Skip to the content
The Update Bureau

Windows Server 2016

Windows Server 2016

Every published release for Windows Server 2016, newest first: what each update changes, whether to install it and any confirmed known issues.

Latest
KB5131291 Nov 10, 2026
Build
14393.9688
Released
Oct 15, 2016
All editions
updates until Jan 12, 2027
Known issues
2 open

Build history

  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5055521

    An exploited Common Log File System flaw is patched

    Addresses 62 vulnerabilities, including an actively exploited elevation-of-privilege flaw in the Common Log File System Driver. It also adds security and time-zone changes; a Group Policy audit-reporting issue is resolved by KB5058921.

    Check the newer update, KB5058921

    Key changes 62 CVEs · 3 changes

    • New OS Security: A new %systemdrive%\inetpub folder is created as part of security protections. Do not delete it; no action is needed.
    • Improved Daylight Saving Time (DST): Time-zone support is updated for Chile’s Aysen region to follow the government’s 2025 daylight saving time change.
    • Improved Kerberos Authentication: Kerberos adds protections for a certificate authority that is in the Windows root store but not the NTAuth store. This might cause Even...

    Read update Source: Microsoft

    Build
    14393.7969
    Security
    62 fixed · 7 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5053594

    Exploited kernel, NTFS and FAT flaws addressed

    Addresses actively exploited flaws in Windows, including kernel, NTFS and FAT vulnerabilities, and adds safer temporary-file storage for system processes.

    Check the newer update, KB5055521

    Key changes 34 CVEs · 3 changes

    • Improved Temporary files: System processes can store temporary files in a protected folder, reducing the risk of unauthorized access.
    • Improved Daylight saving time (DST): Daylight-saving-time changes for Paraguay are included.
    • Fix Use-after-free (UAF) risk: Process creation no longer has the reported risk of using freed memory.

    Read update Source: Microsoft

    Build
    14393.7876
    Security
    34 fixed · 5 critical · 6 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5052006

    USB camera status and audio playback issues fixed

    The update fixes a USB camera status problem and USB audio failures, including a playback issue more likely with some DAC drivers. It also closes 33 vulnerabilities, including one critical flaw and two being exploited.

    Check the newer update, KB5053594

    Key changes 33 CVEs · 3 changes

    • Fix USB cameras: Devices recognize when the camera is on again after the January 2025 security update.
    • Fix USB audio device drivers: Certain external audio management devices no longer show a code 10 “This device cannot start” error when connected.
    • Fix Digital/Analog converter (DAC): USB audio devices that might stop working and interrupt playback are addressed. This is more likely with a DAC audio driver based on US...

    Read update Source: Microsoft

    Build
    14393.7785
    Security
    33 fixed · 1 critical · 2 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5049993

    Windows OLE remote-code-execution flaw among critical fixes

    Addresses 111 vulnerabilities, including 8 critical flaws. It also adds at-risk drivers to the vulnerable driver blocklist; USB audio problems are resolved by KB5052006.

    Check the newer update, KB5052006

    Key changes 111 CVEs · 1 change

    • Improved Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b): The vulnerable driver blocklist covers more drivers that attackers could abuse by bringing their own vulnerable driver.
    • Critical CVE-2025-21298: Windows OLE Remote Code Execution Vulnerability
    • Critical CVE-2025-21307: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.7699
    Security
    111 fixed · 8 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5048671

    Exploited CLFS driver flaw patched; critical LDAP risks addressed

    The update patches 32 vulnerabilities, including 11 critical ones. It addresses an exploited Common Log File System Driver flaw and a publicly disclosed Winlogon flaw.

    Check the newer update, KB5049993

    Key changes 32 CVEs · 1 change

    • Improved Windows operating system: The update includes miscellaneous security improvements to internal operating system functionality. No additional issues are documented...
    • Exploited CVE-2024-49138: Windows Common Log File System Driver Elevation of Privilege Vulnerability
    • Critical CVE-2024-49112: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.7606
    Security
    32 fixed · 11 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5046612

    Exploited NTLM and Task Scheduler flaws patched; vmswitch crash fixed

    The update fixes 27 vulnerabilities, including exploited CVE-2024-43451 and CVE-2024-49039, and fixes a vmswitch stop error in a specific LBFO and SR-IOV setup.

    Check the newer update, KB5048671

    Key changes 27 CVEs · 1 change

    • Fix vmswitch: A vmswitch stop error is fixed when a virtual machine uses LBFO teaming with two virtual switches, one using SR-IOV.
    • Exploited CVE-2024-49039: Windows Task Scheduler Elevation of Privilege Vulnerability
    • Exploited CVE-2024-43451: NTLM Hash Disclosure Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    14393.7515
    Security
    27 fixed · 1 critical · 2 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5044293

    Exploited MMC flaw addressed; Remote Desktop drops fixed

    The update addresses 56 security vulnerabilities, including actively exploited MMC remote-code-execution and MSHTML spoofing flaws, and fixes Remote Desktop disconnections with legacy gateway protocols. It is no longer available as of March 31, 2026.

    As of March 31, 2026, this update is no longer available through Microsoft Update Catalog or other release channels. Microsoft recommends updating devices to the latest version of Windows.

    Key changes 56 CVEs · 1 change

    • Fix Remote Desktop (known issue): Remote Desktop connections on Windows Servers might no longer drop sporadically when a legacy protocol is used in the Remote Desktop Ga...
    • Exploited CVE-2024-43572: Microsoft Management Console Remote Code Execution Vulnerability
    • Exploited CVE-2024-43573: Windows MSHTML Platform Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    14393.7428
    Security
    56 vulnerabilities fixed · 2 actively exploited
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5043051

    Exploited MSHTML spoofing flaw patched; Installer repairs change

    Addresses 40 vulnerabilities, including an exploited MSHTML spoofing flaw. It also changes Windows Installer repairs so User Account Control prompts for credentials.

    As of March 31, 2026, this update is no longer available from the Microsoft Update Catalog or other release channels. Microsoft recommends updating devices to the latest version of Windows.

    Key changes 40 CVEs · 2 changes

    • Improved Windows Installer: When Windows Installer repairs an application, User Account Control now prompts for credentials. Automation scripts must be updated, an...
    • Improved Dual boot of Windows and Linux: Linux might fail to start when Windows and Linux are set up to dual-boot on a device.
    • Exploited CVE-2024-43461: Windows MSHTML Platform Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    14393.7336
    Security
    40 fixed · 1 critical · 3 exploited
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5041773

    Exploited kernel flaws patched; Linux dual-boot issue remains

    Patches 43 vulnerabilities, including flaws already exploited in attacks. Some Windows and Linux dual-boot devices might fail to boot Linux, and the update is no longer available.

    As of March 31, 2026, this update is no longer available from the Microsoft Update Catalog or other release channels. Microsoft recommends updating devices to the latest version of Windows.
    Known issues: 1 open
    • After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device.

    Key changes 43 CVEs · 6 changes

    • Improved Lock screen: The “Use my Windows user account” checkbox is no longer available on the lock screen when connecting to Wi-Fi.
    • Improved Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI): Windows blocks vulnerable Linux EFI boot managers from running. Older Linux ISO images might not boot after the update.
    • Improved Domain Name System (DNS): DNS server security is hardened to address CVE-2024-37968. Out-of-date domain configurations might cause a SERVFAIL error or timeout.

    Read update Source: Microsoft

    Build
    14393.7259
    Security
    43 fixed · 5 critical · 4 exploited
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5040434

    Exploited MSHTML spoofing flaw addressed; BitLocker profile changes

    Addresses an actively exploited MSHTML Platform spoofing flaw and changes the default BitLocker Secure Boot validation profile. It also updates the setup requirements for remote shortcut icons.

    As of March 31, 2026, this update is no longer available through the Microsoft Update Catalog or other release channels. Microsoft recommends updating devices to the latest Windows version.

    Key changes 81 CVEs · 4 changes

    • Improved Republic of Turkey name: The country's new official name is the Republic of Türkiye.
    • Improved Remote Authentication Dial-In User Service (RADIUS) protocol: The RADIUS protocol note says the issue is related to MD5 collisions and links to KB5040268 for more information.
    • Improved BitLocker: The default Secure Boot validation profile includes PCR 4, 7, and 11.

    Read update Source: Microsoft

    Build
    14393.7159
    Security
    81 fixed · 4 critical · 1 exploited
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5039214

    Exploited Mark of the Web flaw addressed; LSASS issues fixed

    Addresses an exploited Mark of the Web security flaw and two LSASS problems on Windows servers. It also changes how files from untrusted locations are tagged.

    As of March 31, 2026, this update is no longer available from the Microsoft Update Catalog or other release channels. Microsoft recommends updating devices to the latest version of Windows.

    Key changes 28 CVEs · 3 changes

    • Improved File Explorer: Files and folders from untrusted locations get a Mark of the Web tag. Their LastWriteTime timestamp is updated, which might affect some...
    • Fix lsass.exe: LSASS stops responding on Windows servers after the April 2024 security updates.
    • Fix lsass.exe: LSASS leaks memory during a Local Security Authority (Domain Policy) Remote Protocol call.

    Read update Source: Microsoft

    Build
    14393.7070
    Security
    28 fixed · 1 critical · 1 exploited
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5037763

    Exploited MSHTML and DWM flaws addressed; update expired

    Addresses 34 vulnerabilities, including two exploited flaws in MSHTML and DWM Core. It is no longer available from Microsoft’s release channels as of March 31, 2026.

    As of March 31, 2026, this update is no longer available from Microsoft Update Catalog or other release channels. Microsoft recommends updating devices to the latest version of Windows.

    Key changes 34 CVEs · 5 changes

    • Improved Supports Croatia’s change of currency from the kuna to the euro.
    • Improved DNS Server: Limits NSEC3 validation in a recursive resolver to 1,000 computations by default.
    • Fix VPN: Addresses a problem that might cause VPN connections to fail after the update dated April 9, 2024, or later.

    Read update Source: Microsoft

    Build
    14393.6981
    Security
    34 vulnerabilities fixed · 2 actively exploited
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5036899

    Exploited proxy driver flaw patched; Remote Desktop access fixed

    The update fixes 66 security vulnerabilities, including an exploited proxy driver spoofing flaw, and restores access to network resources from affected Remote Desktop sessions. It is no longer available as of March 31, 2026.

    As of March 31, 2026, this update is no longer available from Microsoft Update Catalog or other release channels; Microsoft recommends updating devices to the latest version of Windows.

    Key changes 66 CVEs · 4 changes

    • Improved Daylight saving time: Daylight saving time changes in Palestine are supported.
    • Improved Daylight saving time: Daylight saving time changes in Kazakhstan are supported.
    • Improved Daylight saving time: Daylight saving time changes in Samoa are supported.

    Read update Source: Microsoft

    Build
    14393.6897
    Security
    66 vulnerabilities fixed · 1 actively exploited
  • Windows Server 2016 Windows Server 2016 Out-of-band update Also for Windows 10
    Out-of-band

    KB5037423

    LSASS memory leak on domain controllers addressed

    Addresses an LSASS memory leak that can cause domain controllers to stop responding and restart unexpectedly after KB5035855.

    Check the newer update, KB5046612

    Key changes 1 change

    • Fix Local Security Authority Subsystem Service (LSASS): Addresses a memory leak on domain controllers that can cause LSASS to stop responding and the servers to restart unexpectedly. The issu...

    Read update Source: Microsoft

    Build
    14393.6800
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5035855

    Domain controller memory leaks can trigger reboots; update expired

    An LSASS memory leak can crash domain controllers and trigger unscheduled reboots while they handle Kerberos requests. This update is no longer available; Microsoft recommends updating devices to the latest Windows version.

    As of March 31, 2026, this update is no longer available from Microsoft Update Catalog or other release channels. Microsoft recommends updating devices to the latest Windows version.

    Key changes 30 CVEs · 1 change

    • Improved Operating system: The update includes miscellaneous security improvements to internal operating system functionality.
    • Critical CVE-2024-21407: Windows Hyper-V Remote Code Execution Vulnerability
    • Critical CVE-2024-21408: Windows Hyper-V Denial of Service Vulnerability

    Read update Source: Microsoft

    Build
    14393.6796
    Security
    30 fixed · 2 critical
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5034767

    Exploited SmartScreen bypass and critical PGM flaw addressed

    The update addresses 34 vulnerabilities, including an actively exploited SmartScreen bypass and a critical PGM remote-code-execution flaw. It also updates Secure Boot certificate support and makes device metadata downloads more secure.

    Key changes 34 CVEs · 2 changes

    • Improved UEFI Secure Boot: UEFI Secure Boot systems can opt in to use a renewed signing certificate.
    • Improved Device metadata: Device metadata downloads over HTTPS are more secure.
    • Exploited CVE-2024-21351: Windows SmartScreen Security Feature Bypass Vulnerability

    Read update Source: Microsoft

    Build
    14393.6709
    Security
    34 fixed · 1 critical · 1 exploited
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5034119

    Critical Kerberos bypass and IE mode scroll bar addressed

    The update addresses 26 vulnerabilities, including a critical Windows Kerberos security feature bypass, and a problem with the ActiveX scroll bar in IE mode. It is no longer available from Microsoft release channels as of March 31, 2026.

    As of March 31, 2026, this update is no longer available from the Microsoft Update Catalog or other release channels. Microsoft recommends updating devices to the latest version of Windows.

    Key changes 26 CVEs · 1 change

    • Fix ActiveX scroll bar: The update addresses a problem affecting the ActiveX scroll bar in IE mode.
    • Critical CVE-2024-20674: Windows Kerberos Security Feature Bypass Vulnerability
    • CVSS 8.1 CVE-2024-20652: Windows HTML Platforms Security Feature Bypass Vulnerability

    Read update Source: Microsoft

    Build
    14393.6614
    Security
    26 fixed · 1 critical