IRONSMITHINTEL
HIGH
|Auth: n/a|Reboot: service restart|Est. 30–90 minutes|Manual only

SQL Server Cumulative Updates Are Not Delivered via Windows Update

SQL Server is not patched by Windows Update — cumulative updates must be downloaded and applied manually, making it one of the most commonly under-patched enterprise components.

Published May 3, 2026 · Updated May 3, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

An attacker who exploits an unpatched SQL Server vulnerability can achieve privilege escalation to sysadmin, remote code execution via the SQL Server service account, or data exfiltration depending on the specific CVE. The risk compounds with each missed CU — a server that has never had CUs applied may be missing years of security fixes.

How the attack works

Microsoft SQL Server receives security fixes through Cumulative Updates (CUs), not through Windows Update or WSUS. Administrators who rely solely on Windows Update to keep their servers patched are unknowingly leaving SQL Server unpatched indefinitely. SQL Server CUs must be downloaded from the Microsoft Update Catalog and applied manually during a maintenance window.

Am I affected?Quick check

Probably yes if any of these apply:

●All SQL Server database servers
●Running Any SQL Server instance not on the latest CU

Affected OS versions

Windows Server 2016Windows Server 2019Windows Server 2022
Fixed inLatest CU for your SQL Server version
Real-world incidentsWhat we've seen

During a routine vulnerability scan, a client discovers their SQL Server 2019 instance is running build 15.0.2000.5 — the original RTM release from 2019. Every CU released in five years has been missed because the team assumed Windows Update handled SQL Server. The instance is missing over 30 security fixes including multiple privilege escalation and RCE vulnerabilities.

How to patch

Manual remediation steps

⏱ 30–90 minutes

Step 1 — Check SQL Server Version and Patch Level

sqlcmd -Q "SELECT @@VERSION, SERVERPROPERTY('ProductUpdateLevel')" -S localhost 2>$null

Step 2 — Current CU Targets

SQL Server 2022:  CU12 (16.0.4115.5) or later
SQL Server 2019:  CU27 (15.0.4375.4) or later
SQL Server 2016:  SP3 CU17 or later

Step 3 — Download and Apply CU

1
Visit: microsoft.com/en-us/sql-server/sql-server-downloads
2
Find your SQL Server version and download the latest CU
3
Back up all databases before proceeding
4
Stop SQL Server-dependent application services
5
Run the CU installer as Administrator
6
Restart the SQL Server service
7
Restart application services

Verification

sqlcmd -Q "SELECT @@VERSION" -S localhost
# Must show the CU version you installed
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.