Skip to the content
The Update Bureau

Windows Server 2016

Windows Server 2016

Every published release for Windows Server 2016, newest first: what each update changes, whether to install it and any confirmed known issues.

Latest
KB5131291 Nov 10, 2026
Build
14393.9688
Released
Oct 15, 2016
All editions
updates until Jan 12, 2027
Known issues
2 open

Latest update

  • KB5131291 Released Nov 10, 2026
    Build 14393.9688

Build history

  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Updated

    KB5131291

    Exchange mail issues resolved; NTLM signing strengthened

    Exchange servers can sign in to OWA and send mail again after the October update. Clients also offer NTLM signing by default for non-anonymous connections.

    Windows Server 2016 updates end on January 12, 2027.

    Key changes 502 CVEs · 9 changes

    • Improved Date and Time: Cuba stays on UTC-04:00 through the extended 2026–2027 daylight saving time period.
    • Improved Windows PowerShell: PowerShell scripts with invalid UTF-8 encoding might fail signature checks, even if they passed before.
    • Improved Security: Clients offer NTLM signing by default for non-anonymous connections, helping reduce exposure to relay attacks.

    Read update Source: Microsoft

    Build
    14393.9688
    Security
    502 fixed · 25 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Out-of-band update Also for Windows 10
    Out-of-band Updated

    KB5134123

    Certificate trust updates for isolated devices; Exchange issues remain

    Devices that cannot get certificate trust updates receive a refreshed trusted root certificate list. Some on-premises Exchange servers might still have OWA sign-in or email delivery problems.

    Check the newer update, KB5131291
    Windows Server 2016 support ends January 12, 2027. The page points to guidance about continuing to receive updates.

    Key changes 1 change

    • Improved Certificates: Devices that cannot get certificate trust updates receive a refreshed set of trusted root certificates.

    Read update Source: Microsoft

    Build
    14393.9615
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day Updated

    KB5126868

    Windows Shell flaw exploited; Exchange email issues remain

    An actively exploited Windows Shell security-bypass flaw is addressed, while some on-premises Exchange servers still face email failures despite a temporary mitigation.

    Check the newer update, KB5134123
    Support for Windows Server 2016 ends January 12, 2027.

    Key changes 767 CVEs · 6 changes

    • New Date and Time: Manitoba Standard Time is added as a new time zone.
    • Improved Date and Time: Time-zone data enables support for permanent daylight saving time in British Columbia and Alberta starting in November 2026.
    • Improved ReFS security: ReFS volumes on externally attached storage gain auditing and optional security controls. Auditing is on by default.

    Read update Source: Microsoft

    Build
    14393.9612
    Security
    767 fixed · 26 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Out-of-band update Also for Windows 10
    Out-of-band Updated

    KB5129239

    Remote Desktop failures and multichannel USB audio fixed

    Fixes Remote Desktop failures and USB audio problems in 8-channel and 3D modes. Other USB Audio Class 1.0 symptoms remain unresolved.

    Check the newer update, KB5126868
    Free support for Windows Server 2016 ends January 12, 2027. Microsoft directs organizations to its guidance about Extended Security Updates.

    Key changes 2 changes

    • Fix Remote Desktop Services (known issue): Remote Desktop connection and sign-in failures are fixed. Servers and related tools no longer become unresponsive during Remote Desktop...
    • Fix 8-channel or 3D audio modes: USB Audio Class 1.0 devices work again in 8-channel and 3D audio modes.

    Read update Source: Microsoft

    Build
    14393.9514
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day Updated

    KB5123099

    Actively exploited ALPC flaw; Remote Desktop audio addressed

    An actively exploited ALPC flaw could let attackers gain higher privileges. The update also addresses remote-session audio problems, but some USB audio issues remain.

    Check the newer update, KB5129239
    Free updates and support for Windows Server 2016 end on January 12, 2027. Check Microsoft's information about Extended Security Updates.

    Key changes 563 CVEs · 5 changes

    • Improved Secure Boot: More eligible computers can receive new Secure Boot certificates automatically over the coming months.
    • Improved Date and Time: Devices using Morocco time display the correct local time after Morocco moves to UTC+00:00 on September 20, 2026.
    • Improved Windows Code Integrity policies: App compatibility improves while Windows changes its certificate authorities.

    Read update Source: Microsoft

    Build
    14393.9512
    Security
    563 fixed · 49 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day Updated

    KB5120418

    Exploited WinSock flaw; File History backup failures fixed

    An actively exploited WinSock driver flaw gets a security fix, and scheduled File History backups to SMB shares work again after failing with invalid credentials.

    Check the newer update, KB5123099
    Windows Server 2016 reaches end of support on January 12, 2027.

    Key changes 165 CVEs · 2 changes

    • Improved Secure Boot: More devices can qualify to receive new Secure Boot certificates automatically.
    • Fix Backup: Scheduled File History backups to shared folders work again instead of failing with an “invalid credentials” error.
    • Exploited CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14393.9418
    Security
    165 fixed · 16 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day Updated

    KB5099535

    Exploited AD FS flaw prompts new key-container checks

    An actively exploited AD FS privilege flaw gets new key-container checks, alongside fixes for OLE Automation, File Explorer, and Recycle Bin problems.

    Check the newer update, KB5120418
    Free updates and security fixes for Windows Server 2016 end on January 12, 2027.

    Key changes 250 CVEs · 7 changes

    • New Distributed Key Manager (DKM): AD FS can detect insecure key-container permissions and gives administrators an optional way to strengthen them.
    • New Remote Desktop (RDP) Security: Trusted Remote Desktop publishers can use SHA-2 certificate thumbprints. SHA-1 remains for older setups, but Microsoft plans to remove...
    • Improved Secure Boot: More eligible devices can receive newer Secure Boot certificates automatically through Windows updates.

    Read update Source: Microsoft

    Build
    14393.9339
    Security
    250 fixed · 25 critical · 2 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5094122

    Secure Boot controls added; DFS fixed for 15-character hostnames

    A new Secure Boot policy limits data sent to Microsoft, and more eligible devices can receive updated certificates. The update also fixes DFS Namespaces on servers with exactly 15-character hostnames.

    Check the newer update, KB5099535
    Windows Server 2016 support ends January 12, 2027.

    Key changes 76 CVEs · 4 changes

    • New Secure Boot: Administrators can use a new policy to limit the Secure Boot data Windows sends to Microsoft.
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates automatically after showing enough successful update signals.
    • Improved Folder customization: Some downloaded or remote folders might lose custom icons or localized names. Folder access is not affected.

    Read update Source: Microsoft

    Build
    14393.9234
    Security
    76 fixed · 14 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5087537

    Four critical remote-code flaws; Secure Boot coverage expands

    Addresses 47 vulnerabilities, including four critical remote-code execution flaws, and expands the devices eligible for Secure Boot certificate updates. It also fixes Remote Desktop warnings and Microsoft-account sign-in problems.

    Check the newer update, KB5094122
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and prepare to update them.

    Key changes 47 CVEs · 5 changes

    • New Secure Boot: Eligible devices get a SecureBoot folder containing example scripts for organizations that manage updates across their devices.
    • Improved Daylight Savings Time (DST): Daylight saving time support is updated for the Arab Republic of Egypt.
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates automatically, with the certificates deployed in a controlled, phased ro...

    Read update Source: Microsoft

    Build
    14393.9140
    Security
    47 fixed · 4 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Out-of-band update Also for Windows 10
    Out-of-band

    KB5091572

    PAM domain controllers recover from startup failures

    Fixes startup problems on Windows Server 2016 domain controllers with multi-domain forests using PAM after the April 14 update. It is available only from the Update Catalog.

    Check the newer update, KB5087537
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Microsoft recommends reviewing its guidance and updating certificates in advance.

    Key changes 1 change

    • Fix Domain controllers (known issue): Fixes startup problems that could affect domain controllers in multi-domain forests using PAM after installing the April 14, 2026 secur...

    Read update Source: Microsoft

    Build
    14393.9062
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5082198

    Remote Desktop files get safer defaults; Secure Boot coverage expands

    Remote Desktop shows requested connection settings before opening an .rdp file, and Secure Boot certificate targeting expands. The update also changes WDS, Kerberos, and WinCS behavior.

    Check the newer update, KB5091572
    Windows Server 2016 support ends January 12, 2027.

    Key changes 88 CVEs · 5 changes

    • Improved Remote Desktop: Before an .rdp file connects, Remote Desktop shows its requested connection settings, with each setting off by default. A one-time secu...
    • Improved Kerberos protocol: Kerberos uses AES-SHA1 by default for accounts without an explicit encryption-types setting.
    • Improved Secure Boot: More eligible devices can be targeted to receive new Secure Boot certificates automatically, but certificates are delivered only after...

    Read update Source: Microsoft

    Build
    14393.9060
    Security
    88 fixed · 3 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5078938

    Secure Boot certificate targeting expands ahead of expirations

    The update expands targeting for automatic Secure Boot certificate delivery and adds a trusted-source warning in Windows System Image Manager. Secure Boot certificates have started expiring in June 2026, which might affect some devices’ ability to boot securely.

    Check the newer update, KB5082198
    Secure Boot certificates have started expiring in June 2026. Some devices might be affected if their certificates are not updated in time; Microsoft recommends reviewing its guidance and acting in advance.

    Key changes 34 CVEs · 2 changes

    • New Windows System Image Manager: A warning dialog helps users confirm that a selected catalog file comes from a trusted source.
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates automatically, but servers are unlikely to qualify.
    • CVSS 8.8 CVE-2026-23669: RPC Runtime Library Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8957
    Security
    34 vulnerabilities fixed
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5075999

    Exploited Shell and MSHTML bypasses patched; GPU stability fixed

    The update patches five exploited vulnerabilities, including Windows Shell and MSHTML security feature bypasses, and fixes a graphics stability issue affecting certain GPU configurations.

    Check the newer update, KB5078938
    Windows Server 2016 reaches end of support on January 12, 2027. Microsoft says free updates, technical assistance, and security fixes from Windows Update will end then; see its ESU guidance for availability.

    Key changes 21 CVEs · 1 change

    • Fix Graphics: A stability issue affecting certain graphics processor configurations is fixed.
    • Exploited CVE-2026-21510: Windows Shell Security Feature Bypass Vulnerability
    • Exploited CVE-2026-21513: MSHTML Framework Security Feature Bypass Vulnerability

    Read update Source: Microsoft

    Build
    14393.8868
    Security
    21 vulnerabilities fixed · 5 actively exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5073722

    Exploited Desktop Window Manager flaw patched; modem drivers removed

    Fixes an actively exploited Desktop Window Manager flaw, removes four modem drivers, and changes credential autofill and WDS behavior. Review the Secure Boot certificate guidance to avoid possible boot disruption.

    Check the newer update, KB5075999
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Certain personal and business devices might not boot securely if the certificates are not updated in time; review Microsoft's guidance and prepare in advance.

    Key changes 53 CVEs · 4 changes

    • New Credentials autofill: In certain remote support or automated authentication workflows, credential dialogs no longer accept virtual keyboard input from remote...
    • Improved Windows Deployment Services (WDS): Hands-free deployment is no longer supported by default in Windows Deployment Services.
    • Fix WinSqlite3.dll: The Windows WinSqlite3.dll component is updated to address cases where security software detected it as vulnerable.

    Read update Source: Microsoft

    Build
    14393.8783
    Security
    53 fixed · 1 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Out-of-band update Also for Windows 10
    Out-of-band

    KB5074974

    Message Queuing failures after the December update resolved

    Fixes Message Queuing problems that appeared after the December 9, 2025 updates, including in clustered environments under load.

    Check the newer update, KB5073722
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Microsoft recommends reviewing its guidance and updating certificates in advance.

    Key changes 1 change

    • Fix Message queuing (MSMQ) (known issue): Message Queuing works again after the December 9, 2025 updates caused queues to become inactive or prevented applications from writing...

    Read update Source: Microsoft

    Build
    14393.8692
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5071543

    PowerShell warns before web content can run scripts

    PowerShell 5.1 now warns before `Invoke-WebRequest` content can run scripts, addressing a publicly disclosed remote code execution risk. The update also addresses 15 Important vulnerabilities; an MSMQ issue was later resolved by KB5074974.

    Check the newer update, KB5074974
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review the guidance and prepare to update certificates to avoid possible boot disruptions.

    Key changes 15 CVEs · 1 change

    • Improved PowerShell 5.1: PowerShell 5.1 now warns about script execution risk before a web request, letting you continue or cancel.
    • CVSS 8.8 CVE-2025-62549: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2025-54100: PowerShell Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8688
    Security
    15 vulnerabilities fixed
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5068864

    Critical GDI+ flaw patched; unexpected UAC prompts addressed

    Fixes 24 security vulnerabilities, including critical GDI+ remote code execution flaw CVE-2025-60724, and addresses unexpected UAC prompts for some apps, including Autodesk AutoCAD.

    Check the newer update, KB5071543
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Certain devices might lose the ability to boot securely if their certificates are not updated; review Microsoft's guidance and prepare in advance.

    Key changes 24 CVEs · 2 changes

    • Improved Internal Windows OS: Internal Windows OS functionality receives miscellaneous security improvements; no specific issues are documented.
    • Fix App compatibility (known issue): Unexpected User Account Control prompts for some apps, including Autodesk AutoCAD, are addressed.
    • Critical CVE-2025-60724: Windows GDI+ Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8594
    Security
    24 fixed · 1 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Out-of-band security update Also for Windows 10
    Out-of-band

    KB5070882

    WSUS remote-code-execution flaw patched; sync error details hidden

    Addresses a critical remote code execution vulnerability in WSUS reporting web services. WSUS synchronization error details are temporarily unavailable after installation.

    Check the newer update, KB5068864
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid possible boot disruption.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 1 CVE · 1 change

    • Fix Windows Server Update Services (WSUS): The remote code execution vulnerability in WSUS reporting web services is addressed.
    • Critical CVE-2025-59287: Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8524
    Security
    1 fixed · 1 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5066836

    Exploited modem and Remote Access flaws addressed

    Addresses exploited Windows modem and Remote Access flaws, fixes WinRM timeouts, and removes support for a fax modem driver. File Explorer also disables previews for files downloaded from the internet.

    Check the newer update, KB5070882

    Key changes 77 CVEs · 5 changes

    • Improved Cryptography: RSA-based smart card certificates now require Key Storage Provider instead of Cryptographic Service Provider. Smart card authentication...
    • Improved File Explorer: File Explorer automatically disables previews for files downloaded from the internet.
    • Fix Windows Remote Management (WinRM): PowerShell Remoting and WinRM commands no longer time out after 600 seconds.

    Read update Source: Microsoft

    Build
    14393.8519
    Security
    77 fixed · 1 critical · 3 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5065427

    SMB compatibility auditing added; MSI repair prompts reduced

    Adds a way to audit SMB client compatibility before hardening and reduces unexpected UAC prompts during some MSI actions. The update also addresses 45 vulnerabilities, including five rated critical.

    Check the newer update, KB5066836

    Key changes 45 CVEs · 2 changes

    • New File Server: IT teams can check SMB client compatibility before deploying SMB Server hardening measures.
    • Fix App compatibility (known issue): Non-admin users are less likely to see unexpected UAC prompts during certain MSI installer actions, including repairs.
    • Critical CVE-2025-54918: Windows NTLM Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14393.8422
    Security
    45 fixed · 5 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5063871

    GDI+ flaw patched; Changjie word selection restored

    The update fixes 48 vulnerabilities, including three critical flaws in GDI+, Microsoft Message Queuing, and Windows NTLM. It also restores word selection in the Microsoft Changjie Input Method.

    Check the newer update, KB5065427

    Key changes 48 CVEs · 1 change

    • Fix Input and Composition: Users can select words again with the Microsoft Changjie Input Method.
    • Critical CVE-2025-53766: GDI+ Remote Code Execution Vulnerability
    • Critical CVE-2025-53778: Windows NTLM Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14393.8330
    Security
    48 fixed · 3 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5062560

    NEGOEX remote-code flaw patched; DHCP server stalls fixed

    Fixes DHCP Server stalls that interrupt client IP renewal and hardens Netlogon RPC access. It also addresses 88 vulnerabilities, including five critical ones and the publicly disclosed CVE-2024-21302.

    Check the newer update, KB5063871
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Microsoft recommends reviewing its guidance and updating certificates in advance; certain personal and business devices might otherwise be unable to boot securely.

    Key changes 88 CVEs · 2 changes

    • Improved Microsoft RPC Netlogon protocol: Anonymous clients can no longer make some RPC requests through Active Directory domain controllers. Some file and print service softwar...
    • Fix DHCP Server: The DHCP Server service no longer intermittently stops responding and disrupting clients’ IP renewal.
    • Critical CVE-2025-47981: SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8246
    Security
    88 fixed · 5 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5061010

    Exploited Internet Shortcut flaw fixed; DHCP service could stall

    Fixes 37 vulnerabilities, including an actively exploited flaw in Internet Shortcut files. It also introduced a DHCP Server issue that KB5062560 later resolved.

    Check the newer update, KB5062560

    Key changes 37 CVEs · 2 changes

    • Fix Cloud Infrastructure: Remote Web Access connections no longer behave unpredictably.
    • Fix Windows Hello: The update addresses an issue that prevents some users from signing in with self-signed certificates using Windows Hello for Business.
    • Exploited CVE-2025-33053: Internet Shortcut Files Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8148
    Security
    37 fixed · 3 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5058383

    Exploited scripting and driver flaws patched

    Fixes 39 vulnerabilities, including five critical ones, and improves Secure Boot detection of Linux systems. Four vulnerabilities were already being exploited.

    Check the newer update, KB5061010

    Key changes 39 CVEs · 1 change

    • Improved Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI): Secure Boot improves detection of Linux systems.
    • Exploited CVE-2025-32701: Windows Common Log File System Driver Elevation of Privilege Vulnerability
    • Exploited CVE-2025-32706: Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14393.8066
    Security
    39 fixed · 5 critical · 4 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Out-of-band update Also for Windows 10
    Out-of-band

    KB5058921

    Audit policy status display issue addressed

    Addresses a display issue where enabled logon and logoff auditing can appear disabled in local policy settings on Windows Server 2016.

    Check the newer update, KB5058383

    Key changes 1 change

    • Fix Active Directory Group Policy: Enabled logon and logoff auditing can appear disabled in local policy settings; this update addresses the display issue.

    Read update Source: Microsoft

    Build
    14393.7973
    Restart
    Required

.NET Framework updates

All .NET Framework updates →

.NET Framework is updated separately from Windows Server: each of these updates has its own KB and reaches Windows Server 2016 through Windows Update.