KB5036909: Cumulative update for Windows Server, version 2022, April 2024. Exploited proxy-driver spoofing flaw patched; server issues addressed

The update fixes 78 Important vulnerabilities, including an actively exploited proxy-driver spoofing flaw. It also addresses high CPU usage after opening Snipping Tool and several server issues.

Does it affect you? Applies to: Devices running Windows Server 2022, OS Build 20348.2402.

What changes

Fixes 15 changes

Snipping Tool

High CPU usage after opening Snipping Tool is addressed.¹

Remote Desktop

Verified in package

For: Devices using Remote Credential Guard with a Windows 11, version 22H2 or later client

The issue preventing access to a network resource from a Remote Desktop session is addressed when Remote Credential Guard is on and the client runs Windows 11, version 22H2 or later.²

Microsoft Edge IE mode

Microsoft Edge IE mode no longer stops responding when many tabs are open.³

DNS servers

For: DNS servers performing DNS registrations

The issue causing DNS registrations to fail until the DNS service is restarted is addressed.⁴
Addresses Event 4016 timeouts during LDAP DNS registrations with Active Directory Domain Services.

Workload virtual machines

For: Production environments running workload virtual machines

The issue causing workload virtual machines to lose network connections in production environments is addressed.⁵

Mouse cursor

Verified in package

Cursor lag in some screen-capture scenarios, especially when using Remote Desktop Protocol, is addressed.⁶

Group Policy service

For: Devices where LGPO.exe is used to apply an audit policy

The issue that causes the Group Policy service to fail after applying an audit policy with LGPO.exe is addressed.⁷

Smart card

For: Users signing in with a smart card containing multiple certificates

The smart card icon appears during sign-in when the card has multiple certificates.⁸

Smart card authentication

For: Devices using a smart card to authenticate on a remote system

The issue that shuts down a device 60 seconds after smart card authentication on a remote system is addressed.⁹

Active Directory

For: Devices using LDAP searches for group members

Users whose temporary group memberships have expired no longer appear in LDAP searches after Active Directory removes them.¹⁰

Root directory

The error that can appear when deleting something after opening an alternate data stream in a root directory is addressed.¹¹

Resilient File System

For: Devices using ReFS

The issue that can prevent the operating system from starting correctly with a stop error is addressed.¹²
The issue affects ReFS.

File system

The error that can occur when renaming a directory after creating a file that spans multiple directories is addressed.¹³

fastfat.sys

The issue that causes fastfat.sys to stop responding is addressed.¹⁴
The source attributes the issue to a race condition.

Name Service Provider Interface

For: Domain controllers

The issue that can cause NSPI queries to fail and lsass.exe to stop responding on a domain controller is addressed.¹⁵

Improvements 4 changes

Daylight saving time

3 items

Daylight saving time changes in Palestine are supported.¹⁶
Daylight saving time changes in Kazakhstan are supported.¹⁷
Daylight saving time changes in Samoa are supported.¹⁸

Servicing stack

The servicing stack, which installs Windows updates, receives quality improvements.¹⁹
Includes the Windows Server 2022 servicing stack update, version 20348.2401.

New feature 1 change

Windows Hello for Business

IT admins can use MDM to turn off the prompt that appears after sign-in on an Entra-joined machine. Provisioning is off afterward for Windows 10 and Windows 11 devices.²⁰
Turn on the DisablePostLogonProvisioning policy setting.

Known issues

Open Affects: Everyone

After installing this update, you might be unable to [change your user account profile picture](https://support.microsoft.com/en-us/windows/change-your-account-picture-3645cdc7-acab-49d2-76a9-4ce7e5e…

After installing the update, changing a user account profile picture might fail with error 0x80070520. Microsoft says this issue has very limited or no impact for this Windows version.²¹

How to apply the workaround Workaround

Contact Windows support if you encounter the issue.²¹
Resolved Affects: Everyone Resolved by KB5037782

Windows devices might face VPN connection failures after installing the update dated April 9, 2024, or later.

Windows devices might have VPN connection failures after installing the update dated April 9, 2024, or later. KB5037782 addresses this issue.²²

Resolution Fixed in KB5037782

Install KB5037782 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Resolved Affects: Organizations and IT administrators Resolved by KB5037782

After installing the April 9, 2024 security update on domain controllers (DCs), you might notice a significant increase in [NTLM](https://learn.microsoft.com/windows-server/security/kerberos/ntlm-ove…

After the April 9, 2024 security update, domain controllers might see a significant increase in NTLM authentication traffic. The issue is likely to affect organizations with a very small percentage of primary domain controllers and high NTLM traffic; KB5037782 addresses it.²³

Resolution Fixed in KB5037782

Install KB5037782 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-04-09
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5037422, KB5035857, KB5034770, KB5034129
Replaced by: KB5037782

Version	Build	Channel
2022	20348.2402	General availability

Security

78 vulnerabilities fixed

1 exploited 78 important

Vulnerability	Severity	CVSS
CVE-2024-26234 Exploited Proxy Driver Spoofing Vulnerability	Important	6.7

The table lists the 1 exploited, publicly disclosed or critical vulnerabilities. See all 78 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022

414.8 MB

windows10.0-kb5036909-x64.msu Main update · KB5036909 SHA-1: 786040b0…3d1044

Updated components

607 files changed since the previous update for the same versions.

Top changed components	Files
Remote Desktop	13
Security and sign-in	12
Secure Boot	9
Hyper-V and virtualization	8
Graphics and display	7
Networking	7
Kernel	5
Windows Update	5
Bluetooth	4
File Explorer and shell	4
Storage and file systems	4
Settings	3

Verified in package: changed files confirm Remote Desktop, Mouse cursor.

Sources

Microsoft Support: KB5036909

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (23)

1. This update addresses an issue that causes high CPU usage. This occurs after you open the Snipping Tool. support.microsoft.com
2. This update addresses an issue that affects a network resource. You cannot access it from a Remote Desktop session. support.microsoft.com
3. This update addresses an issue that affects Microsoft Edge IE mode. When you open many tabs, it stops responding. support.microsoft.com
4. This update addresses an issue that affects DNS servers. They receive Event 4016 for a timeout of the Lightweight Directory Access Protocol (LDAP). support.microsoft.com
5. This update addresses an issue that affects workload virtual machines (VM). They lose their connection to the network in production environments. support.microsoft.com
6. This update addresses an issue that affects mouse cursor movements. They lag in some screen capture scenarios, especially when you use the Remote Desktop Protocol (RDP). support.microsoft.com
7. This update addresses an issue that affects the Group Policy service. It fails after you use LGPO.exe to apply an audit policy to the system. support.microsoft.com
8. This update addresses an issue that affects the display of a smart card icon. It does not appear when you sign in. support.microsoft.com
9. This update addresses an issue that causes your device to shut down after 60 seconds. This occurs when you use a smart card to authenticate on a remote system. support.microsoft.com
10. This update addresses an issue that affects temporary group membership. Users whose memberships have expired appear when you search for them in LDAP. support.microsoft.com
11. This update addresses an issue that affects a root directory. When you open an alternate data stream and delete something, you get an error. support.microsoft.com
12. This update addresses an issue that affects the Resilient File System (ReFS). A stop error prevents the OS from starting up correctly. support.microsoft.com
13. This update addresses an issue that occurs when you create a file that spans more than one directory. When you rename the original directory, you get an error. support.microsoft.com
14. This update addresses an issue that affects fastfat.sys. It stops responding. This occurs because of a race condition. support.microsoft.com
15. This update addresses an issue that affects Name Service Provider Interface (NSPI) queries. They might fail. support.microsoft.com
16. This update supports daylight saving time (DST) changes in Palestine. support.microsoft.com
17. This update supports DST changes in Kazakhstan. support.microsoft.com
18. This update supports DST changes in Samoa. support.microsoft.com
19. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
20. IT admins can now use mobile device management (MDM) to turn off the prompt that appears when users sign in to an Entra-joined machine. support.microsoft.com
21. After installing this update, you might be unable to change your user account profile picture. support.microsoft.com
22. This issue is addressed in KB5037782. support.microsoft.com
23. After installing the April 9, 2024 security update on domain controllers (DCs), you might notice a significant increase in NTLM authentication traffic. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 23 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake