Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5040434

KB5040434: Cumulative update for Windows Server, version 2016, July 2024. Exploited MSHTML spoofing flaw addressed; BitLocker profile changes

In short

Addresses an actively exploited MSHTML Platform spoofing flaw and changes the default BitLocker Secure Boot validation profile. It also updates the setup requirements for remote shortcut icons.

Does it affect you? Applies to: Devices running Windows Server 2016.

Build
14393.7159
Security
81 fixed · 4 critical · 1 exploited

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 4 changes

Republic of Turkey name

  • The country's new official name is the Republic of Türkiye.1

Remote Authentication Dial-In User Service (RADIUS) protocol

  • The RADIUS protocol note says the issue is related to MD5 collisions and links to KB5040268 for more information.2

BitLocker

  • The default Secure Boot validation profile includes PCR 4, 7, and 11.3
    Adds PCR 4 to PCR 7 and 11 for the default Secure Boot validation profile.

File shortcut icons

  • Remote shortcut icons require a policy setting; without it, icons on the Start menu, desktop, and taskbar might fail to render after this update or later updates.4
    Configure the policy “Allow the use of remote paths in file shortcut icons” to set up remote paths for .LNK file icons.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5044293

    After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization.

    On Windows Servers using the legacy Remote Procedure Call over HTTP protocol in Remote Desktop Gateway, connections might be interrupted intermittently and users might need to reconnect. KB5044293 resolves this issue.5

    Resolution Fixed in KB5044293

    Install KB5044293 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Everyone Resolved by KB5041773

    After installing the July 9, 2024, Windows security update, you might see a [BitLocker recovery](https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recov…

    A BitLocker recovery screen might appear when the device starts after this update, especially when Device Encryption is enabled. KB5041773 resolves this issue.6

    Resolution Fixed in KB5041773

    Install KB5041773 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-07-09
Type
Cumulative update
VersionBuildChannel
2016 14393.7159 General availability

Security

81 vulnerabilities fixed
1 exploited 4 critical 75 important 2 moderate
VulnerabilitySeverityCVSS
CVE-2024-38112 Exploited
Windows MSHTML Platform Spoofing Vulnerability
 Important 7.5
CVE-2024-38074
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-38076
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-38077
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-38060
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 81 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. [Republic of Turkey name] The new, official name is the Republic of Türkiye. support.microsoft.com
  2. 2. [Remote Authentication Dial-In User Service (RADIUS) protocol] This issue is related to MD5 collisions. For more information, see KB5040268. support.microsoft.com
  3. 3. [BitLocker] This update adds PCR 4 to PCR 7 and 11 for the default Secure Boot validation profile. support.microsoft.com
  4. 4. The set up now requires that you configure the policy “Allow the use of remote paths in file shortcut icons”. support.microsoft.com
  5. 5. This issue is addressed in KB5044293. support.microsoft.com
  6. 6. This issue is addressed in KB5041773. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake