KB5048654: Cumulative update for Windows Server, version 2022, December 2024. Exploited log-file driver flaw patched; motherboard activation fixed

The update patches 41 vulnerabilities, including an actively exploited flaw in the Common Log File System Driver, and fixes Windows activation after a motherboard replacement.

Does it affect you? Applies to: Devices running Windows Server 2022, x64.

What changes

Fix 1 change

Motherboard replacement

For: devices with a replaced motherboard

Windows activates again after a motherboard replacement.¹

Improvement 1 change

Servicing stack

The component that installs Windows updates gets quality improvements to help devices receive and install updates reliably.²
Includes servicing stack update KB5044414, build 20348.2750.

Known issues

Resolved Affects: Organizations and IT administrators Resolved by KB5053603

Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections.

On a limited number of enterprise, IoT, and education devices, OpenSSH might fail to start after the October 2024 security update, preventing SSH connections. Microsoft is investigating whether Home or Pro devices are affected. KB5053603 addresses the issue.³

Resolution Fixed in KB5053603

Install KB5053603 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-12-10
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5046616, KB5047767, KB5044281, KB5042881

+10 earlier
KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by: KB5049983

Version	Build	Channel
2022	20348.2966	General availability

Security

41 vulnerabilities fixed

1 exploited 15 critical 26 important

Vulnerability	Severity	CVSS
CVE-2024-49138 Exploited Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-49112 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability	Critical	9.8
CVE-2024-49117 Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.8
CVE-2024-49105 Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.4
CVE-2024-49106 Windows Remote Desktop Services Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-49108 Windows Remote Desktop Services Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-49115 Windows Remote Desktop Services Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-49116 Windows Remote Desktop Services Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-49118 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-49119 Windows Remote Desktop Services Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-49122 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-49123 Windows Remote Desktop Services Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-49124 Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-49126 Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-49127 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-49132 Windows Remote Desktop Services Remote Code Execution Vulnerability	Critical	8.1
CVE-2024-43583 Winlogon Elevation of Privilege Vulnerability	Important	7.8

The table lists the 17 exploited, publicly disclosed or critical vulnerabilities. See all 41 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022

378.2 MB

windows10.0-kb5048654-x64.msu Main update · KB5048654 SHA-1: ef51e630…c2b226

Updated components

94 files changed since the previous update for the same versions.

Top changed components	Files
Graphics and display	3
Kernel	3
Printing	3
Remote Desktop	3
Hyper-V and virtualization	2
Networking	2
File Explorer and shell	1
Secure Boot	1
Settings	1
Storage and file systems	1

Sources

Microsoft Support: KB5048654

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (3)

1. [Motherboard replacement] Fixed: Windows does not activate after you replace a motherboard. support.microsoft.com
2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
3. Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 21, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake