Skip to the content
The Update Bureau

Windows 10 1607

Windows 10 Enterprise LTSB 2016

Every published release for Windows 10 Enterprise LTSB 2016, newest first: what each update changes, whether to install it and any confirmed known issues.

Latest
KB5131291 Nov 10, 2026
Build
14393.9688
Released
Aug 2, 2016
All editions
no longer updated since Oct 13, 2026
Known issues
1 open

Latest update

  • KB5131291 Released Nov 10, 2026
    Build 14393.9688

Build history

  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    Final update for this version Updated

    KB5131291

    Message Queuing and Windows Search flaws patched

    Critical flaws in Message Queuing and Windows Search lead this release, alongside fixes for printing, Remote Desktop, and USB audio.

    Support for this version ended October 13, 2026. Eligible devices need ESU enrollment to keep receiving critical and important security updates.

    Key changes 453 CVEs · 9 changes

    • Improved Date and Time: Cuba's daylight saving time rules now reflect its schedule through 2027.
    • Improved Windows PowerShell: PowerShell checks script signatures more strictly. Scripts with invalid UTF-8 encoding might fail validation, even if they passed befor...
    • Improved Security: NTLM connections offer message signing by default when they are not anonymous. This helps reduce exposure to relay attacks.

    Read update Source: Microsoft

    Build
    14393.9688
    Security
    453 fixed · 24 critical
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Out-of-band update Also for Windows Server
    Out-of-band Updated

    KB5134123

    Offline devices get updated trusted certificates

    Devices that cannot reach Microsoft’s certificate service get updated trusted certificate data. Support for this edition ended October 13, 2026.

    Check the newer update, KB5131291
    Support for Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB ended October 13, 2026.

    Key changes 1 change

    • Improved Certificates: Devices that cannot get certificate updates from Microsoft receive updated trusted certificate data.

    Read update Source: Microsoft

    Build
    14393.9615
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    Zero-day Updated

    KB5126868

    Actively exploited Windows Shell flaw patched; storage issues addressed

    An actively exploited Windows Shell flaw is patched, alongside fixes for File History and offline Storage Spaces Direct disks. Free support for these 2016 LTSB editions ends on release day.

    Check the newer update, KB5134123
    Free support for Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB ends October 13, 2026.

    Key changes 748 CVEs · 6 changes

    • New Date and Time: A new Manitoba time zone is available.
    • New ReFS security: ReFS volumes on external storage devices gain auditing and optional security controls.
    • Improved Date and Time: Permanent daylight saving time support starts in British Columbia and Alberta in November 2026.

    Read update Source: Microsoft

    Build
    14393.9612
    Security
    748 fixed · 20 critical · 1 exploited
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Out-of-band update Also for Windows Server
    Out-of-band

    KB5129239

    Remote Desktop instability and multichannel USB audio addressed

    Addresses Remote Desktop instability and fixes failures in 8-channel or 3D audio on some USB Audio Class 1.0 devices. Other USB audio symptoms remain unresolved.

    Check the newer update, KB5126868
    Free support for Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB ends October 13, 2026. Microsoft points to information about Extended Security Updates.

    Key changes 2 changes

    • Fix Remote Desktop Services (known issue): Addresses Remote Desktop instability that could cause connection or sign-in failures, unresponsive servers, and related tools to stop r...
    • Fix 8-channel or 3D audio modes: Some USB Audio Class 1.0 devices that worked in standard stereo no longer fail when using 8-channel or 3D audio modes.

    Read update Source: Microsoft

    Build
    14393.9514
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    Zero-day Updated

    KB5123099

    Windows ALPC flaw under attack; Remote Desktop audio addressed

    Attackers are exploiting a Windows ALPC privilege flaw. The update also addresses Remote Desktop audio problems and adds Secure Boot certificate targeting data.

    Check the newer update, KB5129239
    Free updates and security fixes for Enterprise LTSB 2016 end on October 13, 2026. Microsoft points to information about Extended Security Updates.

    Key changes 559 CVEs · 4 changes

    • Improved Secure Boot: More eligible PCs can receive new Secure Boot certificates automatically.
    • Improved Date and Time: Morocco's local time will reflect its move to permanent UTC+00:00 on September 20, 2026.
    • Improved Windows Code Integrity policies: Application compatibility improves during Windows certificate-authority changes.

    Read update Source: Microsoft

    Build
    14393.9512
    Security
    559 fixed · 45 critical · 1 exploited
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    Zero-day Updated

    KB5120418

    Exploited WinSock driver flaw patched; File History backups restored

    An exploited WinSock driver flaw is patched, and failed File History network backups are fixed. Secure Boot certificate updates continue to reach eligible devices.

    Check the newer update, KB5123099
    Windows 10 Enterprise LTSB 2016 and IoT Enterprise 2016 LTSB reach end of support on October 13, 2026.

    Key changes 147 CVEs · 2 changes

    • Improved Secure Boot: More devices can receive updated Secure Boot certificates automatically. The rollout continues over the coming months.
    • Fix Backup: File History backups to network shares work again instead of failing with an incorrect credentials error.
    • Exploited CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14393.9418
    Security
    147 fixed · 11 critical · 1 exploited
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    Zero-day Updated

    KB5099535

    Exploited AD FS flaw patched; unregistered TDI apps may stop working

    Attackers are exploiting an AD FS privilege flaw. This release also tightens TDI transport rules, which might stop apps using unregistered third-party transports.

    Check the newer update, KB5120418
    Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB reach end of support on October 13, 2026.

    Key changes 250 CVEs · 6 changes

    • New Remote Desktop (RDP) Security: Trusted Remote Desktop publishers can use SHA-2 certificate thumbprints. SHA-1 remains for compatibility but is planned for removal.
    • Improved Secure Boot: More devices qualify for automatic Secure Boot certificate updates. Certificates began expiring in June 2026, but devices without repla...
    • Improved Networking: Some apps using unregistered third-party network transports might stop working.

    Read update Source: Microsoft

    Build
    14393.9339
    Security
    250 fixed · 25 critical · 2 exploited
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server

    KB5094122

    Secure Boot reaches more devices; folder icons may disappear

    More devices can qualify for Secure Boot certificate updates, while stricter folder handling may hide custom icons or names. Support ends October 13, 2026.

    Check the newer update, KB5099535
    Windows 10 Enterprise LTSB 2016 and IoT Enterprise 2016 LTSB support ends October 13, 2026.

    Key changes 73 CVEs · 3 changes

    • New Secure Boot: A new policy can limit the Secure Boot service data Windows sends to Microsoft.
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates after showing enough successful update signals.
    • Improved Folder customization: Custom folder icons or localized folder names might be missing for content from downloaded or remote locations. Folder access is not af...

    Read update Source: Microsoft

    Build
    14393.9234
    Security
    73 fixed · 11 critical
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server

    KB5087537

    Remote Desktop warnings and Microsoft account sign-in fixed

    Fixes a Remote Desktop warning display issue and a Microsoft account sign-in error, and addresses 44 vulnerabilities, including three Critical ones.

    Check the newer update, KB5094122
    Support for Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB ends October 13, 2026. Secure Boot certificates used by most Windows devices have started expiring in June 2026; Microsoft recommends preparing certificate updates in advance.

    Key changes 44 CVEs · 4 changes

    • New Secure Boot: Eligible devices get a SecureBoot folder containing example scripts for checking and managing Secure Boot certificate updates.
    • Improved Daylight Savings Time (DST): Daylight-saving-time support is updated for the Arab Republic of Egypt to reflect its 2023 government change order.
    • Fix Remote Desktop security warnings: The Remote Desktop Connection security warning dialog no longer might render incorrectly across monitors with different display scaling...

    Read update Source: Microsoft

    Build
    14393.9140
    Security
    44 fixed · 3 critical
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Out-of-band update Also for Windows Server
    Out-of-band

    KB5091572

    Remote Desktop security warnings display correctly again

    The update adds a resolution for incorrectly displayed Remote Desktop security warnings. It is available only from the Update Catalog and requires the latest servicing stack update.

    Check the newer update, KB5087537
    Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB reach end of support on October 13, 2026.

    Key changes 1 change

    • Fix Remote Desktop: The KB page adds a resolution for Remote Desktop security warnings that might not display correctly.

    Read update Source: Microsoft

    Build
    14393.9062
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server

    KB5082198

    Critical IKE and TCP/IP remote-code flaws patched

    Fixes 79 vulnerabilities, including two critical remote-code execution flaws in Windows IKE Service Extensions and TCP/IP. It also expands the phased rollout of new Secure Boot certificates.

    Check the newer update, KB5091572
    Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB reach end of support on October 13, 2026.

    Key changes 79 CVEs · 3 changes

    • Improved Remote Desktop: When you open an .rdp file, Remote Desktop shows its requested connection settings before connecting. Each setting is off by default, a...
    • Improved Secure Boot: More eligible devices may automatically receive new Secure Boot certificates, but only after successful update signals.
    • Fix Windows Configuration System (WinCS): Secure Boot can be enabled through WinCS again when its components are present.

    Read update Source: Microsoft

    Build
    14393.9060
    Security
    79 fixed · 2 critical
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server

    KB5078938

    Secure Boot certificate targeting expands; catalog warning added

    Secure Boot certificate targeting now covers more eligible devices, and Windows System Image Manager warns users to confirm a catalog is trusted. The update addresses 35 Important vulnerabilities.

    Check the newer update, KB5082198
    Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB reach end of support on October 13, 2026.

    Key changes 35 CVEs · 2 changes

    • New Windows System Image Manager: A warning dialog helps you confirm that a selected catalog file comes from a trusted source.
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates automatically, through a controlled, phased rollout.
    • CVSS 8.8 CVE-2026-23669: RPC Runtime Library Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8957
    Security
    35 vulnerabilities fixed
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    Zero-day

    KB5075999

    Exploited Shell and MSHTML flaws patched; GPU stability fixed

    The update fixes 20 vulnerabilities, including two publicly disclosed and exploited Shell and MSHTML security bypasses, and resolves a stability issue on some GPU configurations.

    Check the newer update, KB5078938
    Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB reach end of support October 13, 2026. Windows Server 2016 reaches end of support January 12, 2027; free updates, technical assistance, and security fixes end on these dates.

    Key changes 20 CVEs · 1 change

    • Fix Graphics: A stability issue affecting some GPU configurations is fixed.
    • Exploited CVE-2026-21510: Windows Shell Security Feature Bypass Vulnerability
    • Exploited CVE-2026-21513: MSHTML Framework Security Feature Bypass Vulnerability

    Read update Source: Microsoft

    Build
    14393.8868
    Security
    20 vulnerabilities fixed · 5 actively exploited
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    Zero-day

    KB5073722

    Exploited Desktop Window Manager flaw patched; modem drivers removed

    The update fixes 51 vulnerabilities, including an exploited Desktop Window Manager information-disclosure flaw, and removes four modem drivers, disabling hardware that depends on them.

    Check the newer update, KB5075999
    Secure Boot certificates have started expiring in June 2026; certain personal and business devices might not boot securely if certificates are not updated in time. The page recommends reviewing the guidance and updating certificates in advance.

    Key changes 51 CVEs · 3 changes

    • New Credentials autofill: Credential dialogs do not accept virtual keyboard input from remote desktop or screen-sharing tools or apps.
    • Fix WinSqlite3.dll: The Windows component WinSqlite3.dll is updated because some security software might have detected it as vulnerable.
    • Removed Drivers: Modem hardware that relies on the removed drivers will no longer work in Windows.

    Read update Source: Microsoft

    Build
    14393.8783
    Security
    51 fixed · 1 critical · 1 exploited
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Out-of-band update Also for Windows Server
    Out-of-band

    KB5074974

    Restores Message Queuing after the December updates

    Message Queuing issues caused by the December 9 updates are fixed, including problems in clustered environments under load. This out-of-band update is available only from the Microsoft Update Catalog.

    Check the newer update, KB5073722
    Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB reach end of support on October 13, 2026.

    Key changes 1 change

    • Fix Message queuing (MSMQ) (known issue): Message Queuing issues that appeared after the December 9 updates are fixed. They included inactive queues, resource errors, and proble...

    Read update Source: Microsoft

    Build
    14393.8692
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server

    KB5071543

    PowerShell web requests warn before running scripts

    PowerShell 5.1 now warns and asks for confirmation before `Invoke-WebRequest` can run web content, adding a safeguard against script execution risks. The update also addresses 15 Important vulnerabilities.

    Check the newer update, KB5074974
    Windows 10 Enterprise LTSB 2016 reaches end of support on October 13, 2026. Microsoft will no longer provide free updates, technical assistance, or security fixes after that date.

    Key changes 15 CVEs · 1 change

    • Improved PowerShell 5.1: Invoke-WebRequest warns about script execution risk and asks for confirmation before continuing.
    • CVSS 8.8 CVE-2025-62549: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2025-54100: PowerShell Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8688
    Security
    15 vulnerabilities fixed
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server

    KB5068864

    Critical GDI+ flaw fixed; unexpected app prompts addressed

    Fixes 25 security vulnerabilities, including the critical GDI+ remote-code execution flaw CVE-2025-60724. It also addresses unexpected UAC prompts for some apps, including Autodesk AutoCAD.

    Check the newer update, KB5071543
    Windows 10 Enterprise LTSB 2016 reaches end of support on October 13, 2026. Microsoft recommends reviewing its Extended Security Updates availability.

    Key changes 25 CVEs · 2 changes

    • Improved Internal Windows OS: The update includes miscellaneous security improvements to internal Windows OS functionality.
    • Fix App compatibility (known issue): Unexpected UAC prompts for some apps, including Autodesk AutoCAD, are addressed.
    • Critical CVE-2025-60724: Windows GDI+ Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8594
    Security
    25 fixed · 1 critical
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Out-of-band update Also for Windows Server
    Out-of-band

    KB5070882

    Version 1607 gets an out-of-band update

    Moves Enterprise LTSB 2016 to build 14393.8524. Support for version 1607 ends October 13, 2026.

    Support for version 1607 ends October 13, 2026.

    Key security notes

    • Other The cumulative update is an out-of-band release and updates version 1607 to build 14393.8524.

    Read update Source: Microsoft

    Build
    14393.8524
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    Zero-day

    KB5066836

    Closes an exploited Remote Access Manager flaw; disables file previews

    Patches an exploited Windows Remote Access Connection Manager vulnerability and changes how File Explorer previews downloaded files. It also fixes long-running remote command timeouts and removes support for a fax modem driver.

    Check the newer update, KB5068864
    The KB applies to Windows 10 IoT Enterprise 2016 LTSB. The dossier lists October 13, 2026 as the end of updates for this edition; the KB also states that Windows 10 support ended on October 14, 2025.

    Key changes 71 CVEs · 4 changes

    • Improved Cryptography: RSA-based smart card certificates must use Key Storage Provider instead of Cryptographic Service Provider, which might affect smart car...
    • Improved File Explorer: File Explorer automatically disables previews for files downloaded from the internet. The KB links to instructions for unblocking files...
    • Fix Windows Remote Management (WinRM): PowerShell remote commands no longer time out after running for 600 seconds.

    Read update Source: Microsoft

    Build
    14393.8519
    Security
    71 fixed · 1 critical · 3 exploited
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server

    KB5065427

    Critical Hyper-V flaw patched; MSI repair prompts reduced

    Fixes five critical security flaws, including a Hyper-V remote code execution vulnerability, and reduces unexpected UAC prompts during some MSI repairs.

    Check the newer update, KB5066836

    Key changes 35 CVEs · 2 changes

    • New File Server: IT teams can check whether devices and software are compatible with SMB Server security measures before deploying them.
    • Fix App compatibility (known issue): Non-admin users get fewer unexpected UAC prompts when certain apps run installation or repair actions.
    • Critical CVE-2025-54918: Windows NTLM Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14393.8422
    Security
    35 fixed · 5 critical
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server

    KB5063871

    GDI+ remote-code flaw patched; Changjie word selection restored

    The update fixes 37 security vulnerabilities, including three critical flaws in GDI+, MSMQ, and NTLM, and restores word selection in the Microsoft Changjie Input Method.

    Check the newer update, KB5065427
    Secure Boot certificates used by most Windows devices began expiring in June 2026. Microsoft recommends reviewing its guidance and preparing to update them in advance.

    Key changes 37 CVEs · 1 change

    • Fix Input and Composition: Users of the Microsoft Changjie Input Method can select words again.
    • Critical CVE-2025-53766: GDI+ Remote Code Execution Vulnerability
    • Critical CVE-2025-53778: Windows NTLM Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14393.8330
    Security
    37 fixed · 3 critical
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server

    KB5062560

    Critical SPNEGO and Hyper-V remote-code flaws addressed

    The update addresses 69 vulnerabilities, including five critical flaws. It also causes reported input problems with the Microsoft Changjie IME; KB5063871 resolves that issue.

    Check the newer update, KB5063871
    Secure Boot certificates used by most Windows devices started expiring in June 2026. Some personal and business devices might be unable to boot securely if their certificates are not updated in time; Microsoft recommends reviewing its guidance and preparing in advance.

    Key changes 69 CVEs · 1 change

    • Improved Internal Windows OS: The update includes general security improvements to Windows; no specific issues are listed.
    • Critical CVE-2025-47981: SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
    • Critical CVE-2025-48822: Windows Hyper-V Discrete Device Assignment (DDA) Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8246
    Security
    69 fixed · 5 critical
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    Zero-day

    KB5061010

    Exploited Internet Shortcut flaw patched; Remote Web Access fixed

    The update closes 32 vulnerabilities, including exploited remote-code-execution flaw CVE-2025-33053, and fixes Remote Web Access connection instability and a Windows Hello sign-in issue.

    Check the newer update, KB5062560
    The page says Windows 10 support ends October 14, 2025. Microsoft says it will no longer provide free software updates, technical assistance, or security fixes after that date.

    Key changes 32 CVEs · 2 changes

    • Fix Cloud Infrastructure: Remote Web Access no longer causes remote connections to act unpredictably.
    • Fix Windows Hello: Signing in with Windows Hello for Business works with self-signed certificates in the Key Trust model.
    • Exploited CVE-2025-33053: Internet Shortcut Files Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8148
    Security
    32 fixed · 1 critical · 1 exploited
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    Zero-day

    KB5058383

    Exploited scripting and Windows driver flaws addressed

    Addresses 33 vulnerabilities, including four that attackers are exploiting. It also improves Secure Boot detection of Linux systems.

    Check the newer update, KB5061010

    Key changes 33 CVEs · 1 change

    • Improved Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI): Secure Boot detection of Linux systems is improved.
    • Exploited CVE-2025-32701: Windows Common Log File System Driver Elevation of Privilege Vulnerability
    • Exploited CVE-2025-32706: Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14393.8066
    Security
    33 fixed · 3 critical · 4 exploited
    Restart
    Required
  • Windows 10 1607 Windows 10 1607 Out-of-band update Also for Windows Server
    Out-of-band

    KB5058921

    Audit logon status can appear disabled even when auditing works

    The out-of-band update fixes a misleading display of local audit settings: logon auditing can appear disabled even when it is enabled and working.

    Check the newer update, KB5058383

    Key changes 1 change

    • Fix Group Policy: The local audit policy no longer appears to have logon auditing turned off when it is enabled and working.

    Read update Source: Microsoft

    Build
    14393.7973
    Restart
    Required

.NET Framework updates

All .NET Framework updates →

.NET Framework is updated separately from Windows 10: each of these updates has its own KB and reaches Windows 10 Enterprise LTSB 2016 through Windows Update.