Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday Zero-day

KB5073379

KB5073379: Cumulative update for Windows Server, version 2025, January 2026. An exploited desktop display flaw exposes information

In short

Attackers are exploiting a flaw in the desktop display system to expose information. The update also changes credential input during remote support and includes a known cloud-file issue.

Does it affect you? Applies to: Windows Server 2025 devices. The listed standalone package is for x64.

Build
26100.32230
Security
86 fixed · 3 critical · 1 exploited
Restart
Required

What changes

Fixes 3 changes

Networking

Verified in package

For: Azure Virtual Desktop environments

  • Addresses RemoteApp connection failures that might occur in Azure Virtual Desktop after installing KB5072033.1

Servicing

For: Devices that installed KB5070881 and stopped receiving Hotpatch updates

  • Devices affected by a problem that stopped Hotpatch updates after KB5070881 will resume receiving Hotpatch updates after this baseline update.2

WinSqlite3.dll

For: Devices where security software flagged WinSqlite3.dll

  • Some security software should no longer flag the Windows database component as vulnerable.3
    Updates the Windows component WinSqlite3.dll. The page notes that it is separate from app-specific sqlite3.dll files.

Improvements 2 changes

Windows Deployment Services

For: IT administrators using Windows Deployment Services

  • Hands-free deployment is no longer supported by default.4
    Windows Deployment Services changes its default behavior for hands-free deployment. Microsoft provides separate guidance for administrators.

Servicing stack

For: Windows Server 2025 devices

  • The update also improves the component that installs Windows updates.5
    Includes servicing stack update KB5072725, build 26100.32131.

New features 2 changes

Credentials autofill

Verified in package

For: Users of remote support or automated sign-in applications

  • In some remote support and automated sign-in situations, credential dialogs no longer accept typing from virtual keyboards in remote desktop or screen-sharing tools.6
    Adds security hardening that restricts certain applications from autofilling credentials during remote support sessions or automated authentication workflows.

Secure Boot

Gradual rollout Verified in package

For: Devices eligible for new Secure Boot certificates

  • Windows quality updates use device eligibility data to deliver new Secure Boot certificates in phases.7
    Updates include high-confidence device-targeting data. Eligible devices receive the certificates after showing sufficient successful update signals.

Removal 1 change

Compatibility

For: Devices using modems that depend on these drivers

  • Modems that depend on four older modem drivers will no longer work.8
    Removes agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64), and smserial.sys (x86).

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    Windows Server Update Services does not show synchronization error details in its error reports after KB5070881 or later updates. Microsoft says this reporting feature is temporarily removed.9

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Everyone

    Apps might become unresponsive when saving files to cloud-based storage

    Some apps may freeze or show errors when opening or saving cloud files. With Outlook data files on OneDrive, Outlook may hang or fail to reopen; sent items may disappear or old emails may download again.10

    How to apply the workaround Workaround

    Contact the app developer about other ways to access the files. For Outlook, move PST files out of OneDrive; webmail is another option if your provider supports it.10

    Step-by-step workaround instructions
    2 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Contact the app developer about other ways to access the files.
    2. For Outlook, move its PST files out of OneDrive or use webmail if your email provider supports it.
  3. Open Affects: Organizations and IT administrators

    Connection and authentication failures in Azure Virtual Desktop and Windows 365

    Some Windows App sign-ins for Remote Desktop connections fail on Windows client devices, affecting Azure Virtual Desktop and Windows 365.11

    How to apply the workaround Workaround

    Microsoft lists KB5077793 as the workaround.11

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-01-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5072033, KB5072359, KB5068861, KB5070881
+17 earlier KB5070773, KB5066835, KB5068221, KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5043080, KB5044284
Replaced by
KB5077793
VersionBuildChannel
2025 26100.32230 General availability

Security

86 vulnerabilities fixed
1 exploited 3 critical 82 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-20805 Exploited
Desktop Window Manager Information Disclosure Vulnerability
 Important 5.5
CVE-2026-20822
Windows Graphics Component Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-20854
Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-20876
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 6.7
CVE-2023-31096
MITRE: CVE-2023-31096 Windows Agere Soft Modem Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21265
Secure Boot Certificate Expiration Security Feature Bypass Vulnerability
 Important 6.4

The table lists the 6 exploited, publicly disclosed or critical vulnerabilities. See all 86 vulnerabilities →

Updated components

1,589 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings56
Graphics and display21
Security and sign-in17
Printing14
File Explorer and shell12
Remote Desktop12
Windows Update12
Hyper-V and virtualization9
Audio8
Networking8
Bluetooth7
Search7

Verified in package: changed files confirm Networking, Credentials autofill, Secure Boot.

Sources

Updated
Cited passages from Microsoft's official notes (11)
  1. 1. Fixed: This update addresses an issue where you might experience RemoteApp connection failures in Azure Virtual Desktop (AVD) environments. support.microsoft.com
  2. 2. This update addresses an issue where devices that installed the out-of-band update (KB5070881) stopped receiving Hotpatch updates. Affected machines will resume Hotpatch updates after installing the January 2026 baseline update. support.microsoft.com
  3. 3. The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. support.microsoft.com
  4. 4. This update introduces a change in behavior in which WDS will stop supporting hands-free deployment functionality by default. support.microsoft.com
  5. 5. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  6. 6. With this change, credential dialogs do not respond to virtual keyboard input from remote desktop or screen sharing tools or apps. support.microsoft.com
  7. 7. Starting with this update, Windows quality updates include a subset of high confidence device targeting data that identifies devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  8. 8. This update removes the following modem drivers: agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64) and smserial.sys (x86). Modem hardware dependent on these specific drivers will no longer work in Windows. support.microsoft.com
  9. 9. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
  10. 10. For Outlook-specific scenarios, moving the PST files out of OneDrive should resolve the issue. support.microsoft.com
  11. 11. This issue is addressed in KB5077793. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 11 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake