Skip to the content
The Update Bureau
Windows 10 1809 Windows 10 1809 Security update
Patch Tuesday Zero-day

KB5055519

KB5055519: Cumulative update for Windows 10, version 1809, April 2025. Exploited Common Log File System Driver flaw addressed

In short

Addresses 59 vulnerabilities, including an actively exploited Common Log File System Driver flaw. It also changes daylight-saving-time handling, security behavior, and the servicing stack.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSC 2019, version 1809.

Build
17763.7136
Security
59 fixed · 5 critical · 1 exploited
Review notes Additional details from the official release notes (2) Read notes
  • In detail Support for Windows 10 ended on October 14, 2025. Microsoft says it no longer provides free software updates, technical assistance, or security fixes for Windows 10 after that date.
  • In detail The update creates a new %systemdrive%\inetpub folder as part of broader protection changes. Microsoft says not to delete the folder, whether or not IIS is enabled.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 5 changes

Daylight Saving Time (DST)

For: devices in the Aysen region of Chile

  • Daylight-saving-time support is updated for the Aysen region in Chile to follow the government's 2025 change.1

OS Security

  • A new %systemdrive%\inetpub folder is created on the device. Do not delete it, whether or not IIS is enabled.2
    The folder is created as part of security changes and requires no action from administrators or end users.

Kerberos Authentication

For: domain-joined devices

  • Kerberos authentication gains protections that might cause Event ID 45 events to be logged on domain controllers.3
    The change addresses a vulnerability that occurs when a certificate authority is in the Windows root store but not the NTAuth store. The protection is enabled by default.

Windows Hello

  • Windows Hello facial recognition requires a color camera to see a visible face during sign-in.4

Servicing stack

  • The component that installs Windows updates receives quality improvements.5
    The cumulative update includes servicing stack update KB5055662, build 17763.7125.

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    On devices with Citrix Session Recording Agent version 2411, the January 2025 Windows security update might fail during restart and roll back. Citrix Session Recording Agent version 2503 or newer resolves the issue.6

    How to apply the workaround Workaround

    Update Citrix Session Recording Agent to version 2503 or newer.6

  2. Resolved Affects: Organizations and IT administrators Resolved by KB5058922

    Active Directory Group Policy: Events in local policy

    Local policy might show Audit logon events as No auditing even when logon events are being audited. KB5058922 resolves this reporting issue.7

    How to apply the workaround Registry / GPO

    For devices on updates released before April 11, 2025 that still have the issue, apply the registry adjustments described in Microsoft's linked guidance.7

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-04-08
Type
Cumulative update
VersionBuildChannel
1809 17763.7136 General availability

Security

59 vulnerabilities fixed
1 exploited 5 critical 53 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2025-29824 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2023-40547
Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass
 Critical 8.3
CVE-2025-26663
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26670
Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26686
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-27491
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 7.1

The table lists the 6 exploited, publicly disclosed or critical vulnerabilities. See all 59 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. [Daylight Saving Time (DST)] Update for the Aysen region in Chile to support the government DST change order in 2025. support.microsoft.com
  2. 2. After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. support.microsoft.com
  3. 3. This change enabled by default might cause Event ID: 45 events to be logged on the domain controller. support.microsoft.com
  4. 4. Windows Hello facial recognition requires color cameras to see a visible face when signing in. support.microsoft.com
  5. 5. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  6. 6. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
  7. 7. This issue is resolved in the April 11, 2025—KB5058922 (OS Build 17763.7240) Out-of-band update. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake