Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5058383

KB5058383: Cumulative update for Windows Server, version 2016, May 2025. Exploited scripting and driver flaws patched

In short

Fixes 39 vulnerabilities, including five critical ones, and improves Secure Boot detection of Linux systems. Four vulnerabilities were already being exploited.

Does it affect you? Applies to: Devices running Windows Server 2016. The update installs build 14393.8066.

Build
14393.8066
Security
39 fixed · 5 critical · 4 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvement 1 change

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

Verified in package
  • Secure Boot improves detection of Linux systems.1
    The update applies improvements to SBAT for Linux system detection.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-05-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5058921, KB5055521, KB5053594, KB5052006
+4 earlier KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5061010
VersionBuildChannel
2016 14393.8066 General availability

Security

39 vulnerabilities fixed
4 exploited 5 critical 34 important
VulnerabilitySeverityCVSS
CVE-2025-32701 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32706 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32709 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-30397 Exploited
Scripting Engine Memory Corruption Vulnerability
 Important 7.5
CVE-2025-29966
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-29967
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2024-49128
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-32710
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-29833
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
 Critical 7.7

The table lists the 9 exploited, publicly disclosed or critical vulnerabilities. See all 39 vulnerabilities →

Updated components

275 files changed since the previous update for the same versions.

Top changed componentsFiles
Bluetooth12
Hyper-V and virtualization7
Secure Boot7
Remote Desktop6
Kernel5
Networking4
File Explorer and shell3
Security and sign-in3
Settings2
Storage and file systems2
Audio1

Verified in package: changed files confirm Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI).

Sources

Updated
Cited passages from Microsoft's official notes (1)
  1. 1. [Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)] This update applies improvements to SBAT for the detection of Linux systems. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake