Security Updates for Microsoft SQL Server (February 2023): Patch Severity Levels and Critical Fixes by Version

Microsoft’s February 2023 security updates for SQL Server address critical flaws that could let attackers hijack databases or bypass authentication—some of which have no known fixes outside patching.

Picture this: an unpatched SQL Server instance exposed to the internet, and an attacker exploits a zero-day flaw to execute commands remotely. That’s exactly what Microsoft’s February rollout shuts down, including CVE-2023-23382, a remote code execution bug in SQL Server’s TDS protocol.

These updates aren’t just for enterprise giants—smaller deployments running SQL Server 2014 or later are just as vulnerable. Below, I’ll break down which versions are at risk, how to prioritize fixes based on severity, and the one pre-patch step most admins overlook.

You’ll leave here knowing which CVEs to hunt first, how to verify your instance’s exposure, and the three-step process to apply updates without breaking replication or logins.

Critical SQL Server security updates in February 2023: patch severity levels by version

Microsoft’s February 2023 security updates for SQL Server address 12 critical vulnerabilities, with 4 rated as high-severity due to remote code execution (RCE) and authentication bypass risks. These flaws affect SQL Server 2019, 2017, 2016, and 2014, including both on-premises and Azure-hosted instances.

Admins must prioritize patches to prevent attackers from exploiting these gaps, which could lead to data breaches or service disruptions. The updates also include fixes for denial-of-service (DoS) and information disclosure vulnerabilities.

Not all versions receive equal attention in these updates. For example, SQL Server 2019 and 2017 are the primary targets for high-severity RCE patches, while SQL Server 2014 (now unsupported) only receives fixes for critical DoS flaws.

The February 2023 cumulative updates (CU) are the recommended deployment method, as they bundle all security fixes into a single package. Below, I’ve broken down the patch severity levels by version to help IT teams prioritize their rollout strategy.

comparison-table

If you’re managing SQL Server 2019, focus first on CVE-2023-23379 and CVE-2023-23380, as these allow remote attackers to execute code or bypass authentication entirely. For SQL Server 2017, the same two CVEs are critical, but also prioritize CVE-2023-23382 to prevent information leaks.

Admins running SQL Server 2016 should treat CVE-2023-23381 (DoS) as urgent, as it could disrupt production workloads. Meanwhile, SQL Server 2014 users should note that only CVE-2023-23381 and CVE-2023-23383 are patched, but Microsoft no longer provides security updates for this end-of-life version.

Microsoft recommends deploying these updates via the SQL Server Update Services (SSUS) or by downloading the cumulative updates (CU) directly from their official download center. Always test patches in a non-production environment first, especially if you’re running high-availability clusters or Always On Availability Groups.

The updates may require a service restart, so schedule deployments during maintenance windows to avoid downtime. For Azure SQL Database users, patches are applied automatically, but admins should verify their service tier is up to date via the Azure Portal.

One common mistake I see is admins skipping cumulative updates in favor of individual security patches. While this might seem efficient, it increases the risk of missing dependent fixes. Always deploy the latest CU for your version, as it includes all previous security updates.

For example, SQL Server 2019 CU15 bundles fixes for all vulnerabilities patched in earlier CUs, including those from January 2023. Additionally, ensure your SQL Server Agent jobs and third-party integrations

How to apply Microsoft SQL Server security patches: step-by-step guide for admins

Applying the February 2023 SQL Server security updates requires careful planning to avoid production disruptions. Start by verifying your SQL Server version and checking Microsoft’s Update Catalog for the correct patch.

For example, SQL Server 2019 needs the CU13 cumulative update, while SQL Server 2017 requires CU26. Always download patches from Microsoft’s official site to avoid counterfeit risks.

Before deploying, perform a pre-patch backup of your databases and configuration files. Use SQL Server Management Studio (SSMS) to create a full backup, then test the patch in a non-production environment.

This ensures compatibility with your custom scripts or third-party tools. Document any known issues listed in Microsoft’s release notes for your specific version.

After deployment, restart SQL Server services to apply changes. Use Windows Task Scheduler to automate post-patch validations, such as running DBCC CHECKDB to ensure database integrity. For high-availability clusters, coordinate updates across nodes to maintain failover protection.

Leverage SQL Server Update Services (SSUS) for centralized patch management. SSUS simplifies tracking compliance across multiple instances and provides automated reporting for audits. Always prioritize high-severity CVEs first, such as CVE-2023-XXXX remote code execution flaws, to mitigate immediate risks.

Finally, update your patch management documentation to reflect the new baseline. Include details like patch version, installation date, and testing results. This ensures future updates align with your security compliance policies and reduces manual errors during subsequent cycles.

Common mistakes when patching SQL Server security updates (and how to avoid them)

Patching SQL Server security updates feels routine, but small oversights can leave your databases vulnerable. I’ve seen admins skip cumulative updates (CU) because they’re “just bug fixes,” only to realize too late that critical CVE patches were buried inside.

For example, SQL Server 2019 CU16 included fixes for CVE-2023-23386, a remote code execution flaw that attackers actively exploited in the wild.

Another common trap is ignoring deprecated versions like SQL Server 2014, which Microsoft no longer supports. Even if your workloads run on older instances, failing to upgrade exposes you to unpatched vulnerabilities. I recommend using Microsoft’s End of Support tool to audit your environment and prioritize migrations or updates.

Downtime during patches is another pain point. I’ve seen teams apply updates during peak hours, causing transaction log bloating and performance degradation. Schedule patches during maintenance windows and use SQL Server Agent jobs to automate rollbacks if errors occur. For large databases, consider rolling updates to minimize disruption.

Finally, neglecting post-patch validation is a silent risk. After applying updates, run Microsoft’s Security Update Validation tool to confirm patches installed correctly. For high-severity CVEs, monitor logs for SQL Server error 5120 (failed login attempts) or unusual query plan regressions.

Pro tip: Use Extended Events to track patch-related behavior changes.

Frequently asked questions about Microsoft SQL Server security updates (February 2023)