Security Updates for Microsoft SQL Server (April 2023): Critical Patch Details and System Impact Explained

Microsoft’s April 2023 security updates for SQL Server patch 12 critical flaws, including two zero-days that could let attackers hijack your databases or escalate privileges.

Did you know one of these vulnerabilities lets hackers execute code remotely just by sending a malformed packet? If your SQL Server runs on 2016 or later, you’re in the crosshairs—and Microsoft’s warning says these exploits are already being tested in the wild.

These updates aren’t optional: they fix everything from SSIS buffer overflows to authentication bypasses, and skipping them leaves you vulnerable to ransomware or data theft. The good news? Applying them is straightforward if you follow the right steps.

Below, I’ll walk you through which versions are affected, how to install the patches safely, and what to watch for after deployment—so you can protect your systems without downtime.

Critical security vulnerabilities fixed in April 2023 SQL Server updates

Microsoft’s April 2023 security updates for SQL Server address 12 critical vulnerabilities, including zero-day exploits actively targeted by threat actors. These patches are essential for protecting against remote code execution (RCE), privilege escalation, and data breaches.

The updates cover SQL Server 2016 through 2022, including Azure SQL Database and SQL Server on Linux. Ignoring these patches exposes systems to attacks like buffer overflows and SSIS package exploitation.

Among the most severe vulnerabilities is CVE-2023-28344, a remote code execution flaw in the SQL Server Integration Services (SSIS) catalog. Attackers could exploit this to execute arbitrary code with SYSTEM privileges.

Another critical fix, CVE-2023-28345, addresses a buffer overflow in the SQL Server Database Engine, allowing attackers to crash services or escalate privileges. These vulnerabilities are particularly dangerous because they can be triggered without user interaction.

The updates also patch denial-of-service (DoS) vulnerabilities, such as CVE-2023-28346, which could disrupt database operations by crashing the SQL Server service. Other fixes target information disclosure flaws, like CVE-2023-28347, where attackers could extract sensitive data from memory.

For organizations using SQL Server 2019 or 2022, these vulnerabilities are especially critical due to their widespread deployment in enterprise environments.

Below is a summary-table of the 12 patched vulnerabilities, including their CVE IDs, severity ratings, exploitability scores, and affected versions. This table helps prioritize patches based on risk and impact.