Skip to the content
The Update Bureau

Monthly Patch Briefing

December 2025

27 updates released this month across 6 product lines · 17 Patch Tuesday · 5 out-of-band · 1 preview · 1 exploited vulnerability fixed.

Release volume

27 updates released

7 fewer than November (34), vs 42/mo in 2025.

Dec 2025
27
Nov 2025
34
2025 average
42/mo

Security flaws fixed

49 vulnerabilities

+4 flaws compared to November (45).

Dec 2025
49
Nov 2025
45
2025 average
79/mo

Critical & urgent

0 critical · 1 zero-day

2 critical in November, plus 5 out-of-band releases this month .

Dec critical
0
Nov critical
2
2025 average
6/mo

2025 Year-to-Date Trend

951 security flaws fixed across 503 updates in 2025

66 critical flaws and 24 exploited zero-days patched across the 12 published months of 2025.

Distinct security flaws fixed per month Jan – Dec 2025
December 2025
Windows 11
Monthly security update
1 preview 35 fixed 1 exploited 2 with issues
35 fixed · 0 critical Exploited CVE-2025-62221 (Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability)
Windows 10
Monthly security update
3 out-of-band 28 fixed 1 exploited
28 fixed · 0 critical Exploited CVE-2025-62221 (Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability)
Windows Server
Monthly security update
2 out-of-band 36 fixed 1 exploited 2 with issues
36 fixed · 0 critical Exploited CVE-2025-62221 (Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability)

Vulnerabilities fixed, by version

Product Version Monthly update & build Critical Important Total
Windows 11
Windows 11, version 25H2 KB5072033 26200.7462 · 34 34
Windows 11
Windows 11, version 24H2 KB5072033 26100.7462 · 34 34
Windows 11
Windows 11, version 23H2 KB5071417 22631.6345 · 30 30
Windows 10
Windows 10 Enterprise LTSC 2019 KB5071544 17763.8146 · 26 26
Windows 10
Windows 10 Enterprise LTSB 2016 KB5071543 14393.8688 · 15 15
Windows 10
Windows 10, version 22H2 KB5071546 19045.6691 · 28 28
Windows 10
Windows 10 Enterprise LTSC 2021 KB5071546 19044.6691 · 28 28
Windows Server
Windows Server 2025 KB5072033 26100.7462 · 34 34
Windows Server
Windows Server 2022 KB5071547 20348.4529 · 29 29
Windows Server
Windows Server 2019 KB5071544 17763.8146 · 26 26
Windows Server
Windows Server 2016 KB5071543 14393.8688 · 15 15
SharePoint Server
SharePoint Server Subscription Edition KB5002815 16.0.19127.20378 · 1 1
SharePoint Server
SharePoint Server 2019 KB5002816 16.0.10417.20075 · 4 4
SharePoint Server
SharePoint Server 2016 KB5002821 16.0.5530.1000 · 4 4
Office Online Server
Office Online Server KB5002817 16.0.10417.20075 · 5 5
Exchange Server
Exchange Server Subscription Edition KB5071876 15.2.2562.35 · 2 3
Exchange Server
Exchange Server 2019 KB5071875 15.2.1748.42 · 2 2
Exchange Server
Exchange Server 2016 KB5071873 15.1.2507.63 · 2 2

All updates

All updates:
  • Windows 11 · 25H2
    Windows 11 Windows 11 Insider 25H2 Insider Preview
    Beta Channel
    Build 26220.7523

    Copilot on the taskbar and custom Narrator announcements

    Adds taskbar Copilot and agent features, more Narrator controls, and other updates. It also fixes issues in File Explorer, the taskbar, and Windows Update.

    Package KB5072043
    Changes 7 new · 6 improved · 16 fixes
  • Windows 10 · 21H2, 22H2
    Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Out-of-band update
    Out-of-band
    KB5074976

    Message Queuing disruption fixed for managed environments

    Fixes Message Queuing problems introduced by the December 9 updates, including under load in clustered environments. It is available only from the Microsoft Update Catalog.

    Builds 19044.6693 19045.6693
    Replaced by KB5073724 →
  • Windows 10 · 1809
    Windows 10 1809 Windows 10 1809 Out-of-band update Also for Windows Server
    Out-of-band
    KB5074975

    Message Queuing disruption fixed for managed environments

    The update fixes Message Queuing problems that followed the December 9, 2025 updates, an issue that primarily affected enterprise and managed IT environments.

    Build 17763.8148
    Replaced by KB5073723 →
  • Windows 10 · 1607
    Windows 10 1607 Windows 10 1607 Out-of-band update Also for Windows Server
    Out-of-band
    KB5074974

    Restores Message Queuing after the December updates

    Message Queuing issues caused by the December 9 updates are fixed, including problems in clustered environments under load. This out-of-band update is available only from the Microsoft Update Catalog.

    Build 14393.8692
    Replaced by KB5073722 →
  • Windows Server · 2019
    Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10
    Out-of-band
    KB5074975

    Message Queuing failures after December updates fixed

    Fixes Message Queuing problems that could leave queues inactive or prevent applications from writing messages, mainly in enterprise or managed environments.

    Build 17763.8148
    Replaced by KB5073723 →
  • Windows Server · 2016
    Windows Server 2016 Windows Server 2016 Out-of-band update Also for Windows 10
    Out-of-band
    KB5074974

    Message Queuing failures after the December update resolved

    Fixes Message Queuing problems that appeared after the December 9, 2025 updates, including in clustered environments under load.

    Build 14393.8692
    Replaced by KB5073722 →
  • Windows 11 · 26H1
    Windows 11 Windows 11 Insider 26H1 Insider Preview
    Experimental Channel
    Build 28020.1362

    Full-screen Xbox gaming reaches more handhelds

    Expands the Xbox full-screen experience to more handhelds and adds changes to Settings, File Explorer, and other features, alongside fixes across Windows.

    Changes 9 new · 16 improved · 27 fixes
  • Windows 11 · 24H2, 25H2
    Windows 11 24H2 / 25H2 Windows 11 24H2 / 25H2 Security update Also for Windows Server
    Zero-day
    KB5072033

    Cloud Files driver flaw under attack; File Explorer flash fixed

    An actively exploited Cloud Files driver flaw is addressed, and File Explorer’s brief white flash is fixed. The update also includes fixes for virtual switches and other issues.

    Builds 26100.7462 26200.7462
    Security 34 CVEs 1 exploited
    Known issues 3 open
    Replaced by KB5074109 →
  • Windows 11 · 23H2
    Windows 11 23H2 Windows 11 23H2 Security update
    Zero-day
    KB5071417

    Closes exploited Cloud Files flaw; adds a PowerShell warning

    The update fixes 30 Important vulnerabilities, including an exploited Cloud Files driver flaw. PowerShell 5.1 now warns before running scripts from web content.

    Build 22631.6345
    Security 30 CVEs 1 exploited
    Replaced by KB5073455 →
  • Windows 11 · 26H1
    Windows 11 Windows 11 Insider 26H1 Insider Preview
    Experimental Channel
    Build 28000.1340

    Admin protection paused and a storage cluster issue fixed

    Build 28000.1340 temporarily disables admin protection for Canary Channel Insiders and fixes an issue that could affect Storage Spaces or Storage Spaces Direct during cluster creation.

    Changes 1 new · 1 improved · 1 fix
  • Windows 10 · 21H2, 22H2
    Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
    Zero-day
    KB5071546

    PowerShell adds a warning before running web content

    The update adds a security warning and confirmation prompt to PowerShell 5.1’s Invoke-WebRequest command. It also includes a fix for an actively exploited Cloud Files driver vulnerability.

    Builds 19044.6691 19045.6691
    Security 28 CVEs 1 exploited
    Replaced by KB5074976 →
  • Windows 10 · 1809
    Windows 10 1809 Windows 10 1809 Security update Also for Windows Server
    Zero-day
    KB5071544

    Exploited Cloud Files flaw fixed; PowerShell adds a script warning

    Fixes 26 vulnerabilities, including an exploited Cloud Files driver flaw and a publicly disclosed PowerShell vulnerability. It also adds a web-script warning to PowerShell 5.1 and retires the taskbar People icon.

    Build 17763.8146
    Security 26 CVEs 1 exploited
    Replaced by KB5074975 →
  • Windows 10 · 1607
    Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    KB5071543

    PowerShell web requests warn before running scripts

    PowerShell 5.1 now warns and asks for confirmation before `Invoke-WebRequest` can run web content, adding a safeguard against script execution risks. The update also addresses 15 Important vulnerabilities.

    Build 14393.8688
    Security 15 CVEs
    Replaced by KB5074974 →
  • Windows Server · 2025
    Windows Server 2025 Windows Server 2025 Security update Also for Windows 11
    Zero-day
    KB5072033

    Exploited Cloud Files flaw patched; RemoteApp may fail

    Attackers are exploiting a Cloud Files driver flaw, while RemoteApp connections might fail on Azure Virtual Desktop. The update also adds privacy prompts and other features.

    Build 26100.7462
    Security 34 CVEs 1 exploited
    Known issues 2 open
    Replaced by KB5073379 →
  • Windows Server · 2022
    Windows Server 2022 Windows Server 2022 Security update
    Zero-day
    KB5071547

    Exploited Cloud Files driver flaw patched; WSUS still hides sync errors

    The update fixes 29 Important vulnerabilities, including an exploited Cloud Files Mini Filter Driver flaw and a publicly disclosed PowerShell flaw. WSUS synchronization error details remain unavailable after KB5070884 or later.

    Build 20348.4529
    Security 29 CVEs 1 exploited
    Known issues 1 open
    Replaced by KB5073457 →
  • Windows Server · 2019
    Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day
    KB5071544

    Closes exploited Cloud Files flaw; People icon stops responding

    The update closes exploited CVE-2025-62221 in the Cloud Files Mini Filter Driver, adds a script-risk prompt to PowerShell 5.1 web requests, and makes the People taskbar icon unresponsive.

    Build 17763.8146
    Security 26 CVEs 1 exploited
    Replaced by KB5074975 →
  • Windows Server · 2016
    Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    KB5071543

    PowerShell warns before web content can run scripts

    PowerShell 5.1 now warns before `Invoke-WebRequest` content can run scripts, addressing a publicly disclosed remote code execution risk. The update also addresses 15 Important vulnerabilities; an MSMQ issue was later resolved by KB5074974.

    Build 14393.8688
    Security 15 CVEs
    Replaced by KB5074974 →
  • Exchange Server · RTM
    Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
    KB5071876

    Exchange privilege and spoofing flaws addressed; OWA integration fixed

    Addresses three Exchange Server vulnerabilities and fixes a Skype for Business integration failure in Outlook on the web.

    Build 15.2.2562.35
    Security 3 CVEs
    Replaced by KB5074992 →
  • Exchange Server · CU15
    Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update
    KB5071875

    Mail-server elevation-of-privilege and spoofing flaws patched

    The update resolves two Exchange Server 2019 CU15 security vulnerabilities: an elevation-of-privilege flaw and a spoofing flaw. Only organizations enrolled in the Extended Security Update program are eligible.

    Build 15.2.1748.42
    Security 2 CVEs
    Replaced by KB5074993 →
  • Exchange Server · CU14
    Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update
    KB5071874

    Exchange privilege escalation and spoofing flaws addressed

    Addresses two important Exchange Server vulnerabilities: one involving privilege escalation and one involving spoofing. Only organizations enrolled in the Extended Security Update program are eligible.

    Build 15.2.1544.37
    Security 2 CVEs
    Replaced by KB5074994 →
  • Exchange Server · CU23
    Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
    KB5071873

    Privilege escalation and spoofing flaws addressed

    Resolves two important security flaws: one could give an attacker more access, and the other could let an attacker fake an identity.

    Build 15.1.2507.63
    Security 2 CVEs
    Replaced by KB5074995 →
  • SharePoint Server · SE
    SharePoint Server SE SharePoint Server SE Security update
    KB5002815

    Spoofing flaw closed; 25H2 features and workflow fixes added

    The update closes a SharePoint Server spoofing vulnerability and introduces the 25H2 feature update, alongside accessibility, crawling, workflow, search and rendering fixes.

    Build 16.0.19127.20378
    Security 1 CVE
    Replaced by KB5002822 →
  • SharePoint Server · 2019
    SharePoint Server 2019 SharePoint Server 2019 Security update
    KB5002816

    Outlook and Word code-execution flaws addressed; certification issue fixed

    The update addresses four Important vulnerabilities affecting Outlook and Word, and fixes a GB18030-2022 China certification issue in SharePoint Server 2019.

    Build 16.0.10417.20075
    Security 4 CVEs
    Replaced by KB5002825 →
  • SharePoint Server · 2016
    SharePoint Server 2016 SharePoint Server 2016 Security update
    KB5002821

    Outlook and Word code-execution flaws addressed; HTTP scanning enabled

    The update addresses remote code execution vulnerabilities affecting Outlook and Word, and enables scanning of HTTP request bodies in SharePoint 2016. SharePoint Server 2016 updates end July 14, 2026.

    Build 16.0.5530.1000
    Security 4 CVEs
    Replaced by KB5002828 →
  • Office Online Server OOS Office Online Server Security update
    KB5002817

    Excel remote code execution flaws resolved

    The update resolves five Important-severity Microsoft Excel remote code execution vulnerabilities.

    Build 16.0.10417.20075
    Security 5 CVEs
    Replaced by KB5002824 →