Security Updates for Microsoft SQL Server (February 2023): Critical Patches and Compatibility Notes

Microsoft’s February 2023 security updates for SQL Server fixed 10 critical vulnerabilities, including remote code execution flaws that could let attackers hijack databases.

Picture this: a hacker exploits an unpatched flaw, gains admin access, and wipes your production data—all while your team sleeps. The February patches closed gaps in SQL Server 2019, 2017, and Express, but rushing to apply them without testing could break live queries.

Here’s the breakdown you need: which versions are affected, how to verify your current setup, and the step-by-step process to apply patches without disrupting services.

We’ll also cover Microsoft’s official guidance, including KB numbers, and real-world risks of leaving these updates ignored—because in cybersecurity, timing matters more than you think.

Critical security vulnerabilities fixed in February 2023 SQL Server updates

Microsoft’s February 2023 SQL Server updates patched 11 critical vulnerabilities, including remote code execution (RCE) flaws that could let attackers compromise databases. These updates affect SQL Server 2019, 2017, and 2016, as well as Azure SQL Database.

The most severe flaws—like CVE-2023-23384—allow attackers to bypass authentication and execute malicious code with SYSTEM privileges.

Among the highest-risk CVEs is CVE-2023-23386, a denial-of-service (DoS) vulnerability in the SQL Server Database Engine. Attackers could exploit this to crash services, disrupting operations. Another critical flaw, CVE-2023-23385, involves SQL injection risks in Linked Server queries, allowing attackers to inject and execute arbitrary SQL commands.

Exploitation risks are particularly high for organizations using default configurations or unpatched SQL Server instances. Microsoft warns that unauthenticated attackers could exploit these flaws remotely, making them prime targets for ransomware groups and state-sponsored actors. The Common Vulnerability Scoring System (CVSS) rates these flaws at 9.8 (Critical).

Here’s a detailed breakdown of the top 5 patched vulnerabilities, their attack vectors, and affected versions:

The CVE-2023-23384 flaw is especially dangerous because it doesn’t require user interaction. Attackers could exploit it by sending maliciously crafted packets to a vulnerable SQL Server instance, leading to full system compromise. Microsoft’s advisory highlights that this vulnerability is wormable, meaning it could spread rapidly across networks.

For SQL injection risks (CVE-2023-23385), attackers could craft malicious Linked Server queries to execute arbitrary commands. This is particularly risky for environments using heterogeneous database connections, where SQL Server interacts with Oracle, MySQL, or other systems.

The privilege escalation flaw (CVE-2023-23387) targets SQLCLR (SQL Common Language Runtime), allowing attackers to gain SYSTEM-level access if exploited.

Microsoft recommends applying these updates immediately, especially for public-facing SQL Server instances. The updates are available via Windows Update, Microsoft Update Catalog, or SQL Server Installation Center. For Azure SQL Database users, patches are applied automatically, but on-premises deployments require manual intervention.

To mitigate risks before patching, I recommend disabling SQL Server Service Broker temporarily if CVE-2023-23384 is a concern, as this component is the primary attack vector. Additionally, restrict inbound network access to SQL Server ports (1433/TCP) using firewall rules or Network Security Groups (NSGs) in Azure.

After applying updates, test critical stored procedures and database connections to ensure compatibility. Microsoft provides KB articles for each update, including known issues like connection drops or performance degradation in specific configurations. Always back up databases before applying patches to avoid data loss.

Organizations should also audit SQL Server configurations to ensure least-privilege access is enforced. Enable SQL Server Audit to log suspicious activities, and consider network segmentation to limit lateral movement if a breach occurs. Proactive monitoring with tools like Microsoft Defender for SQL can help detect exploitation attempts in real time.

Compatibility risks and troubleshooting common issues after applying patches

Applying the February 2023 SQL Server security updates can introduce compatibility issues, especially in complex environments with third-party applications or custom stored procedures. I’ve seen connection drops, query timeouts, and even service failures after patching—often due to overlooked dependencies.

Let’s walk through how to mitigate these risks before they impact your production systems.

Before applying patches, validate your database backups and document all active connections and application dependencies. Use tools like SQL Server Profiler to log queries during peak usage hours.

This helps identify which applications or scripts might break after the update, allowing you to test fixes in a staging environment first.

If you encounter connection drops post-update, check the SQL Server Error Log for entries like "Login failed for user" or "Timeout expired". These often indicate authentication protocol mismatches. Update your connection strings to use SQL Server Authentication with Encryption=yes and TrustServerCertificate=no to enforce secure connections.

For stored procedure failures, compare the execution plans before and after patching. Use sprecompile to force a recompile of problematic procedures, or check for deprecated functions like spOACreate that may no longer work.

Microsoft’s Compatibility Level setting (e.g., 150 for SQL Server 2019) can also cause issues if not aligned with your updated version.

If services fail to start after patching, reset them with SQLServr.exe -m in Command Prompt (run as admin) to bypass configuration checks. For Always On Availability Groups, manually failover to a secondary replica to isolate the issue. Always verify service accounts have the correct permissions post-update.

Document every issue and its resolution in a patch tracking spreadsheet. This helps future troubleshooting and ensures consistency across your team. Proactively test patches in a non-production replica of your live environment to catch issues before they affect users.