, spreading rapidly across unpatched networks.

If your SQL Server is exposed to the internet (e.g., via SQL Server Browser or port 1433), you’re at higher risk.

Another critical issue, CVE-2023-28288, stems from memory corruption in the SQLOS layer. This could allow attackers to execute arbitrary code by sending specially crafted queries, bypassing security controls. Microsoft notes that this vulnerability is exploitable in default configurations, meaning no additional user interaction is needed for exploitation.

For organizations using Azure SQL Database, CVE-2023-28291 poses a unique threat: it could expose sensitive data if attackers exploit misconfigured firewall rules or network endpoints. Unlike on-premises SQL Server, Azure instances may have different attack vectors, such as cross-tenant vulnerabilities if multi-tenancy is enabled.

Microsoft’s April 2023 updates also include fixes for third-party components like OpenSSL and Schannel, which are embedded in SQL Server. For example, CVE-2023-0465 (OpenSSL) could allow attackers to decrypt TLS traffic if weak key exchange algorithms are used.

While this isn’t SQL Server-specific, it highlights the importance of patching all layers of your infrastructure.

To mitigate risks, prioritize applying these updates to public-facing SQL Server instances first. If you’re using SQL Server Always On Availability Groups, test patches in a non-production environment before deploying to avoid disrupting failover clusters.

Microsoft recommends using Windows Update or the Microsoft Update Catalog to download and install the patches.

After applying the updates, monitor your SQL Server error logs for unusual activity, such as failed logins or unexpected service restarts. Tools like SQL Server Audit or Azure Monitor can help detect anomalous behavior post-patch. For high-severity vulnerabilities like CVE-2023-28290, consider implementing network segmentation to limit exposure.

Proactively, review your SQL Server hardening guide to ensure you’ve disabled unnecessary services (e.g., SQL Server Browser) and applied least-privilege access. Microsoft’s Security TechCenter