Skip to the content
The Update Bureau
Windows 10 1607 Windows 10 1607 Security update
Patch Tuesday Zero-day

KB5055521

KB5055521: Cumulative update for Windows 10, version 1607, April 2025. Exploited CLFS driver flaw patched; audit-policy display issue noted

In short

Addresses 46 vulnerabilities, including an actively exploited flaw in the Common Log File System driver. It also changes daylight saving time support in Chile and adds Kerberos protections that might log Event ID 45 on domain controllers.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSB 2016, version 1607, on x86 or x64.

Build
14393.7969
Security
46 fixed · 5 critical · 1 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 3 changes

Daylight Saving Time (DST)

For: Devices in the Aysen region of Chile

  • Daylight saving time support is updated for the Aysen region in Chile to follow the government’s 2025 change order.1

OS Security

  • A new inetpub folder is created on the system drive. Leave it in place.2
    The %systemdrive%\inetpub folder is created whether or not Internet Information Services (IIS) is enabled. No action is required from IT administrators or end users.

Kerberos Authentication

  • Kerberos protections are enabled by default. On domain controllers, this change might cause Event ID 45 events to be logged.3
    Adds protection for a vulnerability involving a certificate authority in the Windows root store but not the NTAuth store.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5058921

    Active Directory Group Policy: Events in local policy

    The Local Group Policy Editor or Local Security Policy might show “No auditing” for Audit logon events even when logon events are enabled and being audited. KB5058921 resolves this reporting issue.4

    How to apply the workaround Workaround

    If you are using an update released before April 11, 2025, and experiencing the issue, registry adjustments can prevent it; see the linked Microsoft guidance.4

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-04-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5053594, KB5052006, KB5049993, KB5048671
+2 earlier KB5046612, KB5037423
Replaced by
KB5058921
VersionBuildChannel
1607 14393.7969 General availability

Security

46 vulnerabilities fixed
1 exploited 5 critical 40 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2025-29824 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2023-40547
Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass
 Critical 8.3
CVE-2025-26663
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26670
Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26686
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-27491
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 7.1

The table lists the 6 exploited, publicly disclosed or critical vulnerabilities. See all 46 vulnerabilities →

Updated components

705 files changed since the previous update for the same versions.

Top changed componentsFiles
WPF26
Networking23
Secure Boot13
Graphics and display12
Kernel11
Remote Desktop11
File Explorer and shell10
Search10
Security and sign-in10
Hyper-V and virtualization6
Storage and file systems6
Settings4

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. [Daylight Saving Time (DST)] Update for the Aysen region in Chile to support the government DST change order in 2025. support.microsoft.com
  2. 2. After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device. support.microsoft.com
  3. 3. This change enabled by default might cause Event ID: 45 events to be logged on the domain controller. support.microsoft.com
  4. 4. This issue is resolved in the April 11, 2025—KB5058921 (OS Build 14393.7973) Out-of-band update. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake