Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5037763

KB5037763: Cumulative update for Windows Server, version 2016, May 2024. Exploited MSHTML and DWM flaws addressed; update expired

In short

Addresses 34 vulnerabilities, including two exploited flaws in MSHTML and DWM Core. It is no longer available from Microsoft’s release channels as of March 31, 2026.

Does it affect you? Applies to: Devices running Windows Server 2016.

Build
14393.6981
Security
34 fixed · 2 exploited

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Fixes 3 changes

VPN

  • Addresses a problem that might cause VPN connections to fail after the update dated April 9, 2024, or later.1

Domain controllers

For: domain controllers

  • Addresses a domain controller issue that might increase NTLM authentication traffic.2

Virtual Secure Mode

  • Addresses failures in Virtual Secure Mode scenarios, including VPN, Windows Hello, Credential Guard, and Key Guard.3

Improvements 2 changes

General

For: devices using Croatian currency

  • Supports Croatia’s change of currency from the kuna to the euro.4

DNS Server

For: DNS Server administrators

  • Limits NSEC3 validation in a recursive resolver to 1,000 computations by default.5
    DNS Server administrators can change \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\MaxComputationForNsec3Validation. The minimum is 1 and the maximum is 9600.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-05-14
Type
Cumulative update
VersionBuildChannel
2016 14393.6981 General availability

Security

34 vulnerabilities fixed
2 exploited 33 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2024-30040 Exploited
Windows MSHTML Platform Security Feature Bypass Vulnerability
 Important 8.8
CVE-2024-30051 Exploited
Windows DWM Core Library Elevation of Privilege Vulnerability
 Important 7.8

The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 34 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. This update addresses a known issue that might cause your VPN connection to fail. This occurs after you install the update dated April 9, 2024, or later. support.microsoft.com
  2. 2. This update addresses a known issue that might affect domain controllers (DC). NTLM authentication traffic might increase. support.microsoft.com
  3. 3. This update addresses an issue that might affect Virtual Secure Mode (VSM) scenarios. They might fail. These scenarios include VPN, Windows Hello, Credential Guard, and Key Guard. support.microsoft.com
  4. 4. This update supports the currency change in Croatia from the kuna to the euro. support.microsoft.com
  5. 5. Its limit is now 1,000 computations. One computation is equal to the validation of one label with one iteration. DNS Server Administrators can change the default number of computations. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake