Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5039214

KB5039214: Cumulative update for Windows Server, version 2016, June 2024. Exploited Mark of the Web flaw addressed; LSASS issues fixed

In short

Addresses an exploited Mark of the Web security flaw and two LSASS problems on Windows servers. It also changes how files from untrusted locations are tagged.

Does it affect you? Applies to: Devices running Windows Server 2016.

Build
14393.7070
Security
28 fixed · 1 critical · 1 exploited

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Fixes 2 changes

lsass.exe

2 items
  • LSASS stops responding on Windows servers after the April 2024 security updates.1
  • LSASS leaks memory during a Local Security Authority (Domain Policy) Remote Protocol call.2
    The memory leak occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call.

Improvement 1 change

File Explorer

  • Files and folders from untrusted locations get a Mark of the Web tag. Their LastWriteTime timestamp is updated, which might affect some file-copy scenarios.3
    When MapUrlToZone classifies a file as “Internet,” that file also gets the Mark of the Web tag.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-06-11
Type
Cumulative update
VersionBuildChannel
2016 14393.7070 General availability

Security

28 vulnerabilities fixed
1 exploited 1 critical 26 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2024-38213 Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
 Moderate 6.5
CVE-2024-30080
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-30068
Windows Kernel Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-30078
Windows Wi-Fi Driver Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-30097
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-30077
Windows OLE Remote Code Execution Vulnerability
 Important 8.0
CVE-2024-30062
Windows Standards-Based Storage Management Service Remote Code Execution Vulnerability
 Important 7.8
CVE-2024-30082
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30086
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30087
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30091
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30094
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 7.8
CVE-2024-30095
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 7.8
CVE-2024-35250
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2023-50868
MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU
 Important 7.5
CVE-2024-30070
DHCP Server Service Denial of Service Vulnerability
 Important 7.5
CVE-2024-30083
Windows Standards-Based Storage Management Service Denial of Service Vulnerability
 Important 7.5
CVE-2024-30093
Windows Storage Elevation of Privilege Vulnerability
 Important 7.3
CVE-2024-30084
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30088
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30090
Microsoft Streaming Service Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30099
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30076
Windows Container Manager Service Elevation of Privilege Vulnerability
 Important 6.8
CVE-2024-30063
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
 Important 6.7
CVE-2024-30065
Windows Themes Denial of Service Vulnerability
 Important 5.5
CVE-2024-30066
Winlogon Elevation of Privilege Vulnerability
 Important 5.5
CVE-2024-30067
Winlogon Elevation of Privilege Vulnerability
 Important 5.5
CVE-2024-30069
Windows Remote Access Connection Manager Information Disclosure Vulnerability
 Important 4.7

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. This update addresses an issue that affects lsass.exe. It stops responding. This occurs after you install the April 2024 security updates on Windows servers. support.microsoft.com
  2. 2. This update addresses an issue that affects lsass.exe. It leaks memory. This occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call. support.microsoft.com
  3. 3. When MapUrlToZone classifies a file as “Internet,” that file also gets this tag. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake