Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5068787

KB5068787: Cumulative update for Windows Server, version 2022, November 2025. Exploited Windows kernel flaw patched; unexpected UAC prompts addressed

In short

The update fixes 30 vulnerabilities, including an actively exploited Windows kernel flaw, and addresses unexpected UAC prompts and HTTP request parsing behavior.

Does it affect you? Applies to: Devices running Windows Server 2022.

Build
20348.4405
Security
30 fixed · 2 critical · 1 exploited
Restart
Required

What changes

Fixes 3 changes

App compatibility (known issue)

  • The update addresses unexpected User Account Control prompts for some apps, including Autodesk AutoCAD.1
    Addresses unexpected UAC prompts during MSI repair operations.

Security

For: domain controllers using Microsoft Defender for Endpoint

  • The update addresses a problem that could disrupt cloud communication after promoting a domain controller.2
    The issue affects Windows Server domain controllers using Microsoft Defender for Endpoint; changes to registry permissions after domain controller promotion disrupted cloud-based communication.

Networking

Verified in package

For: servers using HTTP.sys, particularly with front-end proxies

  • HTTP request parsing is corrected to avoid a parsing discrepancy when front-end proxies are part of the setup.3
    The HTTP.sys request parser now addresses acceptance of a single line break in HTTP/1.1 chunk extensions, where RFC 9112 requires a CRLF sequence. To turn on strict parsing, set HttpAllowLenientChunkExtParsing to DWORD 0 under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Http\Parameters.

Improvement 1 change

Servicing stack

For: devices receiving Windows updates

  • The component that installs Windows updates receives quality improvements.4
    Includes the Windows Server 2022 servicing stack update KB5068786, build 20348.4400.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not display synchronization error details after installing KB5070884 or later updates. This functionality is temporarily removed to address CVE-2025-59287.5

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-11-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5070884, KB5066782, KB5065432, KB5063880
+26 earlier KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5071547
VersionBuildChannel
2022 20348.4405 General availability

Security

30 vulnerabilities fixed
1 exploited 2 critical 28 important
VulnerabilitySeverityCVSS
CVE-2025-62215 Exploited
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2025-60724
Windows GDI+ Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-60716
DirectX Graphics Kernel Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2025-64678
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-60715
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 8.0
CVE-2025-62452
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 8.0
CVE-2025-59505
Windows Smart Card Reader Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-59511
Windows WLAN Service Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-59512
Customer Experience Improvement Program (CEIP) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-59514
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-60703
Windows Remote Desktop Services Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-60705
Windows Client-Side Caching Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-60707
Multimedia Class Scheduler Service (MMCSS) Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-60709
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-60713
Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-60714
Windows OLE Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-60720
Windows Transport Driver Interface (TDI) Translation Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-60704
Windows Kerberos Elevation of Privilege Vulnerability
 Important 7.5
CVE-2025-59506
DirectX Graphics Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2025-59507
Windows Speech Runtime Elevation of Privilege Vulnerability
 Important 7.0
CVE-2025-59508
Windows Speech Recognition Elevation of Privilege Vulnerability
 Important 7.0
CVE-2025-60719
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.0
CVE-2025-62213
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.0
CVE-2025-62217
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.0
CVE-2025-60708
Storvsp.sys Driver Denial of Service Vulnerability
 Important 6.5
CVE-2025-60723
DirectX Graphics Kernel Denial of Service Vulnerability
 Important 6.3
CVE-2025-59509
Windows Speech Recognition Information Disclosure Vulnerability
 Important 5.5
CVE-2025-59510
Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability
 Important 5.5
CVE-2025-59513
Windows Bluetooth RFCOM Protocol Driver Information Disclosure Vulnerability
 Important 5.5
CVE-2025-60706
Windows Hyper-V Information Disclosure Vulnerability
 Important 5.5

Downloads (Microsoft Update Catalog)

x64 2022
412.8 MB
windows10.0-kb5068787-x64.msu Main update · KB5068787 SHA-1: e69a4a97…a2388e

Updated components

576 files changed since the previous update for the same versions.

Top changed componentsFiles
Remote Desktop13
Graphics and display11
Networking8
Kernel4
Storage and file systems4
File Explorer and shell3
Secure Boot3
Security and sign-in3
Hyper-V and virtualization2
Settings2
Audio1
Bluetooth1

Verified in package: changed files confirm Networking.

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. [App compatibility (known issue)] Fixed: This update addresses an issue that created unexpected User Account Control (UAC) prompts for some apps, including Autodesk AutoCAD. support.microsoft.com
  2. 2. This update addresses an issue that affects Windows Server domain controllers using Microsoft Defender for Endpoint. After domain controller promotion, changes to registry permissions disrupted cloud-based communication. support.microsoft.com
  3. 3. This update fixes an issue in the HTTP.sys request parser, a Windows component that reads and processes HTTP requests. support.microsoft.com
  4. 4. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  5. 5. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake