Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5055521

KB5055521: Cumulative update for Windows Server, version 2016, April 2025. An exploited Common Log File System flaw is patched

In short

Addresses 62 vulnerabilities, including an actively exploited elevation-of-privilege flaw in the Common Log File System Driver. It also adds security and time-zone changes; a Group Policy audit-reporting issue is resolved by KB5058921.

Does it affect you? Applies to: Devices running Windows Server 2016, x64.

Build
14393.7969
Security
62 fixed · 7 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues For devices on an update released before April 11, 2025 that are experiencing this issue, Windows registry adjustments can prevent it. Updates released on or after April 11 do not require a workaround.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 2 changes

Daylight Saving Time (DST)

  • Time-zone support is updated for Chile’s Aysen region to follow the government’s 2025 daylight saving time change.1

Kerberos Authentication

  • Kerberos adds protections for a certificate authority that is in the Windows root store but not the NTAuth store. This might cause Event ID 45 to be logged on a domain controller.2
    The change is enabled by default.

New feature 1 change

OS Security

  • A new %systemdrive%\inetpub folder is created as part of security protections. Do not delete it; no action is needed.3
    The folder is created whether or not Internet Information Services (IIS) is enabled.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5058921

    Active Directory Group Policy: Events in local policy

    Active Directory Group Policy might incorrectly show local Audit Logon/Logoff policies as disabled, even when they are enabled and working. KB5058921 resolves the issue.4

    Resolution Fixed in KB5058921

    Install KB5058921 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-04-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5053594, KB5052006, KB5049993, KB5048671
+2 earlier KB5046612, KB5037423
Replaced by
KB5058921
VersionBuildChannel
2016 14393.7969 General availability

Security

62 vulnerabilities fixed
1 exploited 7 critical 55 important
VulnerabilitySeverityCVSS
CVE-2025-29824 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2023-40547
Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass
 Critical 8.3
CVE-2025-26663
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26670
Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-27480
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-27482
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26686
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-27491
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 7.1

The table lists the 8 exploited, publicly disclosed or critical vulnerabilities. See all 62 vulnerabilities →

Updated components

392 files changed since the previous update for the same versions.

Top changed componentsFiles
WPF13
Networking12
Secure Boot7
Graphics and display6
Hyper-V and virtualization6
Kernel6
Remote Desktop6
File Explorer and shell5
Search5
Security and sign-in5
Storage and file systems3
Settings2

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. [Daylight Saving Time (DST)] Update for the Aysen region in Chile to support the government DST change order in 2025. support.microsoft.com
  2. 2. [Kerberos Authentication] Change of behavior: Adds protections for a vulnerability which occurs when a certificate authority is part of the Windows root store but not the NTAuth store. support.microsoft.com
  3. 3. After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted support.microsoft.com
  4. 4. If you install an update released on or after April 11, 2025, you do not need to use a workaround for this issue. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake