Skip to the content
The Update Bureau
Windows Server 2019 Windows Server 2019 Security update
Patch Tuesday Zero-day

KB5060531

KB5060531: Cumulative update for Windows Server, version 2019, June 2025. Exploited Internet Shortcut flaw patched; DHCP service issue noted

In short

Closes an actively exploited Internet Shortcut Files flaw and fixes a GDI rendering problem. The DHCP Server service might intermittently stop responding; KB5062557 resolves that issue.

Does it affect you? Applies to: Devices running Windows Server 2019 (x64).

Build
17763.7434
Security
39 fixed · 3 critical · 1 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Fixes 2 changes

GDI and GDI+

  • Some characters no longer appear too wide, and the sample paragraph is no longer broken.1

Windows Hello

For: Windows Hello for Business users

  • The update addresses a sign-in problem for users with self-signed certificates.2
    The issue affects Windows Hello for Business with the Key Trust model.

Improvement 1 change

Servicing stack

  • The servicing stack receives quality improvements to help install Windows updates reliably.3
    The combined package includes servicing stack update KB5058525, build 17763.7313.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5062557

    DHCP Server service

    The DHCP Server service might intermittently stop responding after this update, affecting client IP renewal. KB5062557 resolves the issue.4

    Resolution Fixed in KB5062557

    Install KB5062557 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-06-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5061978, KB5058392, KB5059091, KB5058922
+2 earlier KB5050008, KB5037425
Replaced by
KB5062557
VersionBuildChannel
2019 17763.7434 General availability

Security

39 vulnerabilities fixed
1 exploited 3 critical 36 important
VulnerabilitySeverityCVSS
CVE-2025-33053 Exploited
Internet Shortcut Files Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-33070
Windows Netlogon Elevation of Privilege Vulnerability
 Critical 8.1
CVE-2025-33071
Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-49735
Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability
 Important 8.8

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 39 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2019
701.5 MB
windows10.0-kb5060531-x64.msu Main update · KB5060531 SHA-1: 83789c3b…85ee02

Updated components

393 files changed since the previous update for the same versions.

Top changed componentsFiles
Kernel6
Networking5
Hyper-V and virtualization4
Search4
Secure Boot4
File Explorer and shell3
Graphics and display3
Security and sign-in3
Remote Desktop2
Storage and file systems2
Printing1
Settings1

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. [GDI and GDI+] Fixed: Some characters were rendered wider, and the sample paragraph was broken. support.microsoft.com
  2. 2. [Windows Hello] Fixed: This update addresses an issue that prevents users from signing in with self-signed certificates when using Windows Hello for Business with the Key Trust model. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. This issue was resolved by Windows updates released on and after July 8, 2025 (KB5062557). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake