Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5046616

KB5046616: Cumulative update for Windows Server, version 2022, November 2024. Exploited Task Scheduler flaw patched; backup failure fixed

In short

Fixes 37 vulnerabilities, including two critical flaws and two that are being exploited. It also fixes Windows Backup failures on devices with an EFI system partition.

Does it affect you? Applies to: Devices running Windows Server 2022, x64.

Build
20348.2849
Security
37 fixed · 2 critical · 2 exploited
Restart
Required

What changes

Fixes 5 changes

FrameShutdownDelay

  • The browser now uses the value set for FrameShutdownDelay.1
    Fixes the browser ignoring the value in HKLM\SOFTWARE\Microsoft\Internet Explorer\Main.

vmswitch

  • A vmswitch no longer triggers a stop error in the specified virtual-machine network configuration.2
    The issue occurs with Load Balancing and Failover (LBFO) teaming and two virtual switches on a VM, when one switch uses single root Input/Output virtualization (SR-IOV).

Collector sets

  • The command to stop a collector set no longer stops responding when an exception occurs during startup or while the set is active.3
    Fixes collector sets not closing properly after an exception during startup or while active.

Windows Backup

  • Windows Backup no longer sometimes fails on a device with an EFI system partition.4
    Fixes backup failures when a device has an Extensible Firmware Interface (EFI) system partition (ESP).

Cace disk

  • The “Starting Maintenance mode” exception flag no longer appears after a cache disk is removed.5

Improvements 4 changes

Product activation phone numbers

  • New product activation phone numbers are available for several regions.6

Windows Kernel Vulnerable Driver Blocklist file

Verified in package
  • The blocklist includes more drivers that could put devices at risk.7
    Adds drivers at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks to DriverSiPolicy.p7b.

Remote Desktop Connection Broker in high availability mode

Verified in package
  • Smart-card authentication now uses Kerberos in Remote Desktop Connection Broker high availability mode.8
    Turns on Kerberos authentication for smart cards.

Servicing stack

  • The servicing stack receives quality improvements to help devices reliably install Windows updates.9
    The combined package includes servicing stack update KB5044414, build 20348.2750.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5053603

    Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections.

    After the October 2024 security update, some customers report that the OpenSSH service fails to start, preventing SSH connections. A limited number of devices are affected among enterprise, IoT, and education customers; Microsoft is investigating whether Home or Pro consumers are affected. KB5053603 resolves the issue.10

    Resolution Fixed in KB5053603

    Install KB5053603 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-11-12
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5047767, KB5044281, KB5042881, KB5041160
+9 earlier KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5048654
VersionBuildChannel
2022 20348.2849 General availability

Security

37 vulnerabilities fixed
2 exploited 2 critical 35 important
VulnerabilitySeverityCVSS
CVE-2024-49039 Exploited
Windows Task Scheduler Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-43451 Exploited
NTLM Hash Disclosure Spoofing Vulnerability
 Important 6.5
CVE-2024-43639
Windows KDC Proxy Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-43625
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
 Critical 8.1
CVE-2024-49019
Active Directory Certificate Services Elevation of Privilege Vulnerability
 Important 7.8

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 37 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
376.7 MB
windows10.0-kb5046616-x64.msu Main update · KB5046616 SHA-1: e4811cdf…9b606e

Updated components

4,956 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings57
Networking37
Graphics and display30
Printing27
Remote Desktop26
Security and sign-in25
Bluetooth23
Hyper-V and virtualization23
Audio20
File Explorer and shell18
Storage and file systems12
Search11

Verified in package: changed files confirm Windows Kernel Vulnerable Driver Blocklist file, Remote Desktop Connection Broker in high availability mode.

Sources

Updated
Cited passages from Microsoft's official notes (10)
  1. 1. [FrameShutdownDelay] Fixed: The browser ignores its value in the “HKLM\SOFTWARE\Microsoft\Internet Explorer\Main” registry key. support.microsoft.com
  2. 2. [vmswitch] Fixed: A vmswitch triggers a stop error. This occurs when you use Load Balancing and Failover (LBFO) teaming with two virtual switches on a virtual machine (VM). support.microsoft.com
  3. 3. [Collector sets] Fixed: They do not close properly when an exception occurs during startup or while the set is active. Because of this, the command to stop a collector set stops responding. support.microsoft.com
  4. 4. [Windows Backup] Fixed: Backup sometimes fails. This occurs when a device has an Extensible Firmware Interface (EFI) system partition (ESP). support.microsoft.com
  5. 5. [Cace disk] Fixed: The "Starting Maintenance mode" exception flag appears after you remove a cache disk. support.microsoft.com
  6. 6. [Product activation phone numbers] This adds new phone numbers for several regions. support.microsoft.com
  7. 7. [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  8. 8. [Remote Desktop Connection Broker in high availability mode] This update turns on Kerberos authentication for smart cards. support.microsoft.com
  9. 9. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  10. 10. Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake