Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5039227

KB5039227: Cumulative update for Windows Server, version 2022, June 2024. Exploited Mark of the Web bypass patched; SMB access controls added

In short

Patches an exploited Mark of the Web security bypass and adds client-certificate access controls for SMB over QUIC.

Does it affect you? Applies to: Devices running Windows Server 2022 on x64. The update applies to all editions; the source does not specify editions.

Build
20348.2527
Security
31 fixed · 1 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Does it affect you? The update is for Windows Server 2022, but the official page does not specify which editions it applies to.

The official sources are linked at the end of the page.

What changes

Fixes 15 changes

Outlook and OneNote

Verified in package

For: Azure Virtual Desktop users

  • Addresses a problem that stops search from working in Outlook and OneNote when used with Azure Virtual Desktop.1
    The issue occurs when using Azure Virtual Desktop (AVD).

lsass.exe

2 items
  • Addresses an issue that makes lsass.exe stop responding on Windows servers after installing the April 2024 security updates.2
  • Addresses a memory leak in lsass.exe during a Local Security Authority (Domain Policy) Remote Protocol call.14
    The affected protocol is LSARPC.

Windows Hello for Business

For: Windows Hello for Business users

  • Addresses an issue that prevents authentication to Entra ID in certain apps when using Windows Hello for Business.3
    The issue occurs when using Web Access Management (WAM).

Microsoft Entra ID

Verified in package
  • Addresses an issue that prevents devices from authenticating a second Microsoft Entra ID account after the November 13, 2023 Windows update.4

Microsoft Edge

Verified in package
  • Addresses an issue that displays the wrong interface for Internet Options Data Settings.5

Storage Spaces Direct and RDMA

  • Addresses network failures and the loss of cluster management when Storage Spaces Direct and RDMA are used with SMBdirect.6

Containers

  • Addresses an issue that keeps containers from progressing beyond the “ContainerCreating” status.7

Windows Defender Application Control

2 items
  • Prevents a stop error that can occur when applying more than 32 WDAC policies.8
    The issue affects Windows Defender Application Control (WDAC).
  • Addresses an issue that copies unsigned WDAC policies to the EFI disk partition reserved for signed policies.10

Hibernate

  • Addresses an issue that might prevent a system from resuming from hibernate after BitLocker is turned on.9

Enhanced Fast Reconnect

Verified in package
  • Addresses Enhanced Fast Reconnect failing with third-party Remote Desktop Protocol providers.11

Remote Desktop Session Host

Verified in package
  • Addresses a deadlock that occurs when many users sign in to a Remote Desktop Session Host.12

dsamain.exe

  • Addresses dsamain.exe becoming unresponsive while the Knowledge Consistency Checker runs evaluations.13

Kernel stack

Verified in package
  • Addresses a kernel stack issue that might cause virtual machines to shut down prematurely.15
    The kernel stack might overflow.

Improvements 4 changes

LCU package

  • The update package is about 20% smaller, reducing downloads and network traffic and helping downloads on slow connections.16
    The LCU no longer has reverse differentials; the client generates the playback delta.

curl.exe

  • The included curl.exe version changes to 8.7.1.17

File Explorer

  • File Explorer adds a Mark of the Web tag to files and folders from untrusted locations. Their LastWriteTime timestamp is updated, which might affect scenarios that rely on file copy operations.18
    Files classified as “Internet” by MapUrlToZone also receive the Mark of the Web tag.

Servicing stack

  • The included servicing stack update improves the component that installs Windows updates.19
    KB5039343 updates the Windows Server 2022 servicing stack to build 20348.2522.

New feature 1 change

SMB over QUIC

  • Administrators can restrict which clients access SMB over QUIC servers using client-certificate authentication.20
    Turns on the SMB over QUIC client certificate authentication feature.

Known issues

  1. Open Affects: Everyone

    After installing this update, you might be unable to [change your user account profile picture](https://support.microsoft.com/en-us/windows/change-your-account-picture-3645cdc7-acab-49d2-76a9-4ce7e5e…

    Changing a user account profile picture might fail with error 0x80070520. Microsoft says this issue has very limited or no impact for this Windows version.21

    How to apply the workaround Workaround

    Contact Windows support for help if the issue occurs.21

  2. Resolved Affects: Organizations and IT administrators Resolved by KB5041160

    Devices might experience problems with Microsoft 365 Defender.

    The Microsoft 365 Defender Network Detection and Response service might interrupt network data reporting. KB5041160 resolves this issue.22

    Resolution Fixed in KB5041160

    Install KB5041160 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Organizations and IT administrators Resolved by KB5041054

    After installing this update, you might see an issue on cloud-based SQL servers where Azure Synapse SQL Se…

    On cloud-based SQL servers, Azure Synapse SQL Serverless Pool databases might enter “Recovery pending,” especially in environments using Customer-Managed Key or Azure Synapse dedicated SQL pool. KB5041054 resolves this issue.23

    Resolution Fixed in KB5041054

    Install KB5041054 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-06-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5037782, KB5036909, KB5037422, KB5035857
+2 earlier KB5034770, KB5034129
Replaced by
KB5041054
VersionBuildChannel
2022 20348.2527 General availability

Security

31 vulnerabilities fixed
1 exploited 1 critical 29 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2024-38213 Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
 Moderate 6.5
CVE-2024-30080
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2023-50868
MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU
 Important 7.5

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 31 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
366.9 MB
windows10.0-kb5039227-x64.msu Main update · KB5039227 SHA-1: 136403ab…039630

Updated components

1,621 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings39
Graphics and display22
Hyper-V and virtualization17
Networking16
Security and sign-in16
Remote Desktop15
File Explorer and shell12
Printing12
Bluetooth9
Search9
Audio8
Storage and file systems8

Verified in package: changed files confirm Outlook and OneNote, Microsoft Entra ID, Microsoft Edge, Enhanced Fast Reconnect, Remote Desktop Session Host, Kernel stack.

Sources

Updated
Cited passages from Microsoft's official notes (23)
  1. 1. This update addresses an issue that affects Outlook and OneNote. Their search function stops working. This occurs when you use Azure Virtual Desktop (AVD). support.microsoft.com
  2. 2. This update addresses an issue that affects lsass.exe. It stops responding. This occurs after you install the April 2024 security updates on Windows servers. support.microsoft.com
  3. 3. This update addresses an issue that affects Windows Hello for Business. You cannot use it to authenticate to Entra ID on certain apps. This occurs when you use Web Access Management (WAM). support.microsoft.com
  4. 4. This update addresses an issue that affects a Microsoft Entra ID account. Devices cannot authenticate a second one. This occurs after you install the Windows update, dated November 13, 2023. support.microsoft.com
  5. 5. This update addresses an issue that affects Microsoft Edge. The UI is wrong for the Internet Options Data Settings. support.microsoft.com
  6. 6. This update addresses an issue that affects Storage Spaces Direct (S2D) and Remote Direct Memory Access (RDMA). When you use them with SMBdirect in your networks, the networks fail. support.microsoft.com
  7. 7. This update addresses an issue that affects Containers. They do not move past the “ContainerCreating” status. support.microsoft.com
  8. 8. This update addresses an issue that affects Windows Defender Application Control (WDAC). It prevents a stop error that occurs when you apply more than 32 policies. support.microsoft.com
  9. 9. This update addresses an issue that might stop your system from resuming from hibernate. This occurs after you turn on BitLocker. support.microsoft.com
  10. 10. This update addresses an issue that affects Windows Defender Application Control (WDAC). The issue copies unsigned WDAC policies to the Extensible Firmware Interface (EFI) disk partition. It is reserved for signed policies. support.microsoft.com
  11. 11. This update addresses an issue that affects Enhanced Fast Reconnect. It fails. This occurs when you use it with third-party remote desktop protocol (RDP) providers. support.microsoft.com
  12. 12. This update addresses an issue that affects the Remote Desktop Session Host (RD Session Host). A deadlock occurs when a large number of users sign in. support.microsoft.com
  13. 13. This update addresses an issue that affects dsamain.exe. It stops responding. This occurs when the Knowledge Consistency Checker (KCC) runs evaluations. support.microsoft.com
  14. 14. This update addresses an issue that affects lsass.exe. It leaks memory. This occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call. support.microsoft.com
  15. 15. This update addresses an issue that affects the kernel stack. It might overflow. Because of this, VMs might shut down prematurely. support.microsoft.com
  16. 16. The LCU will no longer have the reverse differentials. The client will generate the playback delta. support.microsoft.com
  17. 17. This update affects the version of curl.exe that is in Windows. The version number is now 8.7.1. support.microsoft.com
  18. 18. Starting in this update, File Explorer adds the Mark of the Web (MoTW) tag to files and folders that come from untrusted locations. support.microsoft.com
  19. 19. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  20. 20. This update affects Server Message Block (SMB) over Quick UDP Internet Connections (QUIC). It turns on the SMB over QUIC client certificate authentication feature. support.microsoft.com
  21. 21. After further investigation, we concluded this issue has very limited or no impact for this Windows version.If you encounter this issue on your device, please contact Windows support for help. support.microsoft.com
  22. 22. This issue is addressed in KB5041160. support.microsoft.com
  23. 23. This issue is addressed in KB5041054. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 23 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake