KB5041578: Cumulative update for Windows Server, version 2019, August 2024. Exploited kernel flaws addressed; Linux dual-boot issue reported

Addresses 43 vulnerabilities, including four being exploited and one publicly disclosed. It also reports that some Windows-and-Linux dual-boot devices might fail to start Linux.

Does it affect you? Applies to: This update applies to Windows Server 2019. The listed changes and issues concern devices using features such as BitLocker, DNS, LPD printing, or a Windows-and-Linux dual-boot setup.

Review notes Additional details from the official release notes (1) Read note

What to do The September 2024 update and later updates do not contain the settings that caused the issue. Additional improvements to resolve it were included in the May 2025 update, KB5058392, and later updates.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 6 changes

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

The blocklist includes more drivers at risk of Bring Your Own Vulnerable Driver attacks.¹
Adds drivers to DriverSiPolicy.p7b.

BitLocker

Some devices might show a BitLocker recovery screen at startup after the July 9, 2024 update, especially when device encryption is on.²
Windows might ask for the recovery key from the user's Microsoft account.

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

The update blocks vulnerable Linux EFI bootloaders on systems running Windows. Older Linux ISO images might not boot after the update.³
The SBAT update is not applied when Windows and Linux dual-booting is detected. If an older Linux ISO does not boot, the page advises getting an updated ISO from the Linux vendor.

Domain Name System (DNS)

DNS server security is hardened to address CVE-2024-37968. Out-of-date domain configurations might cause SERVFAIL errors or timeouts.⁴

Line Printer Daemon (LPD) protocol

For: Devices using LPD printing

Printing through the deprecated LPD protocol might not work as expected or might fail after the July 9, 2024 update and later updates.⁵
The page advises UNIX clients to use Internet Printing Protocol (IPP). Windows clients can connect to shared UNIX printers using Windows Standard Port Monitor.

Servicing stack

The servicing stack receives quality improvements to help devices install Windows updates reliably.⁶
The servicing stack update is KB5041577, build 17763.6174.

Removals 2 changes

Lock screen

The “Use my Windows user account” checkbox is no longer available on the lock screen when connecting to Wi-Fi.⁷
This change addresses CVE-2024-38143.

NetJoinLegacyAccountReuse

The NetJoinLegacyAccountReuse registry key is removed.⁸
See KB5020276 for information about domain join hardening changes.

Fix 1 change

Protected Process Light (PPL) protections

Bypassing Protected Process Light protections is addressed.⁹

Known issues

Resolved Affects: Organizations and IT administrators Resolved by KB5044277

After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization.

Remote Desktop connections across an organization might be interrupted after a Windows update released on or after July 9, 2024. This issue can occur intermittently when Remote Desktop Gateway uses the legacy Remote Procedure Call over HTTP protocol; sessions might be lost about every 30 minutes. KB5044277 addresses the issue.¹⁰

Resolution Fixed in KB5044277

Install KB5044277 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Open Affects: Everyone

After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device.

Some devices set up to dual-boot Windows and Linux might fail to start Linux and show “Verifying shim SBAT data failed: Security Policy Violation.” The September 2024 update, KB5043050, no longer contains the settings that caused the issue; KB5058392 and later updates include additional improvements to resolve it.¹¹

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Resolved Affects: Organizations and IT administrators Resolved by KB5043050

After installing this security update, you might observe that some Windows Server 2019 devices experience system slowdowns, unresponsiveness, and high CPU usage particularly with Cryptographic Servic…

Some Windows Server 2019 devices might experience slowdowns, unresponsiveness, or high CPU usage, especially with Cryptographic Services. KB5043050 addresses the issue.¹²

Resolution Fixed in KB5043050

Install KB5043050 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-08-13
Type: Cumulative update

Version	Build	Channel
2019	17763.6189	General availability

Security

43 vulnerabilities fixed

4 exploited 2 critical 41 important

Vulnerability	Severity	CVSS
CVE-2024-38107 Exploited Windows Power Dependency Coordinator Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-38193 Exploited Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-38178 Exploited Scripting Engine Memory Corruption Vulnerability	Important	7.5
CVE-2024-38106 Exploited Windows Kernel Elevation of Privilege Vulnerability	Important	7.0
CVE-2024-38140 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	9.8
CVE-2022-3775 Redhat: CVE-2022-3775 grub2 - Heap based out-of-bounds write when rendering certain Unicode sequences	Critical	7.1
CVE-2024-38199 Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability	Important	9.8

The table lists the 7 exploited, publicly disclosed or critical vulnerabilities. See all 43 vulnerabilities →

Sources

Microsoft Support: KB5041578

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (12)

1. [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
2. [BitLocker (known issue)] A BitLocker recovery screen shows when you start up your device. This occurs after you install the July 9, 2024, update. support.microsoft.com
3. [Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)] This update applies SBAT to systems that run Windows. support.microsoft.com
4. [Domain Name System (DNS)] This update hardens DNS server security to address CVE-2024-37968. support.microsoft.com
5. [Line Printer Daemon (LPD) protocol] Using this deprecated #printing) protocol to print might not work as you expect or fail. support.microsoft.com
6. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
7. [Lock screen] This update addresses CVE-2024-38143. Because of this, the “Use my Windows user account” checkbox is not available on the lock screen to connect to Wi-Fi. support.microsoft.com
8. [NetJoinLegacyAccountReuse] This update removes this registry key. support.microsoft.com
9. [Protected Process Light (PPL) protections] You can bypass them. support.microsoft.com
10. This issue is addressed in KB5044277. support.microsoft.com
11. Additional improvements to resolve this issue were included in the May 2025 Windows security update (KB5058392) and later updates. support.microsoft.com
12. This issue is addressed in KB5043050. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 12 quoted passages · compared with Microsoft's page on Nov 8, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake