Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5073457

KB5073457: Cumulative update for Windows Server, version 2022, January 2026. Exploited Desktop Window Manager flaw patched; modem drivers removed

In short

An exploited Desktop Window Manager flaw is addressed, and four modem drivers are removed, so hardware that depends on them stops working.

Does it affect you? Applies to: Devices running Windows Server 2022, including x64 systems. The update is build 20348.4648.

Build
20348.4648
Security
78 fixed · 1 critical · 1 exploited
Restart
Required

What changes

Improvements 3 changes

Credentials autofill

Verified in package
  • Some credential dialogs no longer accept typing sent by remote desktop or screen sharing tools.1
    Hardens autofill during remote support sessions and automated authentication workflows. Credential dialogs do not respond to virtual keyboard input from remote desktop or screen sharing tools or apps.

Windows Deployment Services (WDS)

For: IT administrators using WDS hands-free deployment

  • Hands-free deployment is no longer supported by default.2
    WDS changes its default behavior and stops supporting hands-free deployment functionality by default. Microsoft provides guidance for IT administrators.

Servicing stack

  • The component that installs Windows updates gets quality improvements.3
    Includes servicing stack update KB5074428, build 20348.4640.

Fixes 2 changes

Remote Desktop

Verified in package

For: Users connecting to Citrix hosts

  • Users can start remote sessions more reliably on Citrix hosts.4
    Addresses an issue that causes SearchIndexer to stop responding on Citrix hosts, which might prevent users from starting remote sessions.

WinSqlite3.dll

For: Devices whose security software flagged WinSqlite3.dll

  • Security software should no longer flag the Windows WinSqlite3.dll component as vulnerable.5
    Updates the Windows core component WinSqlite3.dll. This does not update the separate, app-specific sqlite3.dll.

Removal 1 change

Compatibility

For: Devices using these modem drivers

  • Some modem hardware will stop working because its required drivers are removed.6
    Removes agrsm64.sys and smserl64.sys (x64), and agrsm.sys and smserial.sys (x86).

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not show synchronization error details. Microsoft lists this as a known issue for this update.7

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Everyone

    Some devices with Virtual Secure Mode enabled might fail to shut down or hibernate

    Some Secure Launch-capable PCs with Virtual Secure Mode enabled might restart instead of shutting down or entering hibernation. Microsoft lists this as a known issue for this update.8

    How to apply the workaround Workaround

    Microsoft says KB5075906 addresses this issue.8

  3. Open Affects: Everyone

    Apps might become unresponsive when saving files to cloud-based storage

    Some apps might freeze or show errors when opening or saving cloud-based files. Outlook might hang or fail to reopen; sent items might be missing, and downloaded emails might download again. Microsoft lists this as a known issue for this update.9

    How to apply the workaround Workaround

    Microsoft says KB5078136 addresses this issue.9

  4. Open Affects: Organizations and IT administrators

    Connection and authentication failures in Azure Virtual Desktop and Windows 365

    Some Windows App sign-ins to Azure Virtual Desktop or Windows 365 might fail on specific Windows client builds. Microsoft lists this as a known issue for this update.10

    How to apply the workaround Workaround

    Microsoft says KB5077800 addresses this issue.10

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-01-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5071547, KB5068787, KB5070884, KB5066782
+28 earlier KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5077800
VersionBuildChannel
2022 20348.4648 General availability

Security

78 vulnerabilities fixed
1 exploited 1 critical 76 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-20805 Exploited
Desktop Window Manager Information Disclosure Vulnerability
 Important 5.5
CVE-2026-20822
Windows Graphics Component Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2023-31096
MITRE: CVE-2023-31096 Windows Agere Soft Modem Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21265
Secure Boot Certificate Expiration Security Feature Bypass Vulnerability
 Important 6.4

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 78 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
413.4 MB
windows10.0-kb5073457-x64.msu Main update · KB5073457 SHA-1: c194bd30…2455f0

Updated components

600 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display14
Security and sign-in10
Kernel8
Networking7
Hyper-V and virtualization6
Printing6
File Explorer and shell5
Search5
Secure Boot5
Remote Desktop2
Audio1
Bluetooth1

Verified in package: changed files confirm Credentials autofill, Remote Desktop.

Sources

Updated
Cited passages from Microsoft's official notes (10)
  1. 1. With this change, credential dialogs do not respond to virtual keyboard input from remote desktop or screen sharing tools or apps. support.microsoft.com
  2. 2. This update introduces a change in behavior in which WDS will stop supporting hands-free deployment functionality by default. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. This update addresses an issue that causes SearchIndexer (the Windows service that indexes files for search) to stop responding on Citrix hosts, which might prevent users from starting remote sessions. support.microsoft.com
  5. 5. The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. support.microsoft.com
  6. 6. This update removes the following modem drivers: agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64) and smserial.sys (x86). Modem hardware dependent on these specific drivers will no longer work in Windows. support.microsoft.com
  7. 7. After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. support.microsoft.com
  8. 8. After installing this update, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts. support.microsoft.com
  9. 9. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. support.microsoft.com
  10. 10. credential prompt failures occured during Remote Desktop connections using the Windows App on Windows client devices, impacting Azure Virtual Desktop and Windows 365. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake