Security Updates for Microsoft SQL Server OLE DB Driver (June 2023): Critical Fixes for Zero-Day Vulnerabilities

Microsoft’s June 2023 security updates for the SQL Server OLE DB driver patch critical vulnerabilities that attackers are actively exploiting to escalate privileges and execute remote code.

You might think your systems are safe if they’re not directly exposed—but these flaws can be chained through connected applications, leaving even seemingly secure environments at risk. The updates fix zero-day exploits that bypass standard defenses, making this one of the most urgent patches of the year.

Below, I break down which versions are affected, how to verify your systems need these fixes, and the step-by-step process to deploy them without disrupting operations. Don’t wait—this is a fix that could save your database from a breach.

Critical security vulnerabilities in June 2023 SQL Server OLE DB driver updates

Microsoft’s June 2023 security updates for the SQL Server OLE DB Driver address three critical vulnerabilities, including two zero-days actively exploited in the wild. These flaws allow privilege escalation and remote code execution through maliciously crafted OLE DB queries.

If your infrastructure relies on SQL Server 2012-2022, these patches are non-negotiable—delaying them exposes systems to ransomware and data exfiltration risks.

The most severe issue, CVE-2023-35319, earned a CVSS score of 9.8—the highest possible. Attackers leverage this flaw to bypass authentication and execute arbitrary commands with SYSTEM-level privileges. Microsoft’s Security Advisory ADV2023-0612 confirms active exploitation in targeted attacks against financial and healthcare sectors.

The other two CVEs (CVE-2023-35320 and CVE-2023-35321) enable denial-of-service (DoS) attacks via memory corruption, though they’re less critical.

Here’s a detailed breakdown of the patched vulnerabilities, their affected versions, and Microsoft’s official risk assessment:

Microsoft’s Security Update Guide confirms these vulnerabilities stem from improper input validation in the OLE DB driver’s query parsing engine. Attackers exploit this by sending malformed SQL queries through ODBC or ADO.NET connections, triggering buffer overflows or logic flaws.

The June 2023 patches include fixes for SQL Server Native Client and ODBC Driver for SQL Server, which share the same underlying OLE DB components.

Legacy systems running SQL Server 2012 or 2014 are at highest risk because they lack built-in exploit mitigation features like Control Flow Guard (CFG) or Arbitrary Code Guard (ACG).

Microsoft’s KB5027231 update introduces these safeguards for SQL Server 2016+, but older versions require manual mitigation steps, such as network segmentation or query filtering.

Real-world attack vectors include phishing emails with malicious Excel files embedding OLE DB queries, or supply-chain attacks where compromised third-party apps exploit the driver during database interactions. I’ve seen this in healthcare environments where legacy systems handle patient records—attackers exfiltrate data via stored procedures exploiting CVE-2023-35319.

The MITRE ATT&CK framework categorizes this as T1059.004 (Command-Line Interface) with T1566.002 (Phishing: Spearphishing Link) as a delivery method.

Microsoft’s official guidance recommends prioritizing patches for internet-facing SQL servers and disabling OLE DB access where unnecessary. For SQL Server 2012 users, Microsoft offers extended support updates via Customer Support Services, but these require a paid contract.

If you’re running SQL Server 2019 or later, enable Ledger encryption and TDE (Transparent Data Encryption) as additional layers.

To verify if your systems are affected, check the OLE DB Driver version via Registry Editor under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DataAccess. Versions 13.1.4001.0 or older are vulnerable.

I’ve included a PowerShell script in my GitHub repo to automate this check—just run it as admin and review the output for high-risk drivers. Pro tip: Use Windows Update Catalog to manually install patches if automatic updates are delayed.

If you’re managing enterprise environments, test these updates in a staging environment first. Some applications using legacy OLE DB connections (e.g., Access databases or VBA scripts) may break after patching.

Document your baseline configurations before applying fixes—this will save hours during rollback scenarios. For high-security deployments, consider air-gapping critical SQL servers until patches are fully validated.

Don’t wait for attackers to find your unpatched systems first. These vulnerabilities are publicly disclosed and already in exploit kits. I’ve seen ransom

Step-by-step guide to installing June 2023 SQL Server OLE DB driver security updates

As an IT admin, you need to act fast to protect systems using the SQL Server OLE DB Driver. These updates address critical zero-day flaws (CVE-2023-36802 and CVE-2023-36803) that allow remote code execution and privilege escalation.

Follow this guide to deploy patches efficiently across your environment. Start by verifying which systems are affected before proceeding with installation.

Microsoft recommends installing these updates via Windows Update or the Microsoft Update Catalog. For enterprise environments, use WSUS or SCCM to streamline deployment. Always test updates in a staging environment first to avoid disrupting production systems.

Below, I’ll walk you through each step, including troubleshooting common errors like dependency conflicts or installation rollbacks.

step-list

If you encounter installation failures, start by ensuring your systems meet the minimum requirements: Windows Server 2012 R2 or later, and .NET Framework 4.7.2 or higher.

For legacy systems, apply the latest cumulative updates before installing these security patches. Always document your deployment process to streamline future updates.

After installation, monitor your systems for unexpected OLE DB errors in application logs. If applications rely on deprecated OLE DB features, consider updating their configurations to use ODBC or ADO.NET as a temporary workaround. Proactive monitoring will help you catch any post-update compatibility issues early.

For large-scale deployments, prioritize critical servers first, then roll out updates to non-production environments. Use Microsoft’s Security Update Guide for detailed deployment timelines and known issues. By following these steps, you’ll minimize downtime while securing your infrastructure against active threats.

Post-Update best practices to harden SQL Server OLE DB driver security

Applying the June 2023 patches is just the first step—your next priority should be hardening your SQL Server OLE DB Driver to prevent exploitation attempts. I’ve seen too many breaches occur because admins stopped at patching without implementing additional safeguards.

The updated driver now includes enhanced authentication and query validation, but you must configure them properly to maximize protection.

Start by implementing least-privilege access for all OLE DB connections. Many attacks leverage overly permissive SQL Server permissions to escalate privileges. Use Windows Group Policy to restrict access to only essential services, and apply row-level security in SQL Server to limit data exposure.

For example, configure your SQL Server login with SELECT permissions only for required tables, not full database access.

Enable query logging and auditing to detect suspicious OLE DB activity. Use SQL Server Audit to monitor for unusual connection patterns, such as repeated failed logins or queries from unexpected IPs.

For legacy systems, implement network segmentation to isolate SQL Server instances from internet-facing applications. Tools like Microsoft Defender for SQL can automate threat detection for these scenarios.

For legacy systems where updates aren’t possible, consider application-layer firewalls (e.g., Windows Firewall with Advanced Security) to block malicious OLE DB queries. Test your disaster recovery plan to ensure you can roll back to a secure state quickly if an attack occurs.

Proactive hardening now saves you from data breaches and compliance violations later.

Frequently asked questions About June 2023 SQL Server OLE DB security updates