KB5034768: Cumulative update for Windows Server, version 2019, February 2024. Exploited Windows flaws closed; LAPS and LSASS issues addressed

Closes 39 vulnerabilities, including critical CVE-2024-21357 (Windows PGM remote code execution) and exploited CVE-2024-21338 (Windows Kernel), CVE-2024-21412 (Internet Shortcut Files), and CVE-2024-21351 (SmartScreen). It also addresses several sign-in and system issues.

Does it affect you? Applies to: Devices running Windows Server 2019.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 6 changes

Device metadata

For: Devices downloading metadata from WMIS

Downloads of device metadata over HTTPS from Windows Metadata and Internet Services are more secure.¹
The update addresses an issue affecting device metadata downloads from Windows Metadata and Internet Services (WMIS) over HTTPS.

Windows nesting limit

The nesting limit can now be set as low as 35 instead of 50. Do not change it unless a kernel stack overflow and recursion in DestroyWindow() cause stop errors.²
The registry value is HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERNestedWindowLimit.

UEFI Secure Boot

UEFI Secure Boot systems can opt to add a renewed signing certificate.³
The update adds a renewed signing certificate to the Secure Boot DB variable. See KB5036210 for details.

Windows Kernel Vulnerable Driver Blocklist

For: Windows Server 2019 devices

The driver blocklist gets its quarterly update, adding drivers at risk of being used in BYOVD attacks.⁴
The update changes DriverSiPolicy.p7b.

Active Directory Users & Computers

The snap-in now uses a stronger certificate mapping by default.⁵
The default mapping is X509IssuerSerialNumber instead of the weaker x509IssuerSubject.

Servicing stack

For: Windows Server 2019 devices

The component that installs Windows updates receives quality improvements to help devices receive and install Microsoft updates reliably.⁶
Includes servicing stack update 17763.5441.

Fixes 3 changes

Windows LAPS

Addresses a problem that prevents sign-in to a local account managed by Windows LAPS when the Require Smart Card for Interactive Logon policy is set.⁷

Windows Management Instrumentation

For: Windows Server 2019 devices

Addresses a caching problem that can cause CurrentTimeZone to have the wrong value.⁸
A WMI caching issue can change CurrentTimeZone to the wrong value.

Local Security Authority Subsystem Service

Addresses an issue that might cause LSASS to stop working when accessing the Active Directory database.⁹

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-02-13
Type: Cumulative update

Version	Build	Channel
2019	17763.5458	General availability

Security

39 vulnerabilities fixed

3 exploited 1 critical 37 important 1 moderate

Vulnerability	Severity	CVSS
CVE-2024-21412 Exploited Internet Shortcut Files Security Feature Bypass Vulnerability	Important	8.1
CVE-2024-21338 Exploited Windows Kernel Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-21351 Exploited Windows SmartScreen Security Feature Bypass Vulnerability	Moderate	7.6
CVE-2024-21357 Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability	Critical	8.1

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 39 vulnerabilities →

Sources

Microsoft Support: KB5034768

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (9)

1. This update addresses an issue that affects the download of device metadata. Downloads from the Windows Metadata and Internet Services (WMIS) over HTTPS are now more secure. support.microsoft.com
2. This update addresses an issue that affects the Windows nesting limit. You can now set it to a low of 35 instead of 50. support.microsoft.com
3. It adds a renewed signing certificate to the Secure Boot DB variable. You can now opt for this change. support.microsoft.com
4. This update includes quarterly changes to the Windows Kernel Vulnerable Driver Blocklist file, DriverSiPolicy.p7b. It adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
5. This update changes a setting in Active Directory Users & Computers. By default, the snap-in now uses a strong certificate mapping of X509IssuerSerialNumber. It does not use the weak mapping of x509IssuerSubject. support.microsoft.com
6. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
7. This update addresses an issue that affects a local account. You cannot sign in to an account that Windows LAPS manages. This occurs if you set the "Require Smart Card for Interactive Logon" policy. support.microsoft.com
8. This update addresses an issue that affects Windows Management Instrumentation (WMI). A caching issue occurs. The issue causes CurrentTimeZone to change to the wrong value. support.microsoft.com
9. This update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). It might stop working. This occurs when you access the Active Directory database. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Nov 8, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake