Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday

KB5035857

KB5035857: Cumulative update for Windows Server, version 2022, March 2024. Critical Hyper-V flaw addressed; domain controllers risk memory leaks

In short

The update addresses 39 vulnerabilities, including two critical Hyper-V flaws. Domain controllers might develop an LSASS memory leak; Microsoft recommends KB5037422 for domain controllers.

Does it affect you? Applies to: Devices running Windows Server 2022.

Build
20348.2340
Security
39 fixed · 2 critical
Restart
Required

What changes

Fixes 4 changes

Touch keyboard

  • The touch keyboard issue that could prevent it from appearing during out-of-box experience is addressed.1
    The issue can occur during OOBE.

Get Help

  • Troubleshooting no longer fails when you use the Get Help app.2

Remote Desktop Web Authentication

Verified in package
  • The issue that could prevent connections to sovereign cloud endpoints is addressed.3

Host Network Service

  • A memory allocation issue that caused high memory usage and affected service and pod deployment is addressed.4
    Addresses a memory allocation issue in HNS.

Improvements 3 changes

Active Directory

  • Active Directory domains that host MDM providers can move from Compatibility mode to Enforcement mode for strong certificate mapping.5
    An Active Directory KDC can read user SIDs from the SAN so providers can populate those values.

Explorer User Shell Folders

  • The device can now set and maintain the correct default permissions for user shell folders.6
    Affects HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders.

Servicing stack

  • The component that installs Windows updates receives quality improvements.7
    Includes the Windows Server 2022 servicing stack update, version 20348.2334.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5037422

    Following installation of this update, Local Security Authority Subsystem Service (LSASS) may experience a memory leak on domain controllers (DCs).

    After this update, LSASS might leak memory on on-premises and cloud-based domain controllers handling Kerberos authentication requests. Extreme leaks might crash LSASS and trigger an unscheduled domain controller reboot. KB5037422 addresses the issue.8

    Resolution Fixed in KB5037422

    Install KB5037422 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-03-12
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5034770, KB5034129
Replaced by
KB5037422
VersionBuildChannel
2022 20348.2340 General availability

Security

39 vulnerabilities fixed
2 critical 34 important 3 not rated
VulnerabilitySeverityCVSS
CVE-2024-21407
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-21408
Windows Hyper-V Denial of Service Vulnerability
 Critical 5.5

The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 39 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
394.5 MB
windows10.0-kb5035857-x64.msu Main update · KB5035857 SHA-1: f699534e…bd3ebb

Updated components

579 files changed since the previous update for the same versions.

Top changed componentsFiles
Networking17
Hyper-V and virtualization13
Security and sign-in10
Audio8
Secure Boot7
Graphics and display6
File Explorer and shell5
Search5
Bluetooth4
Emoji and input4
Kernel4
Printing4

Verified in package: changed files confirm Remote Desktop Web Authentication.

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. This update addresses an issue that affects the touch keyboard. It might not show during out-of-box experience (OOBE). support.microsoft.com
  2. 2. This update addresses an issue that makes the troubleshooting process fail. This occurs when you use the Get Help app. support.microsoft.com
  3. 3. This update addresses an issue that affects Remote Desktop Web Authentication. You might not be able to connect to sovereign cloud endpoints. support.microsoft.com
  4. 4. This update addresses a memory allocation issue in the Host Network Service (HNS). It causes high memory usage. It also affects service and pod deployment. support.microsoft.com
  5. 5. They can transition from “Compatibility mode” to the strong certificate mapping “Enforcement mode.” support.microsoft.com
  6. 6. This update affects HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders. Your device can now set and maintain the correct default permissions. support.microsoft.com
  7. 7. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  8. 8. Following installation of this update, Local Security Authority Subsystem Service (LSASS) may experience a memory leak on domain controllers (DCs). support.microsoft.com
Checked automatically: 7 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake