Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5055526

KB5055526: Cumulative update for Windows Server, version 2022, April 2025. Exploited Common Log File System flaw patched

In short

Attackers are exploiting a flaw in the Common Log File System driver. This update also changes daylight saving time support in Chile and adds a protected system folder.

Does it affect you? Applies to: Devices running Windows Server 2022, x64.

Build
20348.3453
Security
80 fixed · 7 critical · 1 exploited
Restart
Required

What changes

Improvements 4 changes

Daylight Saving Time (DST)

  • Daylight saving time in Chile’s Aysen region follows the government’s 2025 change.1

OS Security

  • A new folder appears on the system drive. Leave it in place, even if IIS is not enabled.2
    The update creates %systemdrive%\inetpub as part of security protections.

Kerberos Authentication

  • Kerberos gets added protection against a certificate-related flaw. Domain controllers might log Event ID 45.3
    The change is enabled by default and protects against a vulnerability involving a certificate authority in the Windows root store but not the NTAuth store.

Servicing stack

  • The component that installs Windows updates gets quality improvements.4
    Includes servicing stack update KB5055668, build 20348.3440.

Fix 1 change

System Guard Runtime Monitor Broker service

  • The System Guard service error shown in Event Viewer is addressed by this update. It has no expected effect on performance or security.5
    Addresses the Event 7023 error related to SgrmBroker.exe.

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Devices with Citrix Session Recording Agent version 2411 might fail to finish installing the January 2025 security update and undo the changes. Home users are not expected to be affected.6

    How to apply the workaround Workaround

    Update Citrix Session Recording Agent to version 2503 or later; that resolves the issue.6

  2. Open Affects: Everyone

    System Guard Runtime Monitor Broker service

    Event Viewer might show a System Guard service error after updates released January 14, 2025 or later. KB5055526 addresses it; no effect on performance or security is expected.5

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Open Affects: Organizations and IT administrators

    Active Directory Group Policy: Events in local policy

    Local policy might show logon auditing as off even when logon events are being recorded. KB5058920 resolved this reporting issue; home users are unlikely to be affected.7

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-04-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5053603, KB5051979, KB5052819, KB5049983
+15 earlier KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5058920
VersionBuildChannel
2022 20348.3453 General availability

Security

80 vulnerabilities fixed
1 exploited 7 critical 73 important
VulnerabilitySeverityCVSS
CVE-2025-29824 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2023-40547
Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass
 Critical 8.3
CVE-2025-26663
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26670
Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-27480
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-27482
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26686
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-27491
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 7.1
CVE-2024-21302
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Important 6.7

The table lists the 9 exploited, publicly disclosed or critical vulnerabilities. See all 80 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
389.0 MB
windows10.0-kb5055526-x64.msu Main update · KB5055526 SHA-1: 70f346aa…5bd310

Updated components

0 files changed since the previous update for the same versions.

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. [Daylight Saving Time (DST)] Update for the Aysen region in Chile to support the government DST change order in 2025. support.microsoft.com
  2. 2. After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted support.microsoft.com
  3. 3. This change enabled by default might cause Event ID: 45 events to be logged on the domain controller. support.microsoft.com
  4. 4. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  5. 5. This issue is addressed in KB5055526. support.microsoft.com
  6. 6. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
  7. 7. This issue was resolved by Windows update released April 11, 2025 (KB5058920). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake