The Update BureauKB5065432: Cumulative update for Windows Server, version 2022, September 2025. SMB flaw disclosed; MSI repair prompts reduced
A publicly disclosed SMB elevation-of-privilege flaw is addressed, and fixes reduce unexpected prompts during some MSI repairs. Secure Boot certificates also need attention before they begin expiring in June 2026.
Does it affect you? Applies to: Devices running Windows Server 2022. The package is for x64 systems.
What changes
Fixes 3 changes
App compatibility (known issue)
For: Non-admin users and IT administrators
-
Some non-admin users see fewer unexpected prompts when apps repair or configure themselves. This can help those apps run.1
Reduces the scope of unexpected User Account Control (UAC) prompts during certain MSI custom actions. IT admins can add specific apps to an allowlist to disable UAC prompts for them.
Input
For: Users of the Chinese (Simplified) input method
-
Some extended characters in the Chinese (Simplified) input method no longer appear as empty boxes.2
Addresses an issue with the Chinese (Simplified) Input Method Editor (IME).
Performance
-
A single oversized certificate list no longer slows down system performance.3
The system plans to use smaller, partitioned Certificate Revocation List (CRL) files.
Improvement 1 change
Servicing stack
-
The component that installs Windows updates gets quality improvements.4
Includes servicing stack update KB5065769, build 20348.4160.
New feature 1 change
File server
-
Customers can check whether devices or software might have problems with SMB Server security settings before applying them.5
Enables auditing SMB client compatibility for SMB Server signing and SMB Server EPA.
Known issues
-
SMBv1 protocol connectivity
Microsoft lists an open issue where shared files and folders might be unreachable over SMBv1 on NetBIOS over TCP/IP. It can occur if either the SMB client or server has the September 2025 security update.6
How to apply the workaround WorkaroundThe page names KB5066782 as an update that addresses this issue.6
-
PSDirect connections failing in hotpatched devices
Microsoft lists an open issue where PowerShell Direct connections might fail on hotpatched devices. It can occur when the host and guest virtual machines are not both fully updated.7
How to apply the workaround WorkaroundIf connections fail, update both the host and guest virtual machines with the recommended updates.7
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-09-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5063880, KB5062572, KB5060526, KB5061906
- Replaced by
- KB5066782
| Version | Build | Channel |
|---|---|---|
| 2022 | 20348.4171 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Windows NTLM Elevation of Privilege Vulnerability
|
Critical | 8.8 |
|
Windows Graphics Component Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Windows Graphics Component Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Graphics Kernel Remote Code Execution Vulnerability
|
Critical | 7.3 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 6.7 |
|
Graphics Kernel Remote Code Execution Vulnerability
|
Critical | 6.7 |
|
Windows Imaging Component Information Disclosure Vulnerability
|
Critical | 5.5 |
|
Windows SMB Elevation of Privilege Vulnerability
|
Important | 8.8 |
The table lists the 9 exploited, publicly disclosed or critical vulnerabilities. See all 59 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
561 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Networking | 11 |
| Graphics and display | 10 |
| File Explorer and shell | 7 |
| Security and sign-in | 7 |
| Kernel | 6 |
| Remote Desktop | 6 |
| Secure Boot | 6 |
| Hyper-V and virtualization | 5 |
| Search | 5 |
| Printing | 3 |
| Storage and file systems | 3 |
| Windows Update | 2 |
Verified in package: changed files confirm File server.
Sources
Cited passages from Microsoft's official notes (7)
-
1.
Fixed: Addresses an issue that caused non-admin users to receive unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions.
support.microsoft.com -
2.
Fixed: This update addresses an issue with the Chinese (Simplified) Input Method Editor (IME) where some extended characters appeared as empty boxes.
support.microsoft.com -
3.
Fixed: This update addresses an issue where a single, oversized Certificate Revocation List (CRL) file slows down system performance.
support.microsoft.com -
4.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com -
5.
This update enabled auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA.
support.microsoft.com -
6.
This issue is addressed in KB5066782
support.microsoft.com -
7.
These devices may experience failures with PowerShell Direct (PSDirect) connections when the host and guest virtual machines (VMs) are both not fully updated.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake