Skip to the content
The Update Bureau
Windows Server 2019 Windows Server 2019 Security update
Patch Tuesday Zero-day

KB5039217

KB5039217: Cumulative update for Windows Server, version 2019, June 2024. Exploited Mark of the Web bypass addressed; LSASS fixes

In short

The update addresses an exploited Mark of the Web security bypass, fixes two LSASS problems, and changes how Windows tags files from untrusted locations.

Does it affect you? Applies to: Devices running Windows Server 2019, build 17763.5936.

Build
17763.5936
Security
32 fixed · 1 critical · 1 exploited

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 3 changes

curl.exe

  • Windows’ curl.exe is updated to version 8.7.1.1

File Explorer

  • Files and folders from untrusted locations get a Mark of the Web tag. This updates the LastWriteTime timestamp and might affect scenarios that rely on file copy operations.2
    MapUrlToZone classifies a file as “Internet” before it receives the Mark of the Web tag.

Servicing stack

For: Windows Server administrators

  • The servicing stack, which installs Windows updates, receives quality improvements.3
    Includes servicing stack update KB5039335, build 17763.5920.

Fixes 2 changes

lsass.exe

2 items

For: Windows Server administrators

  • LSASS stops responding after the April 2024 security updates on Windows servers.4
  • A memory leak during an LSARPC call is addressed.5
    The issue affects lsass.exe during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5040430

    After installing KB5039217, released June 11, 2024, you might observe a chang…

    After installing KB5039217, parts of Windows application menus and dialog buttons might appear in English even when English is not the display language. Font sizes for tab and button names might also change. KB5040430 addresses this issue. It is unlikely to affect Windows Home users; the affected version has supported editions for organizations and IT environments.6

    Resolution Fixed in KB5040430

    Install KB5040430 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-06-11
Type
Cumulative update
VersionBuildChannel
2019 17763.5936 General availability

Security

32 vulnerabilities fixed
1 exploited 1 critical 30 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2024-38213 Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
 Moderate 6.5
CVE-2024-30080
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2023-50868
MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU
 Important 7.5

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 32 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This update affects the version of curl.exe that is in Windows. The version number is now 8.7.1. support.microsoft.com
  2. 2. Starting in this update, File Explorer adds the Mark of the Web (MoTW) tag to files and folders that come from untrusted locations. When MapUrlToZone classifies a file as “Internet,” that file also gets this tag. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. This update addresses an issue that affects lsass.exe. It stops responding. This occurs after you install the April 2024 security updates on Windows servers. support.microsoft.com
  5. 5. This update addresses an issue that affects lsass.exe. It leaks memory. This occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call. support.microsoft.com
  6. 6. This issue is addressed in KB5040430. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake