Windows Server 2019

Build history

• Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10

  Out-of-band

  KB5136490 Nov 13, 2026

  SLMGR licensing failures with error 0x80041008 fixed

  Certain Windows licensing and activation operations using SLMGR might fail with error 0x80041008; this out-of-band update fixes the problem. It mainly affected organizations using SLMGR commands or automation.

  Key changes 2 changes

  • Improved Servicing stack: The servicing stack checks whether a device runs on Azure using an updated certificate chain.
  • Fix Licensing and Activation: Some licensing and activation tasks that use SLMGR can fail with error 0x80041008. This issue is fixed.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  Updated Nov 14

  KB5131085 Nov 10, 2026

  LDAP and Search flaws patched; Exchange mail restored

  Critical flaws in LDAP and Windows Search are patched, and on-premises Exchange sign-in and email delivery issues are resolved. NTLM clients now offer message signing by default for non-anonymous connections.

  Check the newer update, KB5136490

  Key changes 561 CVEs · 9 changes

  • Improved Date and Time: Cuba's time zone stays at UTC-04:00 through the November 2026 and March 2027 time changes.
  • Improved Windows PowerShell: PowerShell checks script signatures more strictly. Scripts with invalid UTF-8 encoding might fail validation, even if they passed befor...
  • Improved Security: For non-anonymous connections, NTLM clients offer message signing by default. This helps reduce exposure to relay attacks.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10

  Out-of-band Updated Nov 11

  KB5134124 Oct 26, 2026

  Updated root certificate payload for disconnected devices

  Devices that cannot get certificate updates from Microsoft receive an updated trusted root certificate payload. Some Exchange servers might still have sign-in and email problems.

  Check the newer update, KB5131085

  Key changes 1 change

  • Improved Certificates: Devices that cannot reach Microsoft's certificate service, or have automatic certificate updates turned off, get an updated trusted roo...

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  Zero-day Updated Nov 14

  KB5126651 Oct 13, 2026

  Actively exploited Windows Shell flaw patched; Exchange issue mitigated

  An actively exploited Windows Shell security bypass is patched. Exchange users might still have sign-in and email problems, but a registry mitigation is available.

  Check the newer update, KB5134124

  Key changes 970 CVEs · 9 changes

  • New Date and Time: Manitoba Standard Time is added as a time zone.
  • New Authentication: Administrators can see who uses NTLM, why it was chosen, and where it is used.
  • New ReFS security: Auditing and optional security controls are added for ReFS volumes on external storage.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10

  Out-of-band Updated Nov 11

  KB5129238 Sep 14, 2026

  Remote Desktop instability addressed; 8-channel USB audio restored

  Addresses Remote Desktop instability and restores 8-channel or 3D audio on affected USB Audio Class 1.0 devices. Other USB audio symptoms might remain.

  Check the newer update, KB5126651

  Key changes 3 changes

  • Improved Servicing stack: The update improves certificate checks when verifying whether a device is hosted on Azure.
  • Fix Remote Desktop Services (known issue): Remote Desktop connections and sign-ins work more reliably in affected environments; servers and related tools are less likely to becom...
  • Fix 8-channel or 3D audio modes: Some USB Audio Class 1.0 devices work again when using 8-channel or 3D audio modes.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  Zero-day Updated Nov 10

  KB5122876 Sep 8, 2026

  An exploited ALPC flaw is patched; Remote Desktop audio is addressed

  An exploited Windows ALPC flaw is patched, and Remote Desktop audio redirection is addressed for some configurations. USB Audio Class 1.0 devices can still have sound problems.

  Check the newer update, KB5129238

  Secure Boot certificates began expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid possible boot problems.

  Key changes 626 CVEs · 5 changes

  • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates automatically over the coming months.
  • Improved Date and Time: Morocco's local time will stay correct after the country moves to UTC+00:00 on September 20, 2026.
  • Improved Windows Code Integrity policies: Some apps work more smoothly during Windows certificate changes.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  Zero-day Updated Nov 10

  KB5120238 Aug 11, 2026

  Exploited WinSock flaw patched; SMB backups recover

  An actively exploited WinSock driver flaw is patched, and scheduled File History backups to network shares work again. Secure Boot certificate coverage also expands.

  Check the newer update, KB5122876

  Key changes 183 CVEs · 3 changes

  • Improved Secure Boot: More devices qualify to receive new Secure Boot certificates automatically. Certificate deployment continues over the coming months.
  • Improved Servicing stack update (SSU): The update improves checks that confirm whether a device is hosted on Azure.
  • Fix Backup: Scheduled File History backups to network shares copy files again instead of failing with an incorrect credentials error.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  Zero-day Updated Nov 10

  KB5099538 Jul 14, 2026

  Exploited AD FS flaw patched; Secure Boot status reporting added

  Attackers are exploiting an AD FS privilege flaw, and the update adds Secure Boot status reporting. It also fixes issues in File Explorer, OLE Automation, and the Recycle Bin.

  Check the newer update, KB5120238

  Key changes 313 CVEs · 10 changes

  • New Secure Boot: Windows Security can now report Secure Boot status.
  • New Distributed Key Manager (DKM): AD FS can detect insecure DKM container settings and offers an optional way to improve them.
  • Improved Input: In rare cases, some built-in Windows features might temporarily stop responding to keyboard shortcuts.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  KB5094123 Jun 9, 2026

  HTTP.sys remote-code flaw patched; Outlook hangs fixed

  A critical HTTP.sys remote-code flaw is patched, and an issue that could hang Outlook and other notification apps is resolved.

  Check the newer update, KB5099538

  Key changes 89 CVEs · 6 changes

  • New Secure Boot: A new setting lets administrators limit the Secure Boot data Windows sends to Microsoft.
  • Improved Secure Boot: Secure Boot status reporting is enabled in the Windows Security app.
  • Improved Secure Boot: More devices that qualify can receive new Secure Boot certificates. They get the certificates after enough successful update signals.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  KB5087538 May 12, 2026

  Remote Desktop warnings and account sign-in failures fixed

  The update fixes a Remote Desktop security warning display problem and a Microsoft account sign-in failure. It also expands the phased delivery of new Secure Boot certificates.

  Check the newer update, KB5094123

  Key changes 55 CVEs · 7 changes

  • New Secure Boot: Eligible devices get a C:\Windows\SecureBoot folder containing example scripts for checking certificate update status and automating de...
  • Improved Secure Boot: Windows Security can report the device's Secure Boot state.
  • Improved Secure Boot: More eligible devices can automatically receive new Secure Boot certificates, in a controlled, phased rollout after showing enough succ...

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10

  Out-of-band

  KB5091573 Apr 19, 2026

  Fixes startup failures on multi-domain PAM domain controllers

  Fixes startup problems on multi-domain domain controllers that use Privileged Access Management after installing the April 14 update. It is available only from the Microsoft Update Catalog.

  Check the newer update, KB5087538

  Key changes 2 changes

  • Improved Servicing stack: The included servicing stack update improves verification of whether a device is hosted on Azure.
  • Fix Domain controllers (known issue): Startup problems are fixed for domain controllers in multi-domain forests that use Privileged Access Management and might have been aff...

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  KB5082123 Apr 14, 2026

  Three critical remote-code flaws; Secure Boot and server changes

  Fixes 107 vulnerabilities, including three critical remote-code execution flaws, and changes Secure Boot, Remote Desktop, Kerberos, and WDS behavior. A domain-controller restart issue is resolved by KB5091573, not this update.

  Check the newer update, KB5091573

  Key changes 107 CVEs · 9 changes

  • New Secure Boot: Windows Security can report Secure Boot status dynamically. These status alerts are disabled by default on commercial devices and serve...
  • Improved Remote Desktop: Before connecting from an .rdp file, Remote Desktop shows all requested connection settings, with each setting turned off by default. A...
  • Improved Vulnerable driver blocklist: Known vulnerable kernel drivers are added to the Microsoft vulnerable driver blocklist. Backup applications that rely on blocked driver...

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  KB5078752 Mar 10, 2026

  Secure Boot certificate targeting expands; File History backs up more files

  The update fixes 38 Important-severity vulnerabilities and expands phased Secure Boot certificate targeting. File History can now back up files with certain Chinese and Private Use Area characters.

  Check the newer update, KB5082123

  Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and prepare to update certificates to avoid disruption.

  Key changes 38 CVEs · 4 changes

  • New Windows System Image Manager: A warning dialog helps you confirm that a selected catalog file comes from a trusted source.
  • Improved File History: File History can back up new files with names containing certain Chinese and Private Use Area characters.
  • Improved Secure Boot: More eligible devices can be targeted to receive new Secure Boot certificates automatically, through a controlled phased rollout.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  Zero-day

  KB5075904 Feb 10, 2026

  Exploited Shell and MSHTML security bypasses patched

  Fixes 24 vulnerabilities, including five that attackers are exploiting. It also fixes shutdown, folder-name, and graphics problems.

  Check the newer update, KB5078752

  Key changes 24 CVEs · 5 changes

  • Improved Fonts: Chinese fonts are updated to meet GB18030-2022A compliance.
  • Improved Servicing stack: The update includes quality improvements to the component that installs Windows updates.
  • Fix OS Security: Some Secure Launch-capable PCs with Virtual Secure Mode enabled can shut down or hibernate instead of restarting.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10

  Out-of-band

  KB5078131 Jan 24, 2026

  Cloud-file errors and Outlook hangs fixed

  Fixes file access problems that could leave some apps unresponsive and cause Outlook to hang when PST files are stored on OneDrive.

  Check the newer update, KB5075904

  Key changes 2 changes

  • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
  • Fix File System: Some apps can open or save files in cloud storage again without becoming unresponsive. In certain Outlook setups, PST files stored on O...

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10

  Out-of-band

  KB5077795 Jan 17, 2026

  Remote Desktop sign-in failures fixed

  Fixes sign-in failures during Remote Desktop connections, including with the Windows App. It also includes servicing stack improvements.

  Check the newer update, KB5078131

  Secure Boot certificates started expiring in June 2026. Review Microsoft’s guidance and update certificates in advance to avoid disruption.

  Known issues: 1 open

  • Apps might become unresponsive when saving files to cloud-based storage

  Key changes 2 changes

  • Improved Servicing stack: The component that installs Windows updates gets quality improvements intended to improve the reliability of update installation.
  • Fix Remote Desktop: Some users can sign in again during Remote Desktop connections.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  Zero-day

  KB5073723 Jan 13, 2026

  Exploited DWM flaw patched; modem drivers removed

  An actively exploited Desktop Window Manager flaw is patched. The update also removes several modem drivers, so hardware that depends on them stops working.

  Check the newer update, KB5077795

  Known issues: 1 open

  • Apps might become unresponsive when saving files to cloud-based storage

  Key changes 72 CVEs · 5 changes

  • Improved Credentials autofill: Credential dialogs ignore virtual keyboard input from remote access tools during some remote support or automated sign-in sessions.
  • Improved Windows Deployment Services (WDS): Hands-free deployment is no longer supported by default. Administrators should follow Microsoft's guidance.
  • Improved Servicing stack: The component that installs Windows updates gets quality improvements.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10

  Out-of-band

  KB5074975 Dec 18, 2025

  Message Queuing failures after December updates fixed

  Fixes Message Queuing problems that could leave queues inactive or prevent applications from writing messages, mainly in enterprise or managed environments.

  Check the newer update, KB5073723

  Key changes 2 changes

  • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
  • Fix Message queuing (MSMQ) (known issue): Message Queuing problems that could leave queues inactive or stop applications from writing messages are fixed for affected environment...

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  Zero-day

  KB5071544 Dec 9, 2025

  Closes exploited Cloud Files flaw; People icon stops responding

  The update closes exploited CVE-2025-62221 in the Cloud Files Mini Filter Driver, adds a script-risk prompt to PowerShell 5.1 web requests, and makes the People taskbar icon unresponsive.

  Check the newer update, KB5074975

  Secure Boot certificates used by most Windows devices have started expiring in June 2026. Microsoft recommends reviewing its guidance and updating certificates in advance to avoid disruption.

  Key changes 26 CVEs · 3 changes

  • Improved PowerShell 5.1: PowerShell warns you about script execution risks before an Invoke-WebRequest request continues. You can choose to continue or cancel.
  • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
  • Removed People app: The People icon on the taskbar no longer responds because the feature is being deprecated.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  Zero-day

  KB5068791 Nov 11, 2025

  Exploited Windows kernel flaw addressed; unexpected UAC prompts fixed

  The update addresses an actively exploited Windows kernel flaw and unexpected UAC prompts during some app repairs. It also includes security improvements and a servicing stack update.

  Check the newer update, KB5071544

  Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid possible boot disruption.

  Key changes 32 CVEs · 3 changes

  • Improved Internal Windows OS: Windows includes miscellaneous security improvements to internal functionality; no specific issues are documented.
  • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
  • Fix App compatibility (known issue): Unexpected UAC prompts during MSI repair operations for some apps, including Autodesk AutoCAD, are addressed.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Out-of-band security update Also for Windows 10

  Out-of-band

  KB5070883 Oct 23, 2025

  Critical WSUS flaw fixed; synchronization error details stay hidden

  Fixes a critical remote code execution flaw in WSUS reporting web services. WSUS synchronization error details are temporarily unavailable after installation.

  Check the newer update, KB5068791

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 1 CVE · 2 changes

  • Improved Servicing stack: The component that installs Windows updates gets quality improvements intended to help make update installation more reliable.
  • Fix Windows Server Update Services (WSUS): WSUS reporting web services receive a fix for a remote code execution vulnerability.
  • Critical CVE-2025-59287: Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  Zero-day

  KB5066586 Oct 14, 2025

  Exploited Remote Access Connection Manager flaw addressed

  Addresses an actively exploited elevation-of-privilege flaw in Remote Access Connection Manager and fixes several input and remote-management problems. It also changes File Explorer previews for downloaded files.

  Check the newer update, KB5070883

  Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and prepare to update certificates to avoid possible secure-boot disruption.

  Key changes 98 CVEs · 8 changes

  • Improved Cryptography: RSA-based smart card certificates must use the newer certificate storage method. Smart card authentication might be affected by this ch...
  • Improved File Explorer: File Explorer automatically disables previews for files downloaded from the internet, helping prevent a vulnerability when previewing p...
  • Improved Servicing stack: The component that installs Windows updates receives quality improvements intended to make the update process more reliable.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  KB5065428 Sep 9, 2025

  SMB compatibility auditing added; MSI repair prompts reduced

  The update adds SMB compatibility auditing and Certificate Revocation List partitioning, and reduces unexpected UAC prompts during some MSI repairs. It also addresses 52 vulnerabilities, including 7 Critical vulnerabilities.

  Check the newer update, KB5066586

  Secure Boot certificates used by most Windows devices have started expiring in June 2026. Microsoft recommends reviewing its guidance and updating certificates in advance to avoid disruption.

  Key changes 52 CVEs · 3 changes

  • New Active Directory: Windows Certificate Authorities can use Certificate Revocation List partitioning.
  • New File Server: IT administrators can check whether SMB clients might be incompatible with SMB Server signing and EPA before deploying the related hard...
  • Fix App compatibility (known issue): Unexpected UAC prompts during some MSI repairs are reduced. IT administrators can allowlist specific apps to disable prompts for those...

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10

  Out-of-band

  KB5066187 Aug 19, 2025

  Secure Boot certificates begin expiring in June 2026

  Improves the servicing stack. Secure Boot certificates used by most Windows devices have started expiring in June 2026, so review Microsoft's guidance and prepare to update them.

  Check the newer update, KB5065428

  Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and prepare to update certificates to avoid possible boot disruption.

  Key changes 1 change

  • Improved Servicing stack: The component that installs Windows updates gets quality improvements intended to make the update process more reliable.

  Read update → Source: Microsoft ↗

• Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

  KB5063877 Aug 12, 2025

  GDI+ remote-code flaw fixed; BitLocker cluster restarts stopped

  Fixes 54 vulnerabilities, including three critical flaws, and stops repeated Cluster Service failures on BitLocker configurations using Cluster Shared Volumes.

  Check the newer update, KB5066187

  Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid possible boot disruption.

  Key changes 54 CVEs · 3 changes

  • Improved Servicing stack: The component that installs Windows updates gets reliability improvements that help mitigate potential problems during installation.
  • Fix Cluster Service: The Cluster Service no longer repeatedly stops and restarts on the affected servers, preventing cluster nodes from failing to rejoin or...
  • Fix Input and Composition: Users can select words again with the Microsoft Changjie Input Method.

  Read update → Source: Microsoft ↗