Skip to the content
The Update Bureau
Windows 10 1607 Windows 10 1607 Security update
Patch Tuesday Zero-day

KB5066836

KB5066836: Cumulative update for Windows 10, version 1607, October 2025. Closes an exploited Remote Access Manager flaw; disables file previews

In short

Patches an exploited Windows Remote Access Connection Manager vulnerability and changes how File Explorer previews downloaded files. It also fixes long-running remote command timeouts and removes support for a fax modem driver.

Does it affect you? Applies to: Devices running Windows 10 IoT Enterprise 2016 LTSB, version 1607, on x86 or x64.

Build
14393.8519
Security
71 fixed · 1 critical · 3 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 2 changes

Cryptography

  • RSA-based smart card certificates must use Key Storage Provider instead of Cryptographic Service Provider, which might affect smart card sign-in.1
    Enforces KSP instead of CSP for RSA-based smart card certificates. The KB directs users who experience authentication problems to the Windows Release Health site for resolution steps.

File Explorer

  • File Explorer automatically disables previews for files downloaded from the internet. The KB links to instructions for unblocking files.2
    Disables the preview feature for files downloaded from the internet to prevent a vulnerability when users preview potentially unsafe files.

Fix 1 change

Windows Remote Management (WinRM)

  • PowerShell remote commands no longer time out after running for 600 seconds.3
    Fixes the timeout issue affecting PowerShell Remoting and WinRM.

Removal 1 change

Fax modem driver

For: Devices using this fax modem driver

  • Fax modem hardware that depends on the removed driver no longer works in Windows.4
    Removes the ltmdm64.sys driver.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-10-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5065427, KB5063871, KB5062560, KB5061010
+9 earlier KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5068864
VersionBuildChannel
1607 14393.8519 General availability

Security

71 vulnerabilities fixed
3 exploited 1 critical 70 important
VulnerabilitySeverityCVSS
CVE-2025-24990 Exploited
Windows Agere Modem Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-59230 Exploited
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-47827 Exploited
MITRE CVE-2025-47827: Secure Boot bypass in IGEL OS before 11
 Important 4.6
CVE-2016-9535
MITRE CVE-2016-9535: LibTIFF Heap Buffer Overflow Vulnerability
 Critical 4.0
CVE-2025-24052
Windows Agere Modem Driver Elevation of Privilege Vulnerability
 Important 7.8

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 71 vulnerabilities →

Updated components

769 files changed since the previous update for the same versions.

Top changed componentsFiles
WPF22
Graphics and display18
Audio17
Networking16
ASP.NET10
Remote Desktop10
Hyper-V and virtualization8
Search8
Secure Boot8
Storage and file systems8
Kernel7
File Explorer and shell6

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. This update enforces a security hardening improvement by requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. support.microsoft.com
  2. 2. After installing this update, File Explorer automatically disables the preview feature for files downloaded from the internet. support.microsoft.com
  3. 3. Fixed: An issue that affects PowerShell Remoting and WinRM in which commands time out after 600 seconds. support.microsoft.com
  4. 4. This update removes the ltmdm64.sys driver. Fax modem hardware dependent on this specific driver will no longer work in Windows. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake