Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5066836

KB5066836: Cumulative update for Windows Server, version 2016, October 2025. Exploited modem and Remote Access flaws addressed

In short

Addresses exploited Windows modem and Remote Access flaws, fixes WinRM timeouts, and removes support for a fax modem driver. File Explorer also disables previews for files downloaded from the internet.

Does it affect you? Applies to: Devices running Windows Server 2016, including Hyper-V Server 2016. The update package is for x64 systems.

Build
14393.8519
Security
77 fixed · 1 critical · 3 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Fixes 2 changes

Windows Remote Management (WinRM)

  • PowerShell Remoting and WinRM commands no longer time out after 600 seconds.1

Stability issue

  • The update addresses a rare issue that could make some devices unresponsive in specific scenarios after the May 2025 security update and later updates.2

Improvements 2 changes

Cryptography

  • RSA-based smart card certificates now require Key Storage Provider instead of Cryptographic Service Provider. Smart card authentication might be affected.3
    Enforces the use of Key Storage Provider (KSP) instead of Cryptographic Service Provider (CSP) for RSA-based smart card certificates.

File Explorer

  • File Explorer automatically disables previews for files downloaded from the internet.4
    The change is intended to prevent a vulnerability when users preview potentially unsafe files.

Removal 1 change

Fax modem driver

For: Devices using fax modem hardware dependent on this driver

  • Fax modem hardware that depends on the removed driver no longer works in Windows.5
    Removes the ltmdm64.sys driver.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-10-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5065427, KB5063871, KB5062560, KB5061010
+9 earlier KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5070882
VersionBuildChannel
2016 14393.8519 General availability

Security

77 vulnerabilities fixed
3 exploited 1 critical 76 important
VulnerabilitySeverityCVSS
CVE-2025-24990 Exploited
Windows Agere Modem Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-59230 Exploited
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-47827 Exploited
MITRE CVE-2025-47827: Secure Boot bypass in IGEL OS before 11
 Important 4.6
CVE-2016-9535
MITRE CVE-2016-9535: LibTIFF Heap Buffer Overflow Vulnerability
 Critical 4.0
CVE-2025-24052
Windows Agere Modem Driver Elevation of Privilege Vulnerability
 Important 7.8

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 77 vulnerabilities →

Updated components

420 files changed since the previous update for the same versions.

Top changed componentsFiles
WPF11
Graphics and display9
Audio8
Hyper-V and virtualization8
Networking8
ASP.NET5
Remote Desktop5
Kernel4
Search4
Secure Boot4
Storage and file systems4
File Explorer and shell3

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. [Windows Remote Management (WinRM)] Fixed: An issue that affects PowerShell Remoting and WinRM in which commands time out after 600 seconds. support.microsoft.com
  2. 2. [Stability issue] Fixed: This update addresses an issue observed in rare cases after installing the May 2025 security update and subsequent updates causing devices to experience stability issues. support.microsoft.com
  3. 3. [Cryptography] This update enforces a security hardening improvement by requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. support.microsoft.com
  4. 4. [File Explorer] After installing this update, File Explorer automatically disables the preview feature for files downloaded from the internet. support.microsoft.com
  5. 5. [Fax modem driver] This update removes the ltmdm64.sys driver. Fax modem hardware dependent on this specific driver will no longer work in Windows. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake