Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5060526

KB5060526: Cumulative update for Windows Server, version 2022, June 2025. Exploited Internet Shortcut flaw patched; DHCP service may stall

In short

Fixes 40 vulnerabilities, including an actively exploited Internet Shortcut Files flaw. The DHCP Server service might intermittently stop responding; KB5062572 resolves that issue.

Does it affect you? Applies to: Devices running Windows Server 2022. The DHCP issue concerns servers running the DHCP Server service and the clients that depend on it for IP renewal.

Build
20348.3807
Security
40 fixed · 4 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What to do With the specified WSUS product and classification configured, the update automatically syncs to WSUS. The official page does not say that WSUS installs it automatically.

The official sources are linked at the end of the page.

What changes

Fixes 5 changes

Graphics

2 items
  • Some characters no longer appear wider than standard characters, and the sample paragraph in the font preview displays correctly.1
  • Some characters in the extended Chinese character set display correctly.2
    Addresses an issue affecting some GB18030-2022 characters.

Memory leak

Verified in package
  • Input Service memory use no longer increases in a way that might affect performance in multi-user, multilingual, and remote desktop environments.3
    Addresses an increased memory usage issue in Input Service.

Settings

Verified in package

For: Devices with the policy enabled

  • Turning on the “Prohibit Access to Control Panel and PC Settings” policy no longer causes the system to repeatedly restart and enter repair mode.4

Windows Hello

For: Windows Hello for Business users using the Key Trust model

  • Users can sign in with self-signed certificates when using Windows Hello for Business with the Key Trust model.5

Improvement 1 change

Servicing stack

  • The component that installs Windows updates receives quality improvements.6
    Includes servicing stack update KB5058531, build 20348.3691.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5062572

    DHCP Server service

    After installing this update, the DHCP Server service might intermittently stop responding, affecting IP renewal for clients. KB5062572 resolves the issue.7

    Resolution Fixed in KB5062572

    Install KB5062572 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-06-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5061906, KB5058385, KB5059092, KB5058920
+20 earlier KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5062572
VersionBuildChannel
2022 20348.3807 General availability

Security

40 vulnerabilities fixed
1 exploited 4 critical 36 important
VulnerabilitySeverityCVSS
CVE-2025-33053 Exploited
Internet Shortcut Files Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-29828
Windows Schannel Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-33070
Windows Netlogon Elevation of Privilege Vulnerability
 Critical 8.1
CVE-2025-33071
Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-49735
Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability
 Important 8.8

The table lists the 6 exploited, publicly disclosed or critical vulnerabilities. See all 40 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
397.6 MB
windows10.0-kb5060526-x64.msu Main update · KB5060526 SHA-1: bb347435…b883c4

Updated components

570 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display7
Networking7
File Explorer and shell6
Kernel6
Secure Boot6
Hyper-V and virtualization5
Search5
Security and sign-in5
Storage and file systems5
Windows Update4
Printing3
Remote Desktop3

Verified in package: changed files confirm Memory leak, Settings.

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. Fixed: An issue where some characters appear wider than standard characters, and the sample paragraph in the font preview section doesn’t display correctly. support.microsoft.com
  2. 2. This update addresses an issue where some GB18030-2022 characters don’t display correctly within the extended Chinese character set. support.microsoft.com
  3. 3. This update addresses an issue in the Input Service that causes increased memory usage, potentially impacting performance in multi-user, multilingual, and remote desktop environments. support.microsoft.com
  4. 4. This update addresses an issue in the Settings app where turning on the "Prohibit Access to Control Panel and PC Settings" policy could make the system repeatedly restart and automatically enter repair mode. support.microsoft.com
  5. 5. Fixed: This update addresses an issue that prevents users from signing in with self-signed certificates when using Windows Hello for Business with the Key Trust model. support.microsoft.com
  6. 6. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  7. 7. This issue was resolved by Windows updates released on and after July 8, 2025 (KB5062572). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake