Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5043051

KB5043051: Cumulative update for Windows Server, version 2016, September 2024. Exploited MSHTML spoofing flaw patched; Installer repairs change

In short

Addresses 40 vulnerabilities, including an exploited MSHTML spoofing flaw. It also changes Windows Installer repairs so User Account Control prompts for credentials.

Does it affect you? Applies to: This update applies to Windows Server 2016, OS build 14393.7336.

Build
14393.7336
Security
40 fixed · 1 critical · 3 exploited
Review notes Additional details from the official release notes (1) Read note
  • What changes The update page identifies Linux failing to start in a Windows/Linux dual-boot setup as a known issue.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 2 changes

Windows Installer

For: IT administrators and application owners

  • When Windows Installer repairs an application, User Account Control now prompts for credentials. Automation scripts must be updated, and application owners must add the Shield icon to indicate that the process requires full administrator access.1
    To turn off the prompt, set HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableLUAInRepair to 1. The change might affect automatic Windows Installer repairs.

Dual boot of Windows and Linux

  • Linux might fail to start when Windows and Linux are set up to dual-boot on a device.2
    The error can read “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.” See the guidance for CVE-2022-2601 and CVE-2023-40547.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5044293

    After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization.

    On Windows Servers using Remote Procedure Call over HTTP in Remote Desktop Gateway, remote desktop connections might be interrupted intermittently, such as every 30 minutes. Users lose their logon sessions and must reconnect. KB5044293 resolves this issue.3

    Resolution Fixed in KB5044293

    Install KB5044293 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-09-10
Type
Cumulative update
VersionBuildChannel
2016 14393.7336 General availability

Security

40 vulnerabilities fixed
3 exploited 1 critical 36 important 1 moderate 2 not rated
VulnerabilitySeverityCVSS
CVE-2024-43461 Exploited
Windows MSHTML Platform Spoofing Vulnerability
 Important 8.8
CVE-2024-38014 Exploited
Windows Installer Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-38217 Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
 Important 5.4
CVE-2024-38119
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
 Critical 7.5

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 40 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. After you install this update, the UAC will prompt for them. Because of this, you must update your automation scripts. Application owners must add the Shield icon. It indicates that the process requires full administrator access. support.microsoft.com
  2. 2. [Dual boot of Windows and Linux (known issue)] Linux might fail to start up when you turn on dual-boot setup for Windows and Linux on your device. support.microsoft.com
  3. 3. This issue is addressed in KB5044293. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake