Are SQL Security Updates Cumulative? Are the vulnerabilities corrected with one Security Update also covered by the next Security Update?

Question

I recently patched SQL Servers that had SP3 and CU4 with the latest available Security Update. After CU4 there are 2 Security Updates available, one from 2020/02/11 and the other one from 2021/01/12.

Our IT security team is asking us to patch using this KB4535288 (2020/02/11) and we couldn't find that one so we patched using KB4583462 (2021/01/12).

My question is, are Security Updates cumulative? By applying KB4583462 (2021/01/12), my SQL version goes to 12.0.6433.1, but if I apply the KB4535288 (2020/02/11) my SQL Version goes to 12.0.6372.1, which is lower than the other.

Thanks in advance.

Answer 1

are Security Updates cumulative

No, Security updates are NOT cumulative.

we couldn't find that one, so we patched using KB4583462 (2021/01/12)

You can download from here

my SQL Version goes to 12.0.6372.1, which is lower than the other

This question and answer have some explanation about why build numbers are not sequential. Why does the SQL Server build number sequence not correlate with the release date sequence?

On a side note, you do not need to apply all security updates. For example, for KB4535288, it is mentioned in Microsoft documentation:

Note this update is made available through the Microsoft Update Catalog for all SQL Servers, even if Reporting Services is not installed. Installing this security update is optional for computers that do not host Microsoft SQL Server Reporting Services.

Answer 2

Only Cumulative Updates are cumulative, as implied by the name.

Specific security patches may contain fixes from prior patches if they happen to patch the same files as the prior patch. However, even that is not definitely guaranteed to be true.

Guidance would be to install the latest Cumulative Update for the server in question, then apply all the security patches applicable to the Cumulative Update, or apply just the security patches you're explicitly interested in.