Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday

KB5082142

KB5082142: Cumulative update for Windows Server, version 2022, April 2026. Critical IKE flaw patched; BitLocker recovery risk remains

In short

A critical flaw in the Windows IKE service could allow remote code execution. Some managed servers might also ask for a BitLocker recovery key after the first restart.

Does it affect you? Applies to: Devices running Windows Server 2022, x64. The BitLocker recovery issue affects only a limited number of managed systems that meet the listed policy and Secure Boot conditions.

Build
20348.5020
Security
117 fixed · 3 critical
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues The Remote Desktop warning issue is addressed in KB5087545.

The official sources are linked at the end of the page.

What changes

Improvements 8 changes

Connectivity

Verified in package

For: Windows Server administrators

  • Audio features are more reliable, which can reduce system slowdowns linked to sound activity.1

Kernel

Verified in package

For: Windows Server administrators

  • Large file operations are more stable, with fewer unexpected interruptions during work or file transfers.2

Kerberos protocol

  • Kerberos uses AES-SHA1 by default for accounts without an explicit encryption setting.3
    Changes the default DefaultDomainSupportedEncTypes value for KDC operations when an account has no msds-SupportedEncryptionTypes Active Directory attribute.

Networking

Verified in package

For: Windows Server administrators

  • SMB compression over QUIC completes more reliably, reducing the chance of timeouts.4

Remote Desktop

Verified in package

For: Windows Server administrators

  • Remote Desktop shows requested connection settings before connecting. Settings are off by default, and a one-time warning appears the first time an RDP file is opened on a device.5
    The change is intended to improve protection against phishing attacks using .rdp files.

Secure Boot

Gradual rollout Verified in package

For: Windows Server administrators

  • More eligible devices can receive new Secure Boot certificates automatically, in a phased rollout after successful update signals.6
    Windows quality updates include additional high-confidence device-targeting data; certificates are delivered after sufficient successful update signals.

Vulnerable driver blocklist

Verified in package

For: Windows Server administrators

  • More known vulnerable kernel drivers are blocked. Backup apps that rely on them might fail when mounting or managing disk images.7
    Apps may report that VSS timed out during snapshot creation or show VSS_E_BAD_STATE. Microsoft advises updating affected apps to versions that use newer drivers with the required protections.

Servicing stack

For: Windows Server administrators

  • The component that installs Windows updates receives quality improvements to support reliable updates.8
    The update includes servicing stack update KB5082137, build 20348.5021.

Fix 1 change

Secure Boot

Verified in package

For: Windows Server administrators

  • Addresses an issue that could send a device to BitLocker recovery after Secure Boot updates.9

New feature 1 change

Texts and Fonts

For: Windows Server administrators

  • Windows fonts now include the Saudi Riyal currency symbol.10

Removal 1 change

Windows Deployment Services (WDS)

  • WDS Hands-Free Deployment is disabled by default and is no longer supported.7

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not show synchronization error details after KB5070884 or later updates. Microsoft temporarily removed this function to address CVE-2025-59287.11

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    A limited number of managed devices might ask for the BitLocker recovery key at the first restart. This applies only when BitLocker protects the OS drive; the policy includes PCR7; msinfo32.exe reports PCR7 binding as “Not Possible”; the Windows UEFI CA 2023 certificate is in the Secure Boot DB; and the device is not already using the 2023-signed Windows Boot Manager.12

    How to apply the workaround Group Policy

    Removing explicit PCR7 policy settings lets BitLocker bindings use the Windows-selected default PCR profile.12

    Step-by-step instructions, command & download kit
    5 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Open Group Policy Editor with gpedit.msc or use Group Policy Management Console.
    2. Go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
    3. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    4. Run gpupdate /force on affected devices.
    5. Where BitLocker is enabled on the C: drive, run the command to disable protectors, then run the command to enable them again.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:
  3. Open Affects: Everyone

    Warnings related to Remote Desktop might not display correctly

    On some setups with monitors using different display scaling, the Remote Desktop warning might show overlapping text or partly hidden buttons.13

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  4. Resolved Affects: Organizations and IT administrators Resolved by KB5091575

    Domain controllers might restart repeatedly after installing this update

    In forests with multiple domains that use PAM, domain controllers might crash during startup and restart repeatedly. KB5091575 resolves this; hotpatch devices should use KB5091576.14

    Resolution Fixed in KB5091575

    Install KB5091575 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-04-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5078766, KB5082314, KB5075906, KB5078136
+34 earlier KB5077800, KB5073457, KB5071547, KB5068787, KB5070884, KB5066782, KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5091575
VersionBuildChannel
2022 20348.5020 General availability

Security

117 vulnerabilities fixed
3 critical 111 important 1 moderate 2 not rated
VulnerabilitySeverityCVSS
CVE-2026-33824
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-33827
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-33826
Windows Active Directory Remote Code Execution Vulnerability
 Critical 8.0

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 117 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
515.8 MB
windows10.0-kb5082142-x64.msu Main update · KB5082142 SHA-1: 0d2677e2…3ccf1f

Updated components

1,161 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display12
Networking11
Security and sign-in11
Audio10
Secure Boot10
File Explorer and shell8
Hyper-V and virtualization8
Kernel8
Search6
Settings5
Windows Update5
Remote Desktop4

Verified in package: changed files confirm Connectivity, Kernel, Networking, Remote Desktop, Secure Boot, Vulnerable driver blocklist.

Sources

Updated
Cited passages from Microsoft's official notes (14)
  1. 1. This update improves the reliability of audio features in Windows, helping reduce system unresponsiveness related to sound or audio activity. support.microsoft.com
  2. 2. This update improves system stability during large file operations. Users should experience fewer unexpected interruptions while working with or transferring large files. support.microsoft.com
  3. 3. This update changes the default DefaultDomainSupportedEncTypes value for Kerberos Key Distribution Center (KDC) operations to leverage AES-SHA1 for accounts that do not have an explicit msds-SupportedEncryptionTypes Active Directory attribute defined. support.microsoft.com
  4. 4. This update improves reliability when Windows uses SMB compression over QUIC. After you install this update, SMB compression requests over QUIC complete more consistently, reducing the likelihood of timeouts and supporting smoother, more dependable performance. support.microsoft.com
  5. 5. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. support.microsoft.com
  6. 6. Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  7. 7. This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. support.microsoft.com
  8. 8. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  9. 9. This update addresses an issue where the device might enter BitLocker Recovery after the Secure Boot updates. support.microsoft.com
  10. 10. This update improves Windows fonts by adding the new Saudi Riyal currency symbol. support.microsoft.com
  11. 11. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
  12. 12. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. support.microsoft.com
  13. 13. When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with. support.microsoft.com
  14. 14. This issue is addressed in out-of-band update KB5091575. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 14 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake