Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday

KB5062560

KB5062560: Cumulative update for Windows Server, version 2016, July 2025. NEGOEX remote-code flaw patched; DHCP server stalls fixed

In short

Fixes DHCP Server stalls that interrupt client IP renewal and hardens Netlogon RPC access. It also addresses 88 vulnerabilities, including five critical ones and the publicly disclosed CVE-2024-21302.

Does it affect you? Applies to: Devices running Windows Server 2016, including Hyper-V Server 2016. The package is for x64 systems.

Build
14393.8246
Security
88 fixed · 5 critical
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Fix 1 change

DHCP Server

  • The DHCP Server service no longer intermittently stops responding and disrupting clients’ IP renewal.1

Improvement 1 change

Microsoft RPC Netlogon protocol

For: Organizations using Active Directory domain controllers

  • Anonymous clients can no longer make some RPC requests through Active Directory domain controllers. Some file and print service software, including Samba, can be affected.2
    Tightens access checks for a set of remote procedure call (RPC) requests, typically related to domain controller location.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5063871

    Microsoft Changjie Input Method Editor

    The Microsoft Changjie IME for Traditional Chinese might fail to form or select words, respond to the Space key, produce correct output, or display conversion candidates. Windows updates released on and after August 12, 2025, including KB5063871, resolve this issue.3

    Resolution Fixed in KB5063871

    Install KB5063871 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-07-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5061010, KB5058383, KB5058921, KB5055521
+6 earlier KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5063871
VersionBuildChannel
2016 14393.8246 General availability

Security

88 vulnerabilities fixed
5 critical 81 important 1 moderate 1 low
VulnerabilitySeverityCVSS
CVE-2025-47981
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-48822
Windows Hyper-V Discrete Device Assignment (DDA) Remote Code Execution Vulnerability
 Critical 8.6
CVE-2025-47980
Windows Imaging Component Information Disclosure Vulnerability
 Critical 6.2
CVE-2024-36350
AMD: CVE-2024-36350 Transient Scheduler Attack in Store Queue
 Critical 5.6
CVE-2024-36357
AMD: CVE-2024-36357 Transient Scheduler Attack in L1 Data Queue
 Critical 5.6
CVE-2024-21302
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Important 6.7

The table lists the 6 exploited, publicly disclosed or critical vulnerabilities. See all 88 vulnerabilities →

Updated components

405 files changed since the previous update for the same versions.

Top changed componentsFiles
Hyper-V and virtualization10
Audio9
Secure Boot9
Graphics and display7
.NET runtime (CLR)6
Security and sign-in6
Kernel4
Remote Desktop4
Search4
Storage and file systems4
File Explorer and shell3
Networking3

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. Fixed: An issue in which the DHCP Server service might intermittently stop responding and affects IP renewal for clients. support.microsoft.com
  2. 2. After this update is installed, Active Directory domain controllers will no longer allow anonymous clients to invoke some RPC requests through the Netlogon RPC server. support.microsoft.com
  3. 3. This issue is resolved by Windows updates released on and after August 12, 2025 support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake