Skip to the content
The Update Bureau
Windows Server 2019 Windows Server 2019 Security update
Patch Tuesday Zero-day

KB5055519

KB5055519: Cumulative update for Windows Server, version 2019, April 2025. Exploited log file driver flaw patched; Hello sign-in tightened

In short

The update addresses 75 vulnerabilities, including the exploited CVE-2025-29824, and requires a color camera for Windows Hello facial recognition. It has not been available since March 31, 2026.

Does it affect you? Applies to: Devices running Windows Server 2019.

Build
17763.7136
Security
75 fixed · 7 critical · 1 exploited

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 5 changes

Daylight Saving Time (DST)

  • Daylight saving time support is updated for Chile’s Aysen region to follow the government’s 2025 change order.1

OS Security

  • A new %systemdrive%\inetpub folder is created for protection purposes. Do not delete it, whether or not IIS is enabled.2
    The folder is created after installing this update or a later Windows update.

Kerberos Authentication

  • Kerberos adds protections for a certificate authority that is in the Windows root store but not the NTAuth store. Domain controllers might log Event ID 45.3
    The change is enabled by default.

Windows Hello

  • Windows Hello facial recognition requires a color camera to see a visible face during sign-in.4

Servicing stack

  • The servicing stack receives quality improvements to help make installing Windows updates more reliable.5
    KB5055662 (build 17763.7125) is combined with this cumulative update.

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Devices with Citrix Session Recording Agent version 2411 might fail to complete installation of the January 2025 Windows security update and revert to their previous updates. Home users are not expected to be affected.6

    How to apply the workaround Workaround

    Update Citrix Session Recording Agent to version 2503 or newer.6

  2. Resolved Affects: Organizations and IT administrators Resolved by KB5058922

    Active Directory Group Policy: Events in local policy

    The Local Group Policy Editor or Local Security Policy might show “Audit logon events” as “No auditing” even when logon events are being audited. KB5058922 resolves this reporting inconsistency.7

    Resolution Fixed in KB5058922

    Install KB5058922 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-04-08
Type
Cumulative update
VersionBuildChannel
2019 17763.7136 General availability

Security

75 vulnerabilities fixed
1 exploited 7 critical 68 important
VulnerabilitySeverityCVSS
CVE-2025-29824 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2023-40547
Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass
 Critical 8.3
CVE-2025-26663
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26670
Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-27480
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-27482
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26686
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-27491
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 7.1

The table lists the 8 exploited, publicly disclosed or critical vulnerabilities. See all 75 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. [Daylight Saving Time (DST)] Update for the Aysen region in Chile to support the government DST change order in 2025. support.microsoft.com
  2. 2. After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device. support.microsoft.com
  3. 3. [Kerberos Authentication] Change of behavior: Adds protections for a vulnerability which occurs when a certificate authority is part of the Windows root store but not the NTAuth store. This change enabled by default might cause Event ID: 45 events to be logged on the domain controller. support.microsoft.com
  4. 4. [Windows Hello] After installing this update or a later Windows update, for enhanced security, Windows Hello facial recognition requires color cameras to see a visible face when signing in. support.microsoft.com
  5. 5. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  6. 6. Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. support.microsoft.com
  7. 7. This issue is resolved in the April 11, 2025—KB5058922 (OS Build 17763.7240) Out-of-band update. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake