Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5040437

KB5040437: Cumulative update for Windows Server, version 2022, July 2024. Closes exploited Hyper-V and MSHTML flaws; fixes remote access issues

In short

Fixes 86 vulnerabilities, including two flaws already exploited in Hyper-V and the MSHTML Platform, and addresses problems with Remote Desktop, BitLocker, and other features.

Does it affect you? Applies to: Devices running Windows Server 2022, x64.

Build
20348.2582
Security
86 fixed · 4 critical · 2 exploited
Restart
Required

What changes

Fixes 7 changes

Absent apps and features

For: Devices upgraded to Windows 11

  • The update addresses apps and features missing after an upgrade to Windows 11.1

Input Method Editor (IME)

For: Users of the Input Method Editor

  • The update addresses candidate lists that fail to appear or appear in the wrong position.2

Windows Presentation Foundation (WPF)

  • The update addresses WPF becoming unresponsive because of a malformed Human Interface Device descriptor.3

Remote Desktop Session Host (RDSH)

Verified in package

For: Remote Desktop Session Host users

  • The update addresses users being unable to connect to RDSH when dwm.exe stops responding.4

Remote Desktop MultiPoint Server

Verified in package

For: Devices running Remote Desktop MultiPoint Server

  • The update addresses the service stopping in a race condition.5

Windows Local Administrator Password Solution (LAPS)

  • LAPS Post Authentication Actions run at the end of the grace period instead of waiting until restart.6

Remote Authentication Dial-In User Service (RADIUS) protocol

  • The update addresses an issue related to MD5 collisions in the RADIUS protocol.7

Improvements 4 changes

Double-wide character set range

For: PowerShell users

  • PowerShell identifies and handles additional double-wide characters correctly.8
    Adds new ranges to the double-wide character set range.

BitLocker

Verified in package
  • The default Secure Boot validation profile uses an updated set of checks for BitLocker.9
    Adds PCR 4 to PCR 7 and 11 in the default Secure Boot validation profile.

File shortcut icons

  • Remote paths for shortcut icons need a policy configured; without it, icons on the Start menu, desktop, and taskbar will fail to render.10
    Configure the policy “Allow the use of remote paths in file shortcut icons” to use remote paths in .LNK file icons.

Servicing stack

  • The update includes a servicing stack improvement to help devices receive and install Microsoft updates.11
    Includes servicing stack update KB5040571, build 20348.2571.

Known issues

  1. Open Affects: Everyone

    After installing this update, you might be unable to [change your user account profile picture](https://support.microsoft.com/en-us/windows/change-your-account-picture-3645cdc7-acab-49d2-76a9-4ce7e5e…

    After installing this update, changing a user account profile picture might fail with error 0x80070520. Microsoft says the issue has very limited or no impact for this Windows version.12

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Resolved Affects: Organizations and IT administrators Resolved by KB5044281

    After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization.

    Windows Server devices using the legacy Remote Procedure Call over HTTP protocol in Remote Desktop Gateway might experience intermittent Remote Desktop disconnections, potentially every 30 minutes. KB5044281 resolves this issue.13

    Resolution Fixed in KB5044281

    Install KB5044281 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Organizations and IT administrators Resolved by KB5044281

    After installing this update, container networking on Kubernetes might not operate as expected, preventing containers from reaching external networks or communicating between pods.

    Kubernetes container networking might fail on Server 2022 when using Calico, blocking containers from reaching external networks or communicating between pods. KB5044281 resolves this issue.14

    Resolution Fixed in KB5044281

    Install KB5044281 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  4. Resolved Affects: Organizations and IT administrators Resolved by KB5041160

    Devices might experience problems with Microsoft 365 Defender.

    Microsoft 365 Defender's Network Detection and Response service might stop reporting network data. This issue is resolved by KB5041160.15

    Resolution Fixed in KB5041160

    Install KB5041160 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  5. Resolved Affects: Everyone Resolved by KB5041160

    After installing the July 9, 2024, Windows security update, you might see a [BitLocker recovery](https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recov…

    After the July 9, 2024 security update, devices might show a BitLocker recovery screen at startup, especially when Device Encryption is enabled. KB5041160 resolves this issue.16

    Resolution Fixed in KB5041160

    Install KB5041160 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-07-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5041054, KB5039227, KB5037782, KB5036909
+4 earlier KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5041160
VersionBuildChannel
2022 20348.2582 General availability

Security

86 vulnerabilities fixed
2 exploited 4 critical 80 important 2 moderate
VulnerabilitySeverityCVSS
CVE-2024-38080 Exploited
Windows Hyper-V Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-38112 Exploited
Windows MSHTML Platform Spoofing Vulnerability
 Important 7.5
CVE-2024-38074
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-38076
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-38077
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-38060
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8

The table lists the 6 exploited, publicly disclosed or critical vulnerabilities. See all 86 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
368.0 MB
windows10.0-kb5040437-x64.msu Main update · KB5040437 SHA-1: c1c5b6fc…53de91

Updated components

770 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio11
Graphics and display10
Hyper-V and virtualization9
Secure Boot9
File Explorer and shell8
Security and sign-in8
Networking7
Search5
Kernel3
Storage and file systems3
Remote Desktop2
Settings2

Verified in package: changed files confirm Remote Desktop Session Host (RDSH), Remote Desktop MultiPoint Server, BitLocker.

Sources

Updated
Cited passages from Microsoft's official notes (16)
  1. 1. [Absent apps and features] Some apps and features are absent after you upgrade to Windows 11. support.microsoft.com
  2. 2. [Input Method Editor (IME)] The candidate list fails to show or shows in the wrong position. support.microsoft.com
  3. 3. [Windows Presentation Foundation (WPF)] A malformed Human Interface Device (HID) descriptor causes WPF to stop responding. support.microsoft.com
  4. 4. [Remote Desktop Session Host (RDSH)] Users cannot connect to the RDSH. This occurs because dwm.exe stops responding. support.microsoft.com
  5. 5. [Remote Desktop MultiPoint Server] A race condition causes the service to stop responding. support.microsoft.com
  6. 6. [Windows Local Administrator Password Solution (LAPS)] Its Post Authentication Actions (PAA) do not occur at the end of the grace period. Instead, they occur at restart. support.microsoft.com
  7. 7. [Remote Authentication Dial-In User Service (RADIUS) protocol] This issue is related to MD5 collisions. support.microsoft.com
  8. 8. [Double-wide character set range] This update adds new ranges to the double-wide character set range. This ensures that the PowerShell console identifies and handles them the right way. support.microsoft.com
  9. 9. [BitLocker] This update adds PCR 4 to PCR 7 and 11 for the default Secure Boot validation profile. support.microsoft.com
  10. 10. This update changes how IT administrators should set up remote paths for file shortcut icons (.LNK files). The set up now requires that you configure the policy support.microsoft.com
  11. 11. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  12. 12. After further investigation, we concluded this issue has very limited or no impact for this Windows version. support.microsoft.com
  13. 13. This issue is addressed in KB5044281. support.microsoft.com
  14. 14. This issue is addressed in KB5044281. support.microsoft.com
  15. 15. This issue is addressed in KB5041160. support.microsoft.com
  16. 16. This issue is addressed in KB5041160. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 16 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake