Skip to the content
The Update Bureau

Windows Server

Windows Server updates

All published releases for Windows Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 13, 2026.

24 active known issues →

Latest build per version

Windows Server updates

  • Windows Server 2025 Windows Server 2025 Out-of-band update
    Out-of-band

    KB5136489

    Fix addresses certain Windows licensing failures with error 0x80041008

    Some organizations can now complete certain Windows licensing and activation operations that previously failed. The fix mainly helps systems that use commands or automated processes to manage KMS activation and product keys.

    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Fix Licensing and Activation: The update fixes certain Windows licensing and activation operations that could fail with error 0x80041008.

    Read update Source: Microsoft

    Build
    26100.33828
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Out-of-band update
    Out-of-band Updated

    KB5136487

    SLMGR activation failures fixed for KMS and license tasks

    Some Windows licensing and activation commands that failed with error 0x80041008 now work again. The fix mainly matters to organizations managing KMS activation, product keys, or Windows licenses.

    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements to help devices install updates reliably.
    • Fix Licensing and Activation: Some Windows licensing and activation commands no longer fail with error 0x80041008.

    Read update Source: Microsoft

    Build
    20348.5873
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10
    Out-of-band

    KB5136490

    SLMGR licensing failures with error 0x80041008 fixed

    Certain Windows licensing and activation operations using SLMGR might fail with error 0x80041008; this out-of-band update fixes the problem. It mainly affected organizations using SLMGR commands or automation.

    Key changes 2 changes

    • Improved Servicing stack: The servicing stack checks whether a device runs on Azure using an updated certificate chain.
    • Fix Licensing and Activation: Some licensing and activation tasks that use SLMGR can fail with error 0x80041008. This issue is fixed.

    Read update Source: Microsoft

    Build
    17763.9488
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update
    Updated

    KB5131080

    NTLM signing defaults strengthened; Exchange mail issues remain

    NTLM clients now offer message signing by default for non-anonymous connections, helping limit relay attacks. Some on-premises Exchange servers might still have email access or delivery problems.

    Check the newer update, KB5136489
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 628 CVEs · 11 changes

    • Improved Date and Time: Cuba’s clock stays on UTC-04:00 through the November 2026 and March 2027 time changes. It returns to UTC-05:00 in November 2027.
    • Improved Security: NTLM signing helps reduce the risk of relay attacks and helps identify connections that do not use signing.
    • Improved Start menu: The policy that hides the Recommended section now works in Windows 11 Enterprise multi-session environments.

    Read update Source: Microsoft

    Build
    26100.33822
    Security
    628 fixed · 33 critical
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Updated

    KB5131090

    Critical Windows Search remote-code flaw patched

    A critical Windows Search flaw and other serious security bugs get fixes, alongside Exchange, printer, and Remote Desktop repairs. Some Exchange and WSUS problems remain open.

    Check the newer update, KB5136487
    Mainstream support for Windows Server 2022 has ended. Monthly security updates continue during extended support through October 14, 2031.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 593 CVEs · 9 changes

    • Improved Date and Time: Cuba's daylight saving time schedule is adjusted for the extended 2026–2027 period.
    • Improved Security: NTLM connections get stronger protection against relay attacks, with auditing to help identify connections that lack signing.
    • Improved Windows PowerShell: PowerShell scripts with invalid UTF-8 encoding might fail signature checks, even if they passed before.

    Read update Source: Microsoft

    Build
    20348.5870
    Security
    593 fixed · 30 critical
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Updated

    KB5131085

    LDAP and Search flaws patched; Exchange mail restored

    Critical flaws in LDAP and Windows Search are patched, and on-premises Exchange sign-in and email delivery issues are resolved. NTLM clients now offer message signing by default for non-anonymous connections.

    Check the newer update, KB5136490

    Key changes 561 CVEs · 9 changes

    • Improved Date and Time: Cuba's time zone stays at UTC-04:00 through the November 2026 and March 2027 time changes.
    • Improved Windows PowerShell: PowerShell checks script signatures more strictly. Scripts with invalid UTF-8 encoding might fail validation, even if they passed befor...
    • Improved Security: For non-anonymous connections, NTLM clients offer message signing by default. This helps reduce exposure to relay attacks.

    Read update Source: Microsoft

    Build
    17763.9487
    Security
    561 fixed · 28 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Updated

    KB5131291

    Exchange mail issues resolved; NTLM signing strengthened

    Exchange servers can sign in to OWA and send mail again after the October update. Clients also offer NTLM signing by default for non-anonymous connections.

    Windows Server 2016 updates end on January 12, 2027.

    Key changes 502 CVEs · 9 changes

    • Improved Date and Time: Cuba stays on UTC-04:00 through the extended 2026–2027 daylight saving time period.
    • Improved Windows PowerShell: PowerShell scripts with invalid UTF-8 encoding might fail signature checks, even if they passed before.
    • Improved Security: Clients offer NTLM signing by default for non-anonymous connections, helping reduce exposure to relay attacks.

    Read update Source: Microsoft

    Build
    14393.9688
    Security
    502 fixed · 25 critical
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Out-of-band update
    Out-of-band Updated

    KB5134137

    Offline servers get updated trusted root certificates

    Devices that cannot reach Microsoft's certificate-update service get an updated trusted root certificate payload. Hotpatch-enrolled devices that install this update will not receive hotpatch updates until after they install the January 2027 baseline.

    Check the newer update, KB5131080
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 2 changes

    • Improved Certificates: Devices that cannot get certificate list updates receive an updated set of trusted root certificates.
    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.

    Read update Source: Microsoft

    Build
    26100.33674
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Out-of-band update
    Out-of-band Updated

    KB5134140

    Root certificates updated for isolated servers; Exchange mail can fail

    An updated trusted root certificate list helps servers that cannot reach Microsoft's certificate service. Some on-premises Exchange servers might also have trouble with sign-in and mail delivery.

    Check the newer update, KB5131090
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 2 changes

    • Improved Certificates: Servers that cannot get certificate updates from Microsoft receive an updated list of trusted root certificates.
    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.

    Read update Source: Microsoft

    Build
    20348.5773
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10
    Out-of-band Updated

    KB5134124

    Updated root certificate payload for disconnected devices

    Devices that cannot get certificate updates from Microsoft receive an updated trusted root certificate payload. Some Exchange servers might still have sign-in and email problems.

    Check the newer update, KB5131085

    Key changes 1 change

    • Improved Certificates: Devices that cannot reach Microsoft's certificate service, or have automatic certificate updates turned off, get an updated trusted roo...

    Read update Source: Microsoft

    Build
    17763.9378
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Out-of-band update Also for Windows 10
    Out-of-band Updated

    KB5134123

    Certificate trust updates for isolated devices; Exchange issues remain

    Devices that cannot get certificate trust updates receive a refreshed trusted root certificate list. Some on-premises Exchange servers might still have OWA sign-in or email delivery problems.

    Check the newer update, KB5131291
    Windows Server 2016 support ends January 12, 2027. The page points to guidance about continuing to receive updates.

    Key changes 1 change

    • Improved Certificates: Devices that cannot get certificate trust updates receive a refreshed set of trusted root certificates.

    Read update Source: Microsoft

    Build
    14393.9615
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update
    Zero-day Updated

    KB5126646

    Exploited Windows Shell flaw patched; server recovery feature added

    An actively exploited Windows Shell security-feature bypass is patched. Windows Server 2025 also gains Quick machine recovery, which is off by default.

    Check the newer update, KB5134137
    Known issues: 2 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details
    • SQL Server linked server connections might remain open

    Key changes 1,098 CVEs · 15 changes

    • New Quick machine recovery: Quick machine recovery is now supported on Windows Server 2025, but it is off by default.
    • New Security: Encrypted TLS 1.3 connections can use ML-KEM key exchange to help protect against future quantum-computing threats.
    • New Date and Time: A new Manitoba Standard Time zone is available.

    Read update Source: Microsoft

    Build
    26100.33650
    Security
    1,098 fixed · 35 critical · 1 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day Updated

    KB5126655

    Exploited Shell flaw patched; Exchange mail issues mitigated

    An exploited Windows Shell security bypass is addressed. Some Exchange servers may still have sign-in and email delivery problems, with a temporary mitigation available.

    Check the newer update, KB5134140
    This is the last mainstream support update for this version. Extended support provides monthly security updates through October 14, 2031.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 1,034 CVEs · 8 changes

    • New Authentication: Administrators can get more details about NTLM use, including who uses it and where.
    • New Date and Time: A new Manitoba time zone is available.
    • Improved Date and Time: British Columbia and Alberta switch to permanent daylight saving time starting in November 2026.

    Read update Source: Microsoft

    Build
    20348.5761
    Security
    1,034 fixed · 33 critical · 1 exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day Updated

    KB5126651

    Actively exploited Windows Shell flaw patched; Exchange issue mitigated

    An actively exploited Windows Shell security bypass is patched. Exchange users might still have sign-in and email problems, but a registry mitigation is available.

    Check the newer update, KB5134124

    Key changes 970 CVEs · 9 changes

    • New Date and Time: Manitoba Standard Time is added as a time zone.
    • New Authentication: Administrators can see who uses NTLM, why it was chosen, and where it is used.
    • New ReFS security: Auditing and optional security controls are added for ReFS volumes on external storage.

    Read update Source: Microsoft

    Build
    17763.9376
    Security
    970 fixed · 30 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day Updated

    KB5126868

    Windows Shell flaw exploited; Exchange email issues remain

    An actively exploited Windows Shell security-bypass flaw is addressed, while some on-premises Exchange servers still face email failures despite a temporary mitigation.

    Check the newer update, KB5134123
    Support for Windows Server 2016 ends January 12, 2027.

    Key changes 767 CVEs · 6 changes

    • New Date and Time: Manitoba Standard Time is added as a new time zone.
    • Improved Date and Time: Time-zone data enables support for permanent daylight saving time in British Columbia and Alberta starting in November 2026.
    • Improved ReFS security: ReFS volumes on externally attached storage gain auditing and optional security controls. Auditing is on by default.

    Read update Source: Microsoft

    Build
    14393.9612
    Security
    767 fixed · 26 critical · 1 exploited
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Out-of-band update
    Out-of-band Updated

    KB5129235

    Remote Desktop failures fixed; USB audio partly restored

    Remote Desktop connections and sign-ins work again in affected environments. USB audio in 8-channel or 3D modes is also fixed, but other USB audio problems remain.

    Check the newer update, KB5126646
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 2 changes

    • Fix Remote Desktop Services (known issue): Remote Desktop connections and sign-ins work again in affected environments. Servers and related tools no longer stop responding during...
    • Fix 8-channel or 3D audio modes: Some USB audio devices work again with 8-channel or 3D audio. Other reported USB audio problems are not fixed by this update.

    Read update Source: Microsoft

    Build
    26100.33451
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Out-of-band update
    Out-of-band

    KB5129237

    Remote Desktop failures and multichannel USB audio fixed

    Remote Desktop connection and sign-in failures are fixed, along with 8-channel and 3D audio problems on some USB Audio Class 1.0 devices. The update is available only through the Microsoft Update Catalog.

    Check the newer update, KB5126655
    Secure Boot certificates used by most Windows devices have started expiring. Microsoft recommends reviewing its guidance and updating certificates in advance to avoid disruption.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 3 changes

    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Fix Remote Desktop Services: Remote Desktop connections and sign-ins work again in affected environments, where the service could become unstable and leave servers...
    • Fix 8-channel or 3D audio modes: Some USB Audio Class 1.0 devices can use 8-channel or 3D audio modes without the failures addressed by this update.

    Read update Source: Microsoft

    Build
    20348.5631
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10
    Out-of-band Updated

    KB5129238

    Remote Desktop instability addressed; 8-channel USB audio restored

    Addresses Remote Desktop instability and restores 8-channel or 3D audio on affected USB Audio Class 1.0 devices. Other USB audio symptoms might remain.

    Check the newer update, KB5126651

    Key changes 3 changes

    • Improved Servicing stack: The update improves certificate checks when verifying whether a device is hosted on Azure.
    • Fix Remote Desktop Services (known issue): Remote Desktop connections and sign-ins work more reliably in affected environments; servers and related tools are less likely to becom...
    • Fix 8-channel or 3D audio modes: Some USB Audio Class 1.0 devices work again when using 8-channel or 3D audio modes.

    Read update Source: Microsoft

    Build
    17763.9247
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Out-of-band update Also for Windows 10
    Out-of-band Updated

    KB5129239

    Remote Desktop failures and multichannel USB audio fixed

    Fixes Remote Desktop failures and USB audio problems in 8-channel and 3D modes. Other USB Audio Class 1.0 symptoms remain unresolved.

    Check the newer update, KB5126868
    Free support for Windows Server 2016 ends January 12, 2027. Microsoft directs organizations to its guidance about Extended Security Updates.

    Key changes 2 changes

    • Fix Remote Desktop Services (known issue): Remote Desktop connection and sign-in failures are fixed. Servers and related tools no longer become unresponsive during Remote Desktop...
    • Fix 8-channel or 3D audio modes: USB Audio Class 1.0 devices work again in 8-channel and 3D audio modes.

    Read update Source: Microsoft

    Build
    14393.9514
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update
    Zero-day Updated

    KB5122871

    Windows Update Stack flaw under active attack

    An actively exploited Windows Update Stack flaw is among the security fixes. The update also improves networking, Remote Desktop audio, and Sysmon.

    Check the newer update, KB5129235
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 690 CVEs · 9 changes

    • Improved Certificates: Applications are more likely to keep working as Windows moves to newer signing certificates.
    • Improved Date and Time: Morocco’s local time reflects its move to permanent UTC+00:00 on September 20, 2026.
    • Improved Networking: Network connections respond faster when a network adapter disconnects, helping network storage and file access keep working.

    Read update Source: Microsoft

    Build
    26100.33438
    Security
    690 fixed · 64 critical · 1 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day Updated

    KB5122882

    Exploited ALPC flaw patched; Hyper-V restart issue fixed

    Patches an actively exploited flaw in Windows ALPC and fixes a Hyper-V issue that could unexpectedly restart some virtual machines.

    Check the newer update, KB5129237
    Mainstream support ends October 13, 2026; monthly security updates continue through October 14, 2031.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 651 CVEs · 6 changes

    • Improved Certificates: Applications are more likely to keep working during certificate updates.
    • Improved Date and Time: Morocco's local time stays correct after its time change on September 20, 2026.
    • Improved Networking: Network connections respond faster when an adapter disconnects, helping storage and file access keep working.

    Read update Source: Microsoft

    Build
    20348.5622
    Security
    651 fixed · 61 critical · 1 exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day Updated

    KB5122876

    An exploited ALPC flaw is patched; Remote Desktop audio is addressed

    An exploited Windows ALPC flaw is patched, and Remote Desktop audio redirection is addressed for some configurations. USB Audio Class 1.0 devices can still have sound problems.

    Check the newer update, KB5129238
    Secure Boot certificates began expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid possible boot problems.

    Key changes 626 CVEs · 5 changes

    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates automatically over the coming months.
    • Improved Date and Time: Morocco's local time will stay correct after the country moves to UTC+00:00 on September 20, 2026.
    • Improved Windows Code Integrity policies: Some apps work more smoothly during Windows certificate changes.

    Read update Source: Microsoft

    Build
    17763.9245
    Security
    626 fixed · 59 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day Updated

    KB5123099

    Actively exploited ALPC flaw; Remote Desktop audio addressed

    An actively exploited ALPC flaw could let attackers gain higher privileges. The update also addresses remote-session audio problems, but some USB audio issues remain.

    Check the newer update, KB5129239
    Free updates and support for Windows Server 2016 end on January 12, 2027. Check Microsoft's information about Extended Security Updates.

    Key changes 563 CVEs · 5 changes

    • Improved Secure Boot: More eligible computers can receive new Secure Boot certificates automatically over the coming months.
    • Improved Date and Time: Devices using Morocco time display the correct local time after Morocco moves to UTC+00:00 on September 20, 2026.
    • Improved Windows Code Integrity policies: App compatibility improves while Windows changes its certificate authorities.

    Read update Source: Microsoft

    Build
    14393.9512
    Security
    563 fixed · 49 critical · 1 exploited
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update
    Zero-day Updated

    KB5120233

    Winsock driver flaw under attack; DFS file previews improved

    An actively exploited Winsock driver flaw gets a security fix. File Explorer also handles files on DFS drives better after network reconnects.

    Check the newer update, KB5122871
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 216 CVEs · 5 changes

    • New Emoji Panel: The emoji panel now supports GIPHY.
    • Improved File Explorer: Previews and copied files on DFS mapped drives work as expected after the server reconnects to the network.
    • Improved Windows: Certificate Authority setup again offers post-quantum certificate options, and enrollment with new certificate templates can succeed.

    Read update Source: Microsoft

    Build
    26100.33296
    Security
    216 fixed · 19 critical · 1 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day Updated

    KB5120242

    WinSock driver flaw under active attack

    An actively exploited elevation-of-privilege flaw affects the Ancillary Function Driver for WinSock. The update also improves Secure Boot certificate targeting.

    Check the newer update, KB5122882
    Mainstream support ends October 13, 2026. The October 2026 security update is the last mainstream support update for this version.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 195 CVEs · 2 changes

    • Improved Secure Boot: More devices are eligible to receive new Secure Boot certificates automatically.
    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Exploited CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    20348.5499
    Security
    195 fixed · 19 critical · 1 exploited
    Restart
    Required