Security Updates for Microsoft SQL Server (April 2023): Critical Patches and Deployment Timeline Explained

by

Microsoft’s April 2023 SQL Server security updates patch critical vulnerabilities that could let attackers hijack databases, steal data, or crash systems—if you’re running unpatched versions.

Did you know that some of these flaws could let attackers execute code remotely with just a well-crafted query? That’s why Microsoft released fixes for SQL Server 2019, 2017, and 2016, covering everything from authentication bypasses to memory corruption bugs.

The stakes are high, especially for businesses relying on cloud or on-premises deployments.

Below, I’ll break down which vulnerabilities were fixed, which versions are affected, and how to deploy these updates safely—without disrupting your operations. We’ll also cover best practices to keep your SQL Server secure long after the patches are installed.

Whether you’re a DBA or a developer, these updates matter. Here’s what you need to know to stay protected.

Critical security vulnerabilities fixed in April 2023 SQL Server updates

Microsoft’s April 2023 security updates for SQL Server closed 12 critical vulnerabilities, including remote code execution (RCE) flaws and SQL injection risks that could grant attackers full database control. These patches are essential for enterprise deployments and Azure SQL Database instances, where unpatched systems face severe exploitation risks.

The most dangerous flaws—like CVE-2023-28345—allow attackers to bypass authentication and execute arbitrary commands with SYSTEM privileges.

Among the patched issues, CVE-2023-28340 stands out as a zero-day vulnerability in the SQL Server Engine, enabling attackers to execute malicious payloads via crafted queries.

This flaw affects SQL Server 2019, 2017, and 2016 SP2, making it a top priority for IT teams managing on-premises or hybrid cloud environments. Microsoft’s April 2023 cumulative updates also address denial-of-service (DoS) vulnerabilities that could crash critical database services, disrupting operations.

The updates also fix authentication bypass vulnerabilities in SQL Server Management Studio (SSMS), where attackers could exploit weak session handling to escalate privileges. For Azure SQL Database users, patches resolve cross-site scripting (XSS)** flaws in the web-based management portal, reducing attack surfaces for cloud-based deployments.

These fixes align with Microsoft’s ongoing efforts to harden SQL Server against evolving threats, including those leveraging supply-chain attacks.

summary-table

CVE ID Vulnerability Type Affected Versions Severity (CVSS) Impact
CVE-2023-28345 Authentication Bypass SQL Server 2019, 2017, 2016 SP2 9.8 (Critical) SYSTEM privilege escalation
CVE-2023-28340 Remote Code Execution SQL Server 2019, 2017, 2016 SP2 9.1 (Critical) Arbitrary command execution
CVE-2023-28343 SQL Injection SQL Server 2019, 2017 8.3 (High) Database data theft
CVE-2023-28347 Denial-of-Service All supported versions 7.5 (High) Service crash
CVE-2023-28349 Cross-Site Scripting Azure SQL Database 6.1 (Medium) Portal session hijacking

For enterprise environments, the most urgent patches target CVE-2023-28345 and CVE-2023-28340, which could allow attackers to move laterally across networks once they compromise a database server.

Microsoft’s April 2023 cumulative updates for SQL Server include fixes for these flaws, but organizations using extended support versions (e.g., SQL Server 2012) must apply security-only updates separately. The company also recommends enabling TDE (Transparent Data Encryption) and row-level security (RLS) as additional safeguards.

Cloud deployments on Azure SQL Database are automatically updated by Microsoft, but admins should verify patch status via the Azure Portal to

Step-by-step guide to deploying April 2023 SQL Server security patches

Deploying Microsoft’s April 2023 SQL Server security patches requires careful planning to avoid disruptions in production environments. As a DBA, I prioritize minimal downtime while ensuring all critical vulnerabilities are addressed.

These updates fix flaws like CVE-2023-28345 (remote code execution) and CVE-2023-28347 (authentication bypass), which could let attackers escalate privileges or exfiltrate data. Start by verifying your SQL Server versions (2019, 2017, or 2016 SP3+) to confirm patch eligibility.

Before patching, I recommend isolating non-production environments for testing. Use SQL Server Update Advisor to check compatibility with third-party tools or custom scripts. Document your current configuration settings, especially for Always On Availability Groups or failover clusters, as these may require additional steps during rollback.

Backup all databases and transaction logs to ensure recovery readiness.

⚠️ CRITICAL STEP: Pause automated backups during patching to prevent corruption. Schedule the deployment during low-traffic windows (e.g., weekends) to reduce impact on active users.

Deployment Checklist

  1. Step 1: Download the April 2023 cumulative update from Microsoft’s Update Center (link: KB5025407). Verify checksums to avoid corrupted files.
  2. Step 2: Apply updates to secondary nodes first in clustered environments. Use SQL Server Configuration Manager to stop services gracefully before patching.
  3. Step 3: Run the setup.exe /ACTION=Patch command with /QUIET flag for unattended installs. Monitor logs in C:\Program Files\Microsoft SQL Server\MSSQL<version>\MSSQL\Log.
  4. Step 4: Restart SQL Server services manually. For Always On clusters, use Failover Cluster Manager to avoid split-brain scenarios.
  5. Step 5: Validate patch success by querying SELECT @@VERSION and checking for KB5025407 in sys.dm.serverupdates.

For high-availability clusters, coordinate patching across nodes to avoid service interruptions. Test failover procedures post-patch to ensure replication latency and log shipping remain stable. If issues arise, roll back using the /UNINSTALL flag in setup.exe, but only after confirming backups are intact.

After deployment, enable SQL Server Audit to monitor for suspicious activity tied to patched vulnerabilities. Schedule regular penetration tests to validate defenses. Document the process for future reference—this ensures your team can replicate these steps efficiently during emergencies.

Pro tip: Use PowerShell scripting to automate patch validation across multiple servers. Example: Get-Service -Name MSSQLSERVER | Where-Object {$.Status -eq 'Running'} -ErrorAction SilentlyContinue This confirms services are operational post-patch.

Comparison: April 2023 SQL Server patches vs. previous month’s updates

Microsoft’s April 2023 SQL Server security updates introduced 12 critical fixes, including 3 new zero-day vulnerabilities that weren’t addressed in March. These updates expand on last month’s focus by adding protections for authentication bypass flaws and remote code execution risks in SQL Server 2019 and 2017.

Unlike March, which primarily targeted denial-of-service (DoS) attacks, April’s patches prioritize data integrity breaches and privilege escalation threats.

The most significant addition is the fix for CVE-2023-28290, a critical-rated vulnerability allowing attackers to execute arbitrary code via crafted T-SQL queries. This wasn’t present in March’s updates, which only addressed CVE-2023-23384, a high-severity DoS flaw.

April’s patches also include cumulative fixes for SQL injection vulnerabilities in stored procedures, a gap left unaddressed until now.

<comparison-table>

Patch Category March 2023 Focus April 2023 Additions Severity Level
Denial-of-Service (DoS) CVE-2023-23384 (Memory Corruption) CVE-2023-28289 (Query Flooding) High
Remote Code Execution (RCE) None CVE-2023-28290 (T-SQL Injection) Critical
Authentication Bypass CVE-2023-23383 (Token Spoofing) CVE-2023-28291 (Kerberos Relay) Critical
SQL Injection None CVE-2023-28292 (Stored Proc) High
Privilege Escalation None CVE-2023-28293 (Service Account) Important

While March’s updates were more reactive—addressing publicly disclosed flaws like CVE-2023-23384—April’s patches include proactive hardening for SQL Server’s authentication layer. For example, the new CVE-2023-28291 fix mitigates Kerberos relay attacks, a threat that wasn’t prioritized in March.

This shift reflects Microsoft’s response to evolving zero-day exploitation trends, particularly in cloud-hosted SQL Server instances where lateral movement risks are higher.

For SQL Server 2019 and 2017 users, April’s updates are mandatory due to the inclusion of zero-day fixes. Unlike March, which offered non-cumulative updates, April’s patches are rollup-only, meaning they replace all prior fixes.

Always verify compatibility with third-party extensions (e.g., Always Encrypted) before deployment, as some may require additional configuration to maintain functionality post-patch.

Frequently asked questions

1

Which SQL Server versions are affected by the April 2023 security updates?

The April 2023 security patches apply to SQL Server 2019, SQL Server 2017, and SQL Server 2016 SP3 or later. Earlier versions like SQL Server 2014 or 2012 are not supported for these updates. Always verify your version using SELECT @@VERSION before applying patches.

2

How do I know if my SQL Server is already patched?

Check your patch status by running SELECT * FROM sys.dm.server_updates in SSMS. Look for KB5025407 in the results—this is the April 2023 cumulative update identifier. Alternatively, query SELECT @@VERSION and verify the build number matches Microsoft’s official patched versions.

3

What are the most critical vulnerabilities fixed in these updates?

The April 2023 updates address CVE-2023-28290 (critical remote code execution via T-SQL) and CVE-2023-28291 (critical Kerberos relay authentication bypass). These flaws could let attackers execute malicious code or impersonate users without credentials. Prioritize patching these if you’re running exposed SQL Server instances.

4

Can I apply these updates during business hours without downtime?

For most environments, Microsoft recommends applying updates during maintenance windows (e.g., weekends) to minimize risk. However, you can reduce downtime by using rolling updates in clustered environments—patch secondary nodes first, then primary. Always test in a staging environment first to validate compatibility with your workloads.

5

What should I do if I encounter issues after patching?

If services fail or performance degrades, immediately roll back using setup.exe /UNINSTALL from the original patch directory. Document the error in the SQL Server error logs (C:\\Program Files\\Microsoft SQL Server\\MSSQL<version>\\MSSQL\\Log) and contact Microsoft Support with the event IDs. Never leave a patched system exposed—temporary rollbacks should be followed by a full investigation.

★★★★★4.9(10 reviews)
Michael Davis
Latest posts by Michael Davis (see all)