Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5041160

KB5041160: Cumulative update for Windows Server, version 2022, August 2024. Exploited scripting flaw patched; Linux dual-boot issue remains

In short

Fixes 47 vulnerabilities, including 2 critical flaws and 4 exploited vulnerabilities; a fifth vulnerability was publicly disclosed. It also adds a Secure Boot change that can prevent some Linux dual-boot systems from starting.

Does it affect you? Applies to: Devices running Windows Server 2022, x64. The Kubernetes networking issue mainly affects server and enterprise environments using Calico; the Linux boot issue concerns devices set up to dual boot Windows and Linux.

Build
20348.2655
Security
47 fixed · 2 critical · 4 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues After installing the September 2024 update or later, dual-boot systems need no additional steps. On Windows-only systems, setting the documented registry key is optional and ensures the SBAT security update is applied.

The official sources are linked at the end of the page.

What changes

Improvements 7 changes

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

Verified in package
  • The vulnerable driver blocklist includes more drivers at risk of being used in attacks.1
    Adds drivers at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks to DriverSiPolicy.p7b.

Microsoft 365 Defender

For: Microsoft 365 administrators

  • The Network Detection and Response service might have issues that interrupt network data reporting.2
    The service health page in the Microsoft 365 admin center can show whether this issue affects you and the status of NDR.

BitLocker

For: Devices with device encryption enabled

  • A BitLocker recovery screen might appear at startup after installing the July 9, 2024 update; this is more likely when device encryption is on.3
    Windows might ask for the recovery key from the user's Microsoft account.

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

Verified in package
  • Secure Boot blocks vulnerable Linux bootloaders on Windows systems. Older Linux ISO images might not boot after the change.4
    The SBAT update does not apply when Windows and Linux dual boot is detected. If an older Linux ISO no longer boots, work with the Linux vendor to get an updated ISO image.

Domain Name System (DNS)

For: DNS administrators

  • DNS server security is hardened; domains with configurations that are not up to date might return a SERVFAIL error or time out.5
    Addresses CVE-2024-37968.

Line Printer Daemon (LPD) protocol

Verified in package

For: Organizations using LPD printing

  • Printing over the deprecated LPD protocol might not work as expected or might fail. UNIX clients should use IPP; Windows clients can connect to shared UNIX printers using the Windows Standard Port Monitor.6
    The issue occurs after the July 9, 2024 update and later updates.

Servicing stack

  • The update includes improvements to the component that installs Windows updates, helping devices receive and install Microsoft updates reliably.7
    Includes servicing stack update KB5041590, build 20348.2641.

Fixes 4 changes

Remote Desktop Session Host (RDSH)

Verified in package

For: Remote Desktop Session Host users and administrators

  • Users can connect to the Remote Desktop Session Host again without the host losing data because of an unresponsive system component.8
    Addresses win32kbase.sys stopping responding.

Windows Defender Application Control (WDAC)

For: IT administrators provisioning devices

  • A memory leak that can gradually exhaust system memory during device provisioning is addressed.9

Protected Process Light (PPL) protections

  • A bypass of Protected Process Light protections is addressed.10

Lock screen

  • The “Use my Windows user account” checkbox is no longer available on the lock screen when connecting to Wi-Fi.11
    Addresses CVE-2024-38143.

Removal 1 change

NetJoinLegacyAccountReuse

  • The NetJoinLegacyAccountReuse registry key is removed.12
    See KB5020276 for information about domain-join hardening changes.

Known issues

  1. Open Affects: Everyone

    After installing this update, you might be unable to [change your user account profile picture](https://support.microsoft.com/en-us/windows/change-your-account-picture-3645cdc7-acab-49d2-76a9-4ce7e5e…

    After installing the update, you might be unable to change your user account profile picture and might see error 0x80070520. Microsoft says this issue has very limited or no impact for this Windows version.13

    How to apply the workaround Workaround

    Contact Windows support for help if the issue occurs.13

  2. Resolved Affects: Organizations and IT administrators Resolved by KB5044281

    After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization.

    Remote Desktop connections across an organization might be interrupted intermittently when Remote Desktop Gateway uses the legacy Remote Procedure Call over HTTP protocol. KB5044281 resolves this issue.14

    Resolution Fixed in KB5044281

    Install KB5044281 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Organizations and IT administrators Resolved by KB5044281

    After installing this update, container networking on Kubernetes might not operate as expected, preventing containers from reaching external networks or communicating between pods.

    Kubernetes container networking using Calico on Windows Server 2022 might prevent containers from reaching external networks or communicating between pods. KB5044281 resolves this issue.15

    Resolution Fixed in KB5044281

    Install KB5044281 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  4. Open Affects: Everyone

    After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device.

    Some devices set up to dual boot Windows and Linux might fail to boot Linux and show an SBAT security policy error. Customized dual-boot methods might not be detected, causing the SBAT setting to be applied when it should not be.16

    How to apply the workaround Registry / GPO

    Install the September 2024 update or later. On Windows-only systems, set the registry key documented in CVE-2022-2601 and CVE-2023-40547 to ensure the SBAT security update is applied; dual-boot systems need no additional steps after installing the update.16

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-08-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5040437, KB5041054, KB5039227, KB5037782
+5 earlier KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5042881
VersionBuildChannel
2022 20348.2655 General availability

Security

47 vulnerabilities fixed
4 exploited 2 critical 45 important
VulnerabilitySeverityCVSS
CVE-2024-38107 Exploited
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-38193 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-38178 Exploited
Scripting Engine Memory Corruption Vulnerability
 Important 7.5
CVE-2024-38106 Exploited
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-38140
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2022-3775
Redhat: CVE-2022-3775 grub2 - Heap based out-of-bounds write when rendering certain Unicode sequences
 Critical 7.1
CVE-2024-38199
Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability
 Important 9.8

The table lists the 7 exploited, publicly disclosed or critical vulnerabilities. See all 47 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
372.2 MB
windows10.0-kb5041160-x64.msu Main update · KB5041160 SHA-1: f8dc7d5a…26bcfd

Updated components

592 files changed since the previous update for the same versions.

Top changed componentsFiles
Secure Boot11
Remote Desktop10
Security and sign-in7
Hyper-V and virtualization6
Kernel5
Storage and file systems5
File Explorer and shell4
Graphics and display4
Networking3
Settings3
Emoji and input2
Printing2

Verified in package: changed files confirm Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b), Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI), Line Printer Daemon (LPD) protocol, Remote Desktop Session Host (RDSH).

Sources

Updated
Cited passages from Microsoft's official notes (16)
  1. 1. [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  2. 2. [Microsoft 365 Defender (known issue] The Network Detection and Response (NDR) service might encounter issues. This interrupts network data reporting. support.microsoft.com
  3. 3. [BitLocker (known issue)] A BitLocker recovery screen shows when you start up your device. This occurs after you install the July 9, 2024, update. support.microsoft.com
  4. 4. [Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)] This update applies SBAT to systems that run Windows. support.microsoft.com
  5. 5. [Domain Name System (DNS)] This update hardens DNS server security to address CVE-2024-37968. support.microsoft.com
  6. 6. [Line Printer Daemon (LPD) protocol] Using this deprecated protocol to print might not work as you expect or fail. support.microsoft.com
  7. 7. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  8. 8. [Remote Desktop Session Host (RDSH)] Users cannot connect to the RDSH, and the host loses data. This occurs because win32kbase.sys stops responding. support.microsoft.com
  9. 9. [Windows Defender Application Control (WDAC)] A memory leak occurs that might exhaust system memory as time goes by. This issue occurs when you provision a device. support.microsoft.com
  10. 10. [Protected Process Light (PPL) protections] You can bypass them. support.microsoft.com
  11. 11. [Lock screen] This update addresses CVE-2024-38143. Because of this, the “Use my Windows user account” checkbox is not available on the lock screen to connect to Wi-Fi. support.microsoft.com
  12. 12. [NetJoinLegacyAccountReuse] This update removes this registry key. support.microsoft.com
  13. 13. After further investigation, we concluded this issue has very limited or no impact for this Windows version. If you encounter this issue on your device, please contact Windows support for help. support.microsoft.com
  14. 14. This issue is addressed in KB5044281. support.microsoft.com
  15. 15. This issue is addressed in KB5044281. support.microsoft.com
  16. 16. The September 2024 Windows security update (KB5042881) and later updates do not contain the settings that caused this issue. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 16 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake