Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday

KB5062553

KB5062553

Cumulative update for Windows Server, version 2025, July 2025

In short

Critical flaws in NEGOEX and Hyper-V are among the security fixes. The update also fixes issues with authentication, graphics, and other server features.

Does it affect you? Applies to: Devices running Windows Server 2025, including x64 systems. The update installs build 26100.4652.

Build
26100.4652
Security
102 fixed · 5 critical
Restart
Required
Review notes Additional details from the official release notes (6) Read notes
  • What changes The update fixes prolonged execution by the MsiCloseHandle API when it handles MSI files containing many files.
  • What changes The FIDO Cached Credential Logon issue affects certain Hybrid Domain Joined devices.
  • What changes The unexpected lockout after a password change could occur when the account lockout policy is enabled.
  • What changes The update fixes an issue where the DHCP Server service might intermittently stop responding and affect clients’ IP renewals.
  • Known issues When this schema issue occurs, Active Directory replication can fail across the enterprise because domain controllers have inconsistent schemas.
  • What changes On June 3, 2026, Microsoft corrected the x64 .msu update string on the Catalog tab for KB5062553.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 11.

What changes

Fixes 21 changes

Application installation

  • Installing apps with many files takes less time in some cases.1
    Fixes prolonged execution time in the MsiCloseHandle API when handling MSI files containing many files.

Authentication

3 items
  • Kerberos authentication no longer stops responding in some cases when RC4 encryption is used.2
    Fixes Kerberos authentication becoming unresponsive in certain scenarios when RC4 is used for encryption.
  • FIDO sign-in with cached credentials no longer stops responding in some cases.3
    Fixes FIDO Cached Credential Logon becoming unresponsive in certain cases on Hybrid Domain Joined devices.
  • Opening some apps after a password change no longer causes an unexpected account lockout.4
    Fixes unexpected lockouts after a password change when the account lockout policy is enabled.

Boot menu

  • A failed update rollback no longer leaves a new, unusable boot menu entry.5
    Stops devices from encountering this issue in the future. Existing extra boot entries can be managed in the Boot section of System Configuration (msconfig).

Color profile

Verified in package 2 items
  • The expected color profiles appear for the selected monitor.6
    Fixes the color profile list not displaying as expected under Settings > System > Display > Color profile > Color management.
  • Color profile settings apply after the PC wakes from sleep.7
    Fixes color profile settings not being applied after resuming from sleep.

Cryptography

  • Certificates and keys can be shared through Active Directory again when Credential Roaming is used.8
    Addresses an issue impacting Credential Roaming that prevented certificates and keys from being roamed into Active Directory and made available on users' machines.

Direct 3D Ecosystem

Verified in package
  • Some third-party apps no longer stop responding on the graphics settings page.9
    Addresses an issue where certain third-party apps might stop responding on the graphics settings page.

File Explorer

  • The See more menu in File Explorer opens in the right direction.10
    Fixes cases where the See more menu in the File Explorer command bar opens in the wrong direction.

General reliability

  • The PC is less likely to show a blue screen when it wakes from sleep.11
    Fixes an underlying issue that might cause a PDC_WATCHDOG_TIMEOUT bugcheck when resuming from sleep.

Graphics

Verified in package
  • Some third-party apps no longer make the graphics settings page stop responding.12
    Fixes an issue where certain third-party apps might render the graphics settings page unresponsive.

Input

2 items
  • Typing is less likely to be interrupted by an input system restart.13
    Improves ctfmon.exe reliability by addressing a system restart that could impact typing.
  • ctfmon.exe no longer restarts when copying data from some apps.14
    Fixes ctfmon.exe restarting when copying data from certain apps.

Local Administrator Password Solution (LAPS)

Verified in package

For: IT administrators using Windows LAPS

  • LAPS settings remain in place after an in-place upgrade.15
    Addresses an issue where Windows LAPS settings were not preserved after an in-place upgrade.

Network

  • The virtual network adapter description appears correctly in Network Connections.16
    Fixes invalid characters in the virtual NIC description shown in Network Connections (ncpa.cpl).

OOBE

For: devices configured to run ESP by policy

  • The Enrollment Status Page runs each time a new user signs in when policy requires it.17
    Addresses an issue that prevented the ESP from running every time a new user logged onto the device, even when configured by policy.

PowerShell

For: devices using WDAC policies

  • Required PowerShell modules run under policies that control which apps can run.18
    Resolves an issue where critical PowerShell modules required for device configuration were not run under Windows Defender Application Control (WDAC) policies.

Remote desktop

Verified in package
  • Remote Desktop can use UDP instead of being limited to TCP.19
    Fixes Remote Desktop using only TCP and not UDP.

Screen orientation

For: 2-in-1 devices

  • The screen is less likely to change direction unexpectedly after a 2-in-1 device wakes from sleep.20
    Fixes unexpected screen orientation changes coming out of sleep on 2-in-1 devices.

DHCP Server (known issue)

  • When the DHCP Server service stops responding, it affects clients' ability to renew IP addresses less often.21
    Fixes an issue in which the DHCP Server service might intermittently stop responding and affect IP renewal for clients.

Improvements 2 changes

Task manager

  • Task Manager uses consistent CPU workload measures on its Processes, Performance, and Users pages.22
    CPU usage is calculated differently for Processes, Performance, and Users. The Details tab has an optional, hidden-by-default CPU Utility column showing the previous Processes page value.

Servicing stack

  • The component that installs Windows updates gets quality improvements.23
    Includes the Windows Server 2025 servicing stack update KB5063666, build 26100.4651.

Known issues

  1. Open Affects: Organizations and IT administrators

    Active Directory Replication

    On Windows Server 2025 domain controllers that hold the schema master role, duplicate schema object entries might cause Active Directory replication to fail with a schema mismatch. The issue can appear during Exchange Server setup forestprep and can affect replication across the enterprise.24

    How to apply the workaround Workaround

    KB5068861 is listed as addressing this issue.24

  2. Open Affects: Everyone

    Microsoft Changjie Input Method Editor

    After installing this update, the Microsoft Changjie IME for Traditional Chinese might not form or select words, respond to the spacebar, show correct word output, or display conversion choices properly.25

    How to apply the workaround Workaround

    KB5063878 is listed as addressing this issue.25

  3. Open Affects: Organizations and IT administrators

    Azure VM with Trusted Launch disabled

    A small subset of Generation 2 Azure VMs might not boot after this update. The risk applies when Trusted Launch is disabled and VBS is enforced through a registry key.26

    How to apply the workaround Workaround

    KB5064489 is listed as addressing this issue.26

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-07-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5060842, KB5058411, KB5055523, KB5053598
+6 earlier KB5051987, KB5050009, KB5048667, KB5046617, KB5043080, KB5044284
Replaced by
KB5064489
VersionBuildChannel
2025 26100.4652 General availability

Security

102 vulnerabilities fixed
5 critical 95 important 1 moderate 1 low
VulnerabilitySeverityCVSS
CVE-2025-47981
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-48822
Windows Hyper-V Discrete Device Assignment (DDA) Remote Code Execution Vulnerability
 Critical 8.6
CVE-2025-47980
Windows Imaging Component Information Disclosure Vulnerability
 Critical 6.2
CVE-2024-36350
AMD: CVE-2024-36350 Transient Scheduler Attack in Store Queue
 Critical 5.6
CVE-2024-36357
AMD: CVE-2024-36357 Transient Scheduler Attack in L1 Data Queue
 Critical 5.6

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 102 vulnerabilities →

Updated components

7,288 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings144
Graphics and display55
Bluetooth45
Networking42
Printing40
Remote Desktop40
Audio39
.NET networking38
File Explorer and shell31
Storage and file systems31
Hyper-V and virtualization30
Security and sign-in29

Verified in package: changed files confirm Color profile, Direct 3D Ecosystem, Graphics, Local Administrator Password Solution (LAPS), Remote desktop.

Sources

Updated
Cited passages from Microsoft's official notes (26)
  1. 1. [Application installation] Fixed: The MsiCloseHandle API experiences prolonged execution time when handling MSI files containing a large number of files. support.microsoft.com
  2. 2. Fixed: Kerberos authentication stops responding in certain scenarios when RC4 is used for encryption. support.microsoft.com
  3. 3. Fixed: FIDO Cached Credential Logon might stop responding in certain cases when a device is Hybrid Domain Joined. support.microsoft.com
  4. 4. Opening certain apps after a password change could result in an unexpected lockout if the account lockout policy is enabled. support.microsoft.com
  5. 5. If an update stops responding and rolls back, it might result in an unnecessary and non-functional boot menu entry. support.microsoft.com
  6. 6. Under Settings > System > Display > Color profile, go to Color management, it might not display the expected color profile list for the selected monitor. support.microsoft.com
  7. 7. The color profile settings might not be applied after resuming from sleep. support.microsoft.com
  8. 8. This update addresses an issue that was impacting Credential Roaming, preventing certificates and keys from being roamed into Active Directory and made available on users' machines. support.microsoft.com
  9. 9. This update addresses an issue where certain third-party apps might stop responding on the graphics settings page. support.microsoft.com
  10. 10. In some cases, the See more menu in the File Explorer command bar opens in the wrong direction. support.microsoft.com
  11. 11. An underlying issue might lead to your PC experiencing a bugcheck (blue screen) with PDC_WATCHDOG_TIMEOUT when resuming from sleep. support.microsoft.com
  12. 12. There is an issue where certain third-party apps might render the graphics settings page unresponsive. support.microsoft.com
  13. 13. Improved ctfmon.exe reliability, by addressing a system restart which could impact typing. support.microsoft.com
  14. 14. ctfmon.exe might restart when copying data from certain apps. support.microsoft.com
  15. 15. This update addresses an issue with Windows LAPS. LAPS settings would not be preserved after an in-place upgrade. support.microsoft.com
  16. 16. The description of the virtual NIC doesn't display correctly in Network Connections (ncpa.cpl), showing invalid characters. support.microsoft.com
  17. 17. Addresses an issue that prevents the ESP from running every time a new user logs onto the device even when configured by policy. support.microsoft.com
  18. 18. This update resolves an issue where critical PowerShell modules required for device configuration weren't run under Windows Defender Application Control (WDAC) policies. support.microsoft.com
  19. 19. Remote Desktop won't use UDP, only TCP. support.microsoft.com
  20. 20. Screen might unexpectedly change orientation coming out of sleep on 2-in-1 devices. support.microsoft.com
  21. 21. An issue in which the DHCP Server service might intermittently stop responding and affects IP renewal for clients. support.microsoft.com
  22. 22. To ensure backward compatibility, an optional column named CPU Utility is available (hidden by default) on the Details tab, showing the previous CPU value from the Processes page. support.microsoft.com
  23. 23. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  24. 24. This issue can be observed when running Exchange Server setup forestprep and the schema master role for Active Directory is running Windows Server 2025. support.microsoft.com
  25. 25. Inability to form or select words after typing the full composition (associate phrase window). Spacebar or blank key not responding. Incorrect or distorted word outputs. The conversion candidate window fails to display properly. support.microsoft.com
  26. 26. A small subset of Generation 2 Azure Virtual Machines (VMs) with Trusted Launch disabled, and Virtualization-Based Security (VBS) enforced via registry key might be unable to boot after installing this update. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 26 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake