Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5036899

KB5036899: Cumulative update for Windows Server, version 2016, April 2024. Exploited proxy driver flaw patched; Remote Desktop access fixed

In short

The update fixes 66 security vulnerabilities, including an exploited proxy driver spoofing flaw, and restores access to network resources from affected Remote Desktop sessions. It is no longer available as of March 31, 2026.

Does it affect you? Applies to: Devices running Windows Server 2016.

Build
14393.6897
Security
66 fixed · 1 exploited
Review notes Additional details from the official release notes (1) Read note
  • This page The update fixes access to a network resource from a Remote Desktop session only in the specified Remote Credential Guard and Windows 11 client configuration.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 3 changes

Daylight saving time

3 items
  • Daylight saving time changes in Palestine are supported.1
  • Daylight saving time changes in Kazakhstan are supported.2
  • Daylight saving time changes in Samoa are supported.3

Fix 1 change

Remote Desktop

For: Devices using Remote Credential Guard with a Windows 11, version 22H2 or later client

  • A network resource can be accessed from a Remote Desktop session in the affected configuration.4
    Addresses the issue when Remote Credential Guard is enabled and the client runs Windows 11, version 22H2 or higher.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5037763

    Windows devices might face VPN connection failures after installing the update dated April 9, 2024, or later.

    Windows devices might have VPN connection failures after installing the April 9, 2024 update or later. KB5037763 addresses this issue.5

    Resolution Fixed in KB5037763

    Install KB5037763 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Organizations and IT administrators Resolved by KB5037763

    After installing the April 9, 2024 security update on domain controllers (DCs), you might notice a significant increase in [NTLM](https://learn.microsoft.com/windows-server/security/kerberos/ntlm-ove…

    After installing this update on domain controllers, organizations with a very small percentage of primary domain controllers and high NTLM traffic might see a significant increase in NTLM authentication traffic. KB5037763 addresses this issue.6

    Resolution Fixed in KB5037763

    Install KB5037763 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-04-09
Type
Cumulative update
VersionBuildChannel
2016 14393.6897 General availability

Security

66 vulnerabilities fixed
1 exploited 66 important
VulnerabilitySeverityCVSS
CVE-2024-26234 Exploited
Proxy Driver Spoofing Vulnerability
 Important 6.7

The table lists the 1 exploited, publicly disclosed or critical vulnerabilities. See all 66 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This update supports daylight saving time (DST) changes in Palestine. support.microsoft.com
  2. 2. This update supports DST changes in Kazakhstan. support.microsoft.com
  3. 3. This update supports DST changes in Samoa. support.microsoft.com
  4. 4. This update addresses an issue that affects a network resource. You cannot access it from a Remote Desktop session. This occurs when you turn on the Remote Credential Guard feature and the client is Windows 11, version 22H2 or higher. support.microsoft.com
  5. 5. This issue is addressed in KB5037763. support.microsoft.com
  6. 6. After installing the April 9, 2024 security update on domain controllers (DCs), you might notice a significant increase in NTLM authentication traffic. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake