The Update BureauKB5034119: Cumulative update for Windows Server, version 2016, January 2024. Critical Kerberos bypass and IE mode scroll bar addressed
In short
The update addresses 26 vulnerabilities, including a critical Windows Kerberos security feature bypass, and a problem with the ActiveX scroll bar in IE mode. It is no longer available from Microsoft release channels as of March 31, 2026.
Does it affect you? Applies to: This update is for devices running Windows Server 2016.
Microsoft publishes separate notes for this KB for Windows 10.
What changes
Fix 1 change
ActiveX scroll bar
- The update addresses a problem affecting the ActiveX scroll bar in IE mode.1
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2024-01-09
- Type
- Cumulative update
| Version | Build | Channel |
|---|---|---|
| 2016 | 14393.6614 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Windows Kerberos Security Feature Bypass Vulnerability
|
Critical | 8.8 |
|
Windows HTML Platforms Security Feature Bypass Vulnerability
|
Important | 8.1 |
|
Microsoft ODBC Driver Remote Code Execution Vulnerability
|
Important | 8.0 |
|
Microsoft Common Log File System Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Cryptographic Services Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Win32k Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
|
Important | 7.5 |
|
Microsoft AllJoyn API Denial of Service Vulnerability
|
Important | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Important | 7.5 |
|
Windows Group Policy Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability
|
Important | 6.6 |
|
BitLocker Security Feature Bypass Vulnerability
|
Important | 6.6 |
|
Microsoft Message Queuing Information Disclosure Vulnerability
|
Important | 6.5 |
|
Windows Message Queuing Client (MSMQC) Information Disclosure
|
Important | 6.5 |
|
Microsoft Message Queuing Information Disclosure Vulnerability
|
Important | 6.5 |
|
Windows Message Queuing Client (MSMQC) Information Disclosure
|
Important | 6.5 |
|
Microsoft Message Queuing Information Disclosure Vulnerability
|
Important | 6.5 |
|
Windows Themes Spoofing Vulnerability
|
Important | 6.5 |
|
Windows Server Key Distribution Service Security Feature Bypass
|
Important | 6.1 |
|
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
|
Important | 5.7 |
|
Windows CoreMessaging Information Disclosure Vulnerability
|
Important | 5.5 |
|
Windows Cryptographic Services Information Disclosure Vulnerability
|
Important | 5.5 |
|
Windows TCP/IP Information Disclosure Vulnerability
|
Important | 5.3 |
|
Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability
|
Important | 4.9 |
|
Windows Themes Information Disclosure Vulnerability
|
Important | 4.7 |
Sources
Updated
Cited passages from Microsoft's official notes (1)
-
1.
This update addresses an issue that affects the ActiveX scroll bar. It does not work in IE mode.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Nov 8, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake