KB5051987: Cumulative update for Windows Server, version 2025, February 2025. Exploited storage and networking flaws patched; Remote Desktop issues noted

Fixes 38 vulnerabilities, including two critical flaws and two vulnerabilities already exploited. It also fixes USB audio and camera problems, while known issues affect Citrix update installation, Remote Desktop, and Azure Arc Setup.

Does it affect you? Applies to: Devices running Windows Server 2025. The package listed in the dossier is for x64.

Review notes Additional details from the official release notes (1) Read note

What changes This update fixes the USB audio issue that could stop playback, especially with USB 1.0-based DAC audio drivers.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 11.

What changes

Fixes 2 changes

Digital/Analog converter (DAC)

Verified in package

USB audio devices might stop working and stop playback less often, especially when using a USB 1.0-based DAC audio driver.¹

USB cameras

For: Devices with USB cameras

The device recognizes when the camera is on again. The issue occurred after installing the January 2025 security update.²

Improvements 2 changes

Microsoft RPC Netlogon protocol

The update page now clarifies that Microsoft RPC Netlogon protocol was enabled by default on Windows Server 2025 starting in May 2025.³

Servicing stack

The component that installs Windows updates receives quality improvements.⁴
The combined package includes servicing stack update KB5052085, build 26100.3189.

Known issues

Open Affects: Organizations and IT administrators

Citrix

Devices with Citrix Session Recording Agent (SRA) version 2411 might fail to complete installation of the January 2025 Windows security update and revert to their previous updates. The issue is resolved with Citrix SRA version 2503 or newer.⁵

How to apply the workaround Workaround

Update Citrix SRA to version 2503 or newer.⁵
Open Affects: Everyone

Remote desktop

Remote Desktop sessions on Windows Server 2025 might freeze shortly after connection, making mouse and keyboard input unresponsive. Remote Desktop sessions might also disconnect unexpectedly, including Windows 11 version 24H2 clients connecting to Remote Desktop Services on Windows Server 2016 or earlier; Windows Server 2025 is not affected as an RDS host but might disconnect as a client to older servers. KB5055523 resolves the freeze, and KB5053656 addresses the disconnection issue.⁶

How to apply the workaround Group Policy

For enterprise-managed devices with the disconnection issue and an update older than March 27, 2025, configure the special Group Policy and restart the devices. Devices with the March 27, 2025 update or later do not need this policy or a Known Issue Rollback.⁶
Step-by-step workaround instructions
3 steps

Show steps Hide steps
Step-by-step procedure
1. For affected enterprise-managed devices updated before March 27, 2025, obtain the special Group Policy for Windows 11 version 24H2 and Windows Server 2025.
2. Configure it under Computer Configuration > Administrative Templates.
3. Restart the affected devices.
Open Affects: Everyone

Azure Arc Setup wizard app

The Azure Arc Setup wizard might stop responding when opened from the Start menu or taskbar. KB5055523 and later updates resolve this issue.⁷

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-02-11
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5050009, KB5048667, KB5046617, KB5043080, KB5044284
Replaced by: KB5053598

Version	Build	Channel
2025	26100.3194	General availability

Security

38 vulnerabilities fixed

2 exploited 2 critical 36 important

Vulnerability	Severity	CVSS
CVE-2025-21418 Exploited Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8
CVE-2025-21391 Exploited Windows Storage Elevation of Privilege Vulnerability	Important	7.1
CVE-2025-21376 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability	Critical	8.1
CVE-2025-21379 DHCP Client Service Remote Code Execution Vulnerability	Critical	7.1
CVE-2025-21377 NTLM Hash Disclosure Spoofing Vulnerability	Important	6.5

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 38 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2025

1.1 GB

windows11.0-kb5051987-x64.msu Main update · KB5051987 SHA-1: 199ed780…f71972 windows11.0-kb5043080-x64.msu Prerequisite · KB5043080 SHA-1: 95344967…9c83e8

Updated components

7,281 files changed since the previous update for the same versions.

Top changed components	Files
Settings	128
Graphics and display	55
Bluetooth	53
Hyper-V and virtualization	46
Networking	44
Printing	42
Security and sign-in	40
Audio	38
Remote Desktop	36
Windows Update	34
File Explorer and shell	30
.NET networking	24

Verified in package: changed files confirm Digital/Analog converter (DAC).

Sources

Microsoft Support: KB5051987

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (7)

1. Fixed: You might experience issues with USB audio devices. This is more likely when you use a DAC audio driver based on USB 1.0. support.microsoft.com
2. Fixed: Your device does not recognize the camera is on. This issue occurs after you install the January 2025 security update. support.microsoft.com
3. Correction: Microsoft RPC Netlogon protocol was enabled by default on Windows Server 2025 starting in May 2025. support.microsoft.com
4. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
5. Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. This issue was observed on devices with Citrix Session Recording Agent (SRA) version 2411. support.microsoft.com
6. After installing the February 2025 Security update (KB5051987), released February 11, 2025, and later updates, on Windows Server 2025 devices, you might experience Remote Desktop sessions freezing shortly after connection. support.microsoft.com
7. After installing this update, you might face issues with the Azure Arc Setup wizard application. You might notice that the Azure Arc Setup wizard app stops responding when you are trying to launch it from either the Windows Start menu or the Taskbar. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake