Windows Server 2025

Build history

• Windows Server 2025 Windows Server 2025 Out-of-band update

  Out-of-band

  KB5136489 Nov 13, 2026

  Fix addresses certain Windows licensing failures with error 0x80041008

  Some organizations can now complete certain Windows licensing and activation operations that previously failed. The fix mainly helps systems that use commands or automated processes to manage KMS activation and product keys.

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 2 changes

  • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
  • Fix Licensing and Activation: The update fixes certain Windows licensing and activation operations that could fail with error 0x80041008.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update

  Updated Nov 14

  KB5131080 Nov 10, 2026

  NTLM signing defaults strengthened; Exchange mail issues remain

  NTLM clients now offer message signing by default for non-anonymous connections, helping limit relay attacks. Some on-premises Exchange servers might still have email access or delivery problems.

  Check the newer update, KB5136489

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 628 CVEs · 11 changes

  • Improved Date and Time: Cuba’s clock stays on UTC-04:00 through the November 2026 and March 2027 time changes. It returns to UTC-05:00 in November 2027.
  • Improved Security: NTLM signing helps reduce the risk of relay attacks and helps identify connections that do not use signing.
  • Improved Start menu: The policy that hides the Recommended section now works in Windows 11 Enterprise multi-session environments.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Out-of-band update

  Out-of-band Updated Nov 11

  KB5134137 Oct 26, 2026

  Offline servers get updated trusted root certificates

  Devices that cannot reach Microsoft's certificate-update service get an updated trusted root certificate payload. Hotpatch-enrolled devices that install this update will not receive hotpatch updates until after they install the January 2027 baseline.

  Check the newer update, KB5131080

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 2 changes

  • Improved Certificates: Devices that cannot get certificate list updates receive an updated set of trusted root certificates.
  • Improved Servicing stack: The component that installs Windows updates gets quality improvements.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update

  Zero-day Updated Nov 13

  KB5126646 Oct 13, 2026

  Exploited Windows Shell flaw patched; server recovery feature added

  An actively exploited Windows Shell security-feature bypass is patched. Windows Server 2025 also gains Quick machine recovery, which is off by default.

  Check the newer update, KB5134137

  Known issues: 2 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details
  • SQL Server linked server connections might remain open

  Key changes 1,098 CVEs · 15 changes

  • New Quick machine recovery: Quick machine recovery is now supported on Windows Server 2025, but it is off by default.
  • New Security: Encrypted TLS 1.3 connections can use ML-KEM key exchange to help protect against future quantum-computing threats.
  • New Date and Time: A new Manitoba Standard Time zone is available.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Out-of-band update

  Out-of-band Updated Nov 11

  KB5129235 Sep 14, 2026

  Remote Desktop failures fixed; USB audio partly restored

  Remote Desktop connections and sign-ins work again in affected environments. USB audio in 8-channel or 3D modes is also fixed, but other USB audio problems remain.

  Check the newer update, KB5126646

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 2 changes

  • Fix Remote Desktop Services (known issue): Remote Desktop connections and sign-ins work again in affected environments. Servers and related tools no longer stop responding during...
  • Fix 8-channel or 3D audio modes: Some USB audio devices work again with 8-channel or 3D audio. Other reported USB audio problems are not fixed by this update.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update

  Zero-day Updated Nov 10

  KB5122871 Sep 8, 2026

  Windows Update Stack flaw under active attack

  An actively exploited Windows Update Stack flaw is among the security fixes. The update also improves networking, Remote Desktop audio, and Sysmon.

  Check the newer update, KB5129235

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 690 CVEs · 9 changes

  • Improved Certificates: Applications are more likely to keep working as Windows moves to newer signing certificates.
  • Improved Date and Time: Morocco’s local time reflects its move to permanent UTC+00:00 on September 20, 2026.
  • Improved Networking: Network connections respond faster when a network adapter disconnects, helping network storage and file access keep working.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update

  Zero-day Updated Nov 10

  KB5120233 Aug 11, 2026

  Winsock driver flaw under attack; DFS file previews improved

  An actively exploited Winsock driver flaw gets a security fix. File Explorer also handles files on DFS drives better after network reconnects.

  Check the newer update, KB5122871

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 216 CVEs · 5 changes

  • New Emoji Panel: The emoji panel now supports GIPHY.
  • Improved File Explorer: Previews and copied files on DFS mapped drives work as expected after the server reconnects to the network.
  • Improved Windows: Certificate Authority setup again offers post-quantum certificate options, and enrollment with new certificate templates can succeed.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update

  Zero-day Updated Nov 10

  KB5099536 Jul 14, 2026

  Actively exploited AD FS and Shell flaws addressed

  The update addresses actively exploited flaws in AD FS and Windows Shell, along with a publicly disclosed BitLocker flaw. It also adds cryptography support and fixes several reported problems.

  Check the newer update, KB5120233

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 390 CVEs · 16 changes

  • New Cryptography: TLS 1.3 can use hybrid post-quantum key exchange to help protect secure network connections.
  • New Cryptography: Cryptographic signatures and keys can combine traditional and post-quantum algorithms.
  • New Distributed Key Manager (DKM): AD FS can detect insecure DKM container permissions and offers an optional way to improve them.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update

  KB5094125 Jun 9, 2026

  DNS over HTTPS arrives as Secure Boot coverage expands

  Windows Server 2025 DNS can now use encrypted server-to-client queries, while Secure Boot certificate rollout reaches more eligible devices. The update also resolves an issue that could make Outlook and other WNS apps stop responding.

  Check the newer update, KB5099536

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 109 CVEs · 9 changes

  • New Secure Boot: A new policy lets administrators limit the Secure Boot data Windows sends to Microsoft.
  • New Networking: DNS can encrypt queries between a Windows Server DNS server and its clients, helping protect their privacy.
  • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates through a controlled rollout.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update

  KB5087539 May 12, 2026

  Secure Boot certificate rollout expands; ML-DSA signing added

  Secure Boot certificate updates can reach more eligible devices, and certificate authorities can use post-quantum signatures. The update also fixes a Remote Desktop warning dialog that could render incorrectly across monitors.

  Check the newer update, KB5094125

  Known issues: 2 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details
  • Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

  Key changes 66 CVEs · 9 changes

  • New Secure Boot: Eligible devices get a new folder with scripts that help IT teams check and deploy Secure Boot certificate updates.
  • New Active Directory Certificate Services: Certificate services can use new post-quantum signatures for certificates used in code signing and secure connections.
  • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates, but the rollout waits for signs that updates are working well.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Out-of-band update

  Out-of-band

  KB5091157 Apr 19, 2026

  Domain controller startup and update installation problems fixed

  Domain controllers in some multi-domain forests can start again, and affected Server 2025 devices can install the April security update. The out-of-band release also includes open BitLocker, WSUS, and Remote Desktop issues.

  Check the newer update, KB5087539

  Known issues: 3 open

  • Windows Server Update Services (WSUS) does not display error details
  • Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key
  • Warnings related to Remote Desktop might not display correctly

  Key changes 3 changes

  • Improved Servicing stack update (SSU): The component that installs Windows updates gets quality improvements.
  • Fix Active Directory: Some domain controllers in multi-domain forests could have startup problems after the April security update. This release fixes the pro...
  • Fix Windows update installation: Some Windows Server 2025 devices could not install the April 14 security update. This release fixes that problem.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update

  KB5082063 Apr 14, 2026

  Secure Boot hardening and new recovery-key and Remote Desktop issues

  Secure Boot certificate updates reach more eligible devices, while changes to driver blocking and Windows Deployment Services can affect backup apps and Hands-Free Deployment. Some BitLocker, WSUS, and Remote Desktop issues remain listed.

  Check the newer update, KB5091157

  Secure Boot certificates used by most Windows devices start to expire in June 2026. Review Microsoft's guidance and prepare to update them.

  Known issues: 3 open

  • Windows Server Update Services (WSUS) does not display error details
  • Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key
  • Warnings related to Remote Desktop might not display correctly

  Key changes 125 CVEs · 13 changes

  • New Texts and Fonts: Windows fonts include the new Saudi Riyal currency symbol.
  • Improved Secure Boot: Secure Boot certificates reach more eligible devices through a phased rollout.
  • Improved Kerberos protocol: Kerberos uses AES-SHA1 by default for accounts without an explicit encryption setting.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update

  KB5078740 Mar 10, 2026

  Secure Boot targeting expands; newer server errors are handled

  Fixes 39 Important vulnerabilities and expands targeted delivery of new Secure Boot certificates. It also improves hardware error reporting on newer server platforms.

  Check the newer update, KB5082063

  Secure Boot certificates used by most Windows devices start expiring in June 2026. Microsoft recommends reviewing its guidance and preparing to update certificates; servers are unlikely to qualify for automatic delivery of the new certificates.

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 39 CVEs · 4 changes

  • Improved Catalog tab: The x64 update string shown on the Catalog tab is corrected.
  • Improved Secure Boot: Eligible devices receive new Secure Boot certificates through a controlled, phased rollout. Servers are unlikely to qualify, though the...
  • Improved System services and reliability: Newer server platforms can report and handle supported hardware errors as expected, including systems with up to 64 Machine Check Archi...

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update

  Zero-day

  KB5075899 Feb 10, 2026

  Exploited Shell and MSHTML bypasses patched

  Fixes security flaws already being exploited, including Windows Shell and MSHTML security-feature bypasses. It also adds DNS features, while WSUS still does not show synchronization error details.

  Check the newer update, KB5078740

  Secure Boot certificates used by most Windows devices started expiring in June 2026. Devices without newer certificates continue to start and receive standard updates; administrators can follow Microsoft's Windows Server guidance.

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 29 CVEs · 7 changes

  • New Networking: Windows DNS Server adds DNS over HTTPS support in public preview for evaluating traffic between the server and its clients. The preview...
  • New Networking: DNS Server can randomly shuffle resource records in responses, helping reduce the chance that the first-listed record becomes overloade...
  • Improved Fonts & Display: Chinese fonts support the GB18030-2022A standard for character coverage and display.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Out-of-band update

  Out-of-band

  KB5078135 Jan 24, 2026

  Cloud-file errors and Outlook hangs fixed; WSUS details remain missing

  Fixes errors opening or saving cloud-based files, including Outlook hangs in some OneDrive PST configurations. WSUS synchronization error details remain unavailable.

  Check the newer update, KB5075899

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 2 changes

  • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
  • Fix File System: Some applications can open files from and save files to cloud-based storage without the unresponsiveness or unexpected errors caused by...

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Out-of-band update

  Out-of-band

  KB5077793 Jan 17, 2026

  Remote Desktop sign-in failures fixed

  Remote Desktop connections work again for users who had sign-in failures after the January security update. The update also includes a servicing stack improvement.

  Check the newer update, KB5078135

  Known issues: 2 open

  • Windows Server Update Services (WSUS) does not display error details
  • Apps might become unresponsive when saving files to cloud-based storage

  Key changes 2 changes

  • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
  • Fix Remote Desktop: Some users who could not sign in to Remote Desktop connections can sign in again.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update

  Zero-day

  KB5073379 Jan 13, 2026

  An exploited desktop display flaw exposes information

  Attackers are exploiting a flaw in the desktop display system to expose information. The update also changes credential input during remote support and includes a known cloud-file issue.

  Check the newer update, KB5077793

  Known issues: 2 open

  • Windows Server Update Services (WSUS) does not display error details
  • Apps might become unresponsive when saving files to cloud-based storage

  Key changes 86 CVEs · 8 changes

  • New Credentials autofill: In some remote support and automated sign-in situations, credential dialogs no longer accept typing from virtual keyboards in remote de...
  • New Secure Boot: Windows quality updates use device eligibility data to deliver new Secure Boot certificates in phases.
  • Improved Windows Deployment Services: Hands-free deployment is no longer supported by default.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update Also for Windows 11

  Zero-day

  KB5072033 Dec 9, 2025

  Exploited Cloud Files flaw patched; RemoteApp may fail

  Attackers are exploiting a Cloud Files driver flaw, while RemoteApp connections might fail on Azure Virtual Desktop. The update also adds privacy prompts and other features.

  Check the newer update, KB5073379

  Secure Boot certificates have started expiring in June 2026. Devices without newer certificates should still start and receive standard updates.

  Known issues: 2 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details
  • RemoteApp sessions might fail to start on Azure Virtual Desktop

  Key changes 34 CVEs · 24 changes

  • New File Explorer: Dividers now separate the top-level icons in File Explorer's right-click menu.
  • New When an app asks to use your camera, microphone, location, or another device feature, a redesigned prompt appears in the center of a di...
  • New Search on the Taskbar: A new grid view helps you find images more quickly and accurately in taskbar search.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Out-of-band update Also for Windows 11

  Out-of-band

  KB5072359 Nov 18, 2025

  Prevents NVMe boot failures during Server 2025 upgrades

  The out-of-band update prevents a boot failure during some upgrades from Windows Server 2022 to Windows Server 2025 on Intel C2030 systems with Samsung NVMe devices. It also improves the component that installs Windows updates.

  Check the newer update, KB5072033

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 2 changes

  • Improved Servicing stack: The component that installs Windows updates receives a quality improvement.
  • Fix Upgrade to Windows Server 2025: Upgrades from Windows Server 2022 no longer encounter the described boot failure on some Intel C2030 systems with Samsung NVMe devices.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update Also for Windows 11

  Zero-day

  KB5068861 Nov 11, 2025

  Closes an exploited kernel flaw and adds post-quantum cryptography

  Fixes 31 vulnerabilities, including an exploited Windows Kernel elevation-of-privilege flaw, and adds support for two post-quantum cryptography algorithms. WSUS still does not show synchronization error details.

  Check the newer update, KB5072359

  Secure Boot certificates used by most Windows devices started expiring in June 2026. Devices without newer certificates continue to start and operate normally, and standard updates continue to install.

  Known issues: 1 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details

  Key changes 31 CVEs · 18 changes

  • New Start menu: Administrators can apply Start menu pins once, so users can then change their pinned layout and keep their changes.
  • New Post-Quantum Cryptography: Apps can use two new post-quantum cryptography algorithms for key exchange, signing, and decryption.
  • Improved Servicing stack: Includes an update to the component that installs Windows updates, intended to make update installation more reliable.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Out-of-band security update Also for Windows 11

  Out-of-band

  KB5070881 Oct 23, 2025

  WSUS remote-code flaw patched; error details temporarily disappear

  The WSUS remote code execution flaw CVE-2025-59287 gets a patch. WSUS synchronization error details are temporarily unavailable, and a small number of Hotpatch servers may miss updates.

  Check the newer update, KB5068861

  Secure Boot certificates used by most Windows devices start expiring in June 2026. Review Microsoft's guidance and update certificates in advance.

  Known issues: 5 open Organizations and IT administrators

  • Windows Server Update Services (WSUS) does not display error details
  • Active Directory Replication
  • and 3 more

  Key changes 1 CVE · 2 changes

  • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
  • Fix Windows Server Update Services (WSUS): WSUS reporting web services get a fix for a remote code execution flaw.
  • Critical CVE-2025-59287: Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Out-of-band update Also for Windows 11

  Out-of-band

  KB5070773 Oct 20, 2025

  USB keyboards and mice work again in WinRE

  USB keyboards and mice work again in WinRE after the October 14 security update stopped them from working there. They continued to work normally in Windows.

  Check the newer update, KB5070881

  Secure Boot certificates used by most Windows devices start expiring in June 2026. Review Microsoft's guidance and update certificates in advance.

  Known issues: 3 open Organizations and IT administrators

  • Active Directory Replication
  • Directory synchronization (DirSync)
  • IIS websites might fail to load

  Key changes 2 changes

  • Improved Servicing stack: The component that installs Windows updates gets quality improvements to help devices receive and install updates reliably.
  • Fix USB: USB keyboards and mice work again in Windows Recovery Environment. They continued to work normally in Windows.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update Also for Windows 11

  Zero-day

  KB5066835 Oct 14, 2025

  Exploited Remote Access flaw patched; recovery USB issue remains

  Fixes actively exploited Windows flaws, including one in Remote Access Connection Manager, and adds security and usability changes. USB keyboards and mice might not work in the recovery environment.

  Check the newer update, KB5070773

  Secure Boot certificates used by most Windows devices start expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid boot problems.

  Known issues: 4 open Organizations and IT administrators

  • Active Directory Replication
  • Directory synchronization (DirSync)
  • and 2 more

  Key changes 131 CVEs · 33 changes

  • New App defaults: In the European Economic Area, choosing a default browser can also set more file and link types and pin it to Start and the taskbar.
  • New Narrator: Screen Curtain blacks out the screen while Narrator reads aloud, helping keep visible content private.
  • New Narrator: Narrator guides users through prompts that explain new features and changes.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Out-of-band update Also for Windows 11

  Out-of-band

  KB5068221 Sep 22, 2025

  App-V Office app failures fixed

  Microsoft Office apps in App-V environments no longer fail because of a double handle closure. Plan for a restart after installing the update.

  Check the newer update, KB5066835

  Known issues: 3 open Organizations and IT administrators

  • Active Directory Replication
  • Directory synchronization (DirSync)
  • SMBv1 protocol connectivity

  Key changes 1 change

  • Fix Virtualization and platform compatibility: Office apps in App-V environments no longer fail because of a double handle closure.

  Read update → Source: Microsoft ↗

• Windows Server 2025 Windows Server 2025 Security update Also for Windows 11

  KB5065426 Sep 9, 2025

  SMB flaw disclosed; older print clients lose access to updated servers

  An SMB elevation-of-privilege flaw is publicly disclosed, and older Windows print clients can no longer print to updated servers. PowerShell 2.0 is also removed.

  Check the newer update, KB5068221

  Known issues: 4 open Organizations and IT administrators

  • Active Directory Replication
  • Directory synchronization (DirSync)
  • and 2 more

  Key changes 64 CVEs · 31 changes

  • New Settings: Settings adds a FAQs section with answers about Windows Server setup, performance, and compatibility.
  • New Taskbar: Admins can let users unpin selected apps without those apps returning at the next policy refresh.
  • New Voice Access: Voice Access can highlight its new features and improvements in an in-app guide.

  Read update → Source: Microsoft ↗