The Update BureauFiltered Update Catalog
Known issues — All products
51–75 of 355 updates, newest first.
Terms & labels
Label legend
- Security
- Contains fixes for security vulnerabilities.
- Preview
- Optional update with new features and fixes, without new security patches. Its content joins the next Patch Tuesday update.
- Out-of-band
- Released outside the usual monthly schedule, usually to fix a specific problem.
- Cumulative
- Includes everything from earlier updates, so the latest one is enough.
- Zero-day
- Microsoft reports a vulnerability that was already exploited or publicly known when the fix came out.
- Windows Insider Preview
- A pre-release build for testers, not meant for everyday PCs.
- Updated
- We revised this page after publishing because Microsoft changed its notes.
-
Exchange Server · CU15Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update
Published calendar feeds can fail; hybrid sent-mail copies fixed
Security vulnerabilities are addressed, and a hybrid shared-mailbox message-copy problem is fixed. Published calendar subscriptions can still return HTTP 500; a workaround is available.
-
Exchange Server · CU14Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update
Exchange security flaws addressed; hybrid mailbox wrappers fixed
Security flaws are addressed, and a hybrid shared-mailbox message issue is fixed under specific mailbox and permission settings. Published calendar subscriptions stop refreshing and return HTTP 500 errors.
-
Exchange Server · CU23Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
Eight security flaws addressed; published calendar feeds can fail
Addresses eight Important vulnerabilities and fixes wrapper messages appearing in shared mailboxes in hybrid deployments. Published calendar subscriptions can still return HTTP 500.
-
SQL Server · CU8 + GDRSQL Server 2025 CU8 + GDR SQL Server 2025 CU8 + GDR Security update
Four critical remote-code flaws fixed; MSDASQL queries may fail
Fixes 56 vulnerabilities, including four critical SQL Server remote-code execution flaws. Linked-server queries using MSDASQL with a provider string can fail, and queries during database recovery can trigger an access violation.
-
SQL Server · GDRSQL Server 2025 GDR SQL Server 2025 GDR Security update
Critical database flaws addressed; linked-server queries may fail
Addresses 56 SQL Server vulnerabilities, including four critical remote-code-execution flaws. Linked server queries using MSDASQL and a provider string can fail with error 7416.
-
SQL Server · CU26 + GDRSQL Server 2022 CU26 + GDR SQL Server 2022 CU26 + GDR Security update
Remote-code flaws patched; two issues remain open
The update fixes 52 vulnerabilities, including four critical remote-code-execution flaws. KB5126934 supersedes it, so use the newer update rather than installing this package.
-
SQL Server · GDRSQL Server 2022 GDR SQL Server 2022 GDR Security update
Four critical database code-execution flaws patched
Fixes 52 vulnerabilities, including four critical remote code execution flaws. Some linked server queries using MSDASQL can still fail with error 7416.
-
SQL Server · CU32 + GDRSQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update
52 vulnerabilities addressed; linked-server queries can fail
Addresses 52 vulnerabilities, including three Critical remote code execution flaws; none are listed as exploited. Some linked-server queries might fail with error 7416 after installation.
-
SQL Server · GDRSQL Server 2019 GDR SQL Server 2019 GDR Security update
Three critical remote-code flaws affect the database engine
Fixes 52 vulnerabilities, including three critical flaws that could allow remote code execution in SQL Server. It also lists an open issue that can make some linked server queries fail with error 7416.
-
SQL Server · CU31 + GDRSQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update
Critical remote-code-execution flaw patched; linked queries can fail
Fixes 45 vulnerabilities, including one critical SQL Server remote-code-execution flaw. Linked server queries using MSDASQL and a provider string can fail with error 7416.
-
SQL Server · GDRSQL Server 2017 GDR SQL Server 2017 GDR Security update
Database Engine remote-code flaw patched; linked-server error remains
The update fixes 45 vulnerabilities, including one Critical SQL Server remote-code execution flaw. Linked-server queries using MSDASQL and a provider string can still fail with error 7416.
-
SQL Server · CU8SQL Server 2025 CU8 SQL Server 2025 CU8 Cumulative update
Database recovery queries can trigger access violations; JSON fixes included
Includes 11 fixes for SQL Server 2025. It also has an open issue where querying requests during database recovery might cause an access violation and dump file.
-
Windows 11 · 24H2, 25H2Windows 11 24H2 / 25H2 Windows 11 24H2 / 25H2 Security updateZero-day UpdatedKB5121003
Secure Boot targeting expands; Drop Tray is removed
Secure Boot updates reach more eligible PCs, while Drop Tray and its Multitasking setting are removed. The update also closes an actively exploited WinSock driver flaw.
Builds 26100.9168 26200.9168Security 195 CVEs 7 critical 1 exploitedKnown issues 1 with a workaroundReplaced by KB5120998 → -
Windows Server · 2025Windows Server 2025 Windows Server 2025 Security updateZero-day UpdatedKB5120233
Winsock driver flaw under attack; DFS file previews improved
An actively exploited Winsock driver flaw gets a security fix. File Explorer also handles files on DFS drives better after network reconnects.
Build 26100.33296Security 216 CVEs 19 critical 1 exploitedKnown issues 1 openReplaced by KB5122871 → -
Windows Server · 2022Windows Server 2022 Windows Server 2022 Security updateZero-day UpdatedKB5120242
WinSock driver flaw under active attack
An actively exploited elevation-of-privilege flaw affects the Ancillary Function Driver for WinSock. The update also improves Secure Boot certificate targeting.
Build 20348.5499Security 195 CVEs 19 critical 1 exploitedKnown issues 1 openReplaced by KB5122882 → -
Exchange Server · RTMExchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
Exchange privilege flaw addressed; published calendar feeds can fail
A critical Exchange privilege-escalation flaw is addressed. Published calendar subscriptions might stop refreshing and return HTTP 500.
-
Exchange Server · CU15Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update
Critical privilege-escalation flaw in the mail server addressed
A critical flaw could let attackers gain higher privileges on the mail server. Only organizations enrolled in the Extended Security Update program can receive this release.
-
Exchange Server · CU14Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update
Critical Exchange privilege flaw covered; CU14 ESU ends in October
A critical Exchange privilege flaw is addressed. CU14 security updates are available only to ESU organizations through October 31, 2026.
-
Exchange Server · CU23Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
Critical mailbox privilege flaw; shared-mailbox wrappers persist
A critical elevation-of-privilege flaw in Exchange is fixed. Two known issues remain, including wrapper messages in shared mailboxes in hybrid setups.
-
SQL Server · CU7SQL Server 2025 CU7 SQL Server 2025 CU7 Cumulative update
JSON corruption fixes; recovery monitoring can still crash
CU7 fixes 10 issues, including JSON corruption and a crash in recovery monitoring queries. A separate open issue can still cause an access violation when `sys.dm_exec_requests` runs during database recovery.
-
SQL Server · CU26SQL Server 2022 CU26 SQL Server 2022 CU26 Cumulative update
SQL injection fix, while recovery queries can still trigger crashes
Includes 12 fixes, including a SQL injection fix. A known issue can still cause an access violation when `sys.dm_exec_requests` runs during database recovery.
-
Windows Server · 2025Windows Server 2025 Windows Server 2025 Security updateZero-day UpdatedKB5099536
Actively exploited AD FS and Shell flaws addressed
The update addresses actively exploited flaws in AD FS and Windows Shell, along with a publicly disclosed BitLocker flaw. It also adds cryptography support and fixes several reported problems.
Build 26100.33158Security 390 CVEs 31 critical 2 exploitedKnown issues 1 openReplaced by KB5120233 → -
Windows Server · 2022Windows Server 2022 Windows Server 2022 Security updateZero-day UpdatedKB5099540
Exploited AD FS flaw patched; BitLocker recovery prompt remains possible
An actively exploited AD FS elevation flaw and a Windows Shell spoofing flaw get security fixes. Check BitLocker settings before installing on affected managed servers.
Build 20348.5386Security 327 CVEs 28 critical 2 exploitedKnown issues 2 openReplaced by KB5120242 → -
Exchange Server · RTMExchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
Critical Exchange spoofing flaw addressed; mailbox issue remains
A critical Exchange spoofing vulnerability is addressed. Hybrid shared mailboxes might still receive wrapper messages after the June security update; KB5121608 or later resolves the issue.
-
SQL Server · CU6 + GDRSQL Server 2025 CU6 + GDR SQL Server 2025 CU6 + GDR Security update
MessageQueueTask blocks unsafe MSMQ deserialization; MSDASQL links fail
Fixes SQL Server vulnerabilities, including two critical remote code execution flaws. Linked-server queries using MSDASQL and a provider string might fail with error 7416.