KB5042881: Cumulative update for Windows Server, version 2022, September 2024. Exploited Windows flaws closed; installer prompts change

The update fixes 41 security vulnerabilities, including three being exploited, and changes how Windows Installer repairs prompt for credentials. Some users might be unable to change their account profile picture.

Does it affect you? Applies to: Devices running Windows Server 2022.

Review notes Additional details from the official release notes (2) Read notes

In detail Windows Installer automation scripts must be updated for the new credential prompt. Application owners must add the Shield icon to indicate that full administrator access is required.
What changes Windows Installer automation scripts must be updated for the new credential prompt. Application owners must add the Shield icon to indicate that full administrator access is required.

The official sources are linked at the end of the page.

What changes

Fixes 3 changes

IE mode

Pop-up windows in IE mode no longer open in the background instead of the foreground.¹

AppContainer

Verified in package

For: Devices using printers in restricted settings

Printers work as expected in restricted settings such as AppContainer.¹

BitLocker

For: Devices moving BitLocker data drives between Windows versions

You can decrypt a BitLocker data drive moved from a newer Windows version to an older one.¹

Improvements 3 changes

Windows Installer

For: IT administrators and application owners

When Windows Installer repairs an application, a User Account Control prompt now asks for credentials.²
Automation scripts might need updating, and application owners must add the Shield icon to indicate that full administrator access is required. To turn off the prompt, set HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableLUAInRepair to 1.

Dual boot of Windows and Linux (known issue)

For: Devices set up to dual-boot Windows and Linux

Linux might fail to start when Windows and Linux are set up to boot on the same device.³
The reported error is “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.” The page refers readers to guidance for CVE-2022-2601 and CVE-2023-40547.

Servicing stack

The component that installs Windows updates receives quality improvements to help devices receive and install updates reliably.⁴
Includes servicing stack update KB5043167, build 20348.2696.

Known issues

Open Affects: Everyone

After installing this update, you might be unable to [change your user account profile picture](https://support.microsoft.com/en-us/windows/change-your-account-picture-3645cdc7-acab-49d2-76a9-4ce7e5e…

After installing this update, you might be unable to change your user account profile picture. The issue has limited or no impact for this Windows version; if it occurs, contact Windows support for help.⁵

How to apply the workaround Workaround

Contact Windows support for help if you encounter the issue.⁵
Resolved Affects: Organizations and IT administrators Resolved by KB5044281

After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization.

On Windows Servers using the legacy Remote Procedure Call over HTTP protocol in Remote Desktop Gateway, connections might be interrupted intermittently, potentially every 30 minutes. Sessions can be lost, requiring users to reconnect. KB5044281 resolves this issue.⁶

Resolution Fixed in KB5044281

Install KB5044281 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Resolved Affects: Organizations and IT administrators Resolved by KB5044281

After installing this update, container networking on Kubernetes might not operate as expected, preventing containers from reaching external networks or communicating between pods.

Kubernetes container networking using Calico on Windows Server 2022 might prevent containers from reaching external networks or communicating between pods. Affected containers might fail to connect to the internet, and traffic might be blocked by the host firewall. KB5044281 resolves this issue.⁷

Resolution Fixed in KB5044281

Install KB5044281 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-09-10
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5041160, KB5040437, KB5041054, KB5039227

+6 earlier
KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by: KB5044281

Version	Build	Channel
2022	20348.2700	General availability

Security

41 vulnerabilities fixed

3 exploited 2 critical 37 important 2 not rated

Vulnerability	Severity	CVSS
CVE-2024-43461 Exploited Windows MSHTML Platform Spoofing Vulnerability	Important	8.8
CVE-2024-38014 Exploited Windows Installer Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-38217 Exploited Windows Mark of the Web Security Feature Bypass Vulnerability	Important	5.4
CVE-2024-38063 Windows TCP/IP Remote Code Execution Vulnerability	Critical	9.8
CVE-2024-38119 Windows Network Address Translation (NAT) Remote Code Execution Vulnerability	Critical	7.5

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 41 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022

375.3 MB

windows10.0-kb5042881-x64.msu Main update · KB5042881 SHA-1: f000f2a8…49b1d7

Updated components

697 files changed since the previous update for the same versions.

Top changed components	Files
Networking	9
Security and sign-in	9
Secure Boot	8
Graphics and display	7
Hyper-V and virtualization	7
Storage and file systems	5
Kernel	4
File Explorer and shell	3
Printing	3
Remote Desktop	3
Audio	1
Settings	1

Verified in package: changed files confirm AppContainer.

Sources

Microsoft Support: KB5042881

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (7)

1. [IE mode] Pop-up windows open in the background instead of in the foreground. [AppContainer] Printers do not work as you expect when you use them in a restricted setting, like AppContainer. support.microsoft.com
2. [Windows Installer] When it repairs an application, the User Account Control (UAC) does not prompt for your credentials. After you install this update, the UAC will prompt for them. support.microsoft.com
3. [Dual boot of Windows and Linux (known issue)] Linux might fail to start up when you turn on dual-boot setup for Windows and Linux on your device. support.microsoft.com
4. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
5. After further investigation, we concluded this issue has very limited or no impact for this Windows version. If you encounter this issue on your device, please contact Windows support for help. support.microsoft.com
6. IT administrators can track this as a termination of the TSGateway service which becomes unresponsive with exception code 0xc0000005. support.microsoft.com
7. This issue is addressed in KB5044281. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake