Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday Zero-day

KB5068861

KB5068861: Cumulative update for Windows Server, version 2025, November 2025. Closes an exploited kernel flaw and adds post-quantum cryptography

In short

Fixes 31 vulnerabilities, including an exploited Windows Kernel elevation-of-privilege flaw, and adds support for two post-quantum cryptography algorithms. WSUS still does not show synchronization error details.

Does it affect you? Applies to: Devices running Windows Server 2025. The available package is for x64.

Build
26100.7171
Security
31 fixed · 2 critical · 1 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 11.

What changes

Fixes 15 changes

Active Directory

2 items
  • Addresses cases where duplicate values in an attribute could lead to replication failures after a schema change.1
    Addresses duplicate entries in multi-valued attributes that require unique values; schema modifications could cause replication failures due to a schema mismatch.
  • Addresses incomplete synchronization of on-premises Active Directory groups with more than 10,000 members.2
    Addresses incomplete synchronization through the DirSync control in AD DS after KB5065426; affected apps include Microsoft Entra Connect Sync.

App compatibility

  • Addresses unexpected User Account Control prompts in some apps, including Autodesk AutoCAD.3
    The page links this issue to unexpected UAC prompts during MSI repair operations.

Authentication

Verified in package
  • Addresses cases where the sign-in security service might stop responding during machine password changes.4
    LSASS might stop responding during machine password changes with specific audit settings.

Desktop icons

  • An updated app icon pinned to the desktop no longer might appear as a white page.5

File Explorer

4 items
  • The full folder-path menu no longer might be cut off at the bottom.6
    Fixes the More options dropdown menu that displays the full list of folders for the current path.
  • File operation progress windows no longer might disappear when shown by apps.7
  • Browsing folders, opening menus, and launching files can be faster when more SharePoint sites are synced.8
    Addresses performance slowdowns while navigating folders or opening context menus after syncing more SharePoint sites to File Explorer.
  • File Explorer Home no longer might show only one folder instead of recent files and other expected content.9

Graphics

  • External graphics cards connected through Thunderbolt are recognized more reliably in some cases.10

Notifications

  • Selecting a Windows notification brings its related app to the foreground more reliably.11
    The page gives Outlook notifications as an example.

Settings

Verified in package
  • Settings no longer might stop responding when you save Wi-Fi network credentials.12

Stability

  • Addresses a rare issue that could leave some devices unresponsive in specific scenarios.13
    The issue was observed after installing the May 2025 security update and subsequent updates.

Windows Firewall

  • Addresses an Event Viewer error that reports a Windows Firewall configuration read failure.14
    Addresses Windows Firewall with Advanced Security Event 2042, “Config Read Failed,” with the message “More data is available.”

Networking

Verified in package
  • HTTP requests with chunk extensions are handled according to the required line-break format, reducing parsing differences when front-end proxies are used.15
    Fixes the HTTP.sys request parser accepting a single line break in HTTP/1.1 chunk extensions instead of requiring a CRLF sequence. The page gives HttpAllowLenientChunkExtParsing under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Http\Parameters, set to 1, to turn off strict parsing.

New features 2 changes

Start menu

  • Administrators can apply Start menu pins once, so users can then change their pinned layout and keep their changes.16
    Adds a Boolean option to the Configure Start Pins policy.

Post-Quantum Cryptography

For: Developers

  • Apps can use two new post-quantum cryptography algorithms for key exchange, signing, and decryption.17
    Adds CNG and .NET API support for NIST ML-KEM and ML-DSA, in accordance with FIPS 203 and FIPS 204.

Improvement 1 change

Servicing stack

  • Includes an update to the component that installs Windows updates, intended to make update installation more reliable.13
    Includes servicing stack update KB5067035, build 26100.7010.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    After KB5070881 or a later update, Windows Server Update Services (WSUS) does not show synchronization error details in its error reporting. The functionality is temporarily removed to address CVE-2025-59287.14

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-11-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5070881, KB5070773, KB5066835, KB5068221
+14 earlier KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5043080, KB5044284
Replaced by
KB5072359
VersionBuildChannel
2025 26100.7171 General availability

Security

31 vulnerabilities fixed
1 exploited 2 critical 29 important
VulnerabilitySeverityCVSS
CVE-2025-62215 Exploited
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2025-60724
Windows GDI+ Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-60716
DirectX Graphics Kernel Elevation of Privilege Vulnerability
 Critical 7.0

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 31 vulnerabilities →

Updated components

5,211 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings74
Graphics and display33
Audio32
Networking30
Bluetooth25
Remote Desktop24
Printing23
Hyper-V and virtualization20
Security and sign-in19
.NET networking17
File Explorer and shell17
Storage and file systems12

Verified in package: changed files confirm Authentication, Settings, Networking.

Sources

Updated
Cited passages from Microsoft's official notes (17)
  1. 1. Fixed: This update addresses an issue in Active Directory where duplicate entries could be added to a multi-valued attribute that requires unique values. support.microsoft.com
  2. 2. This update addresses an issue that could cause incomplete synchronization of large Active Directory groups (over 10,000 members) support.microsoft.com
  3. 3. This update addresses an issue that created unexpected User Account Control (UAC) prompts for some apps, including Autodesk AutoCAD. support.microsoft.com
  4. 4. LSASS might stop responding during machine password changes with specific audit settings. support.microsoft.com
  5. 5. If you have an app pinned to your desktop and it updates, the app icon might not display correctly and instead show a white page. support.microsoft.com
  6. 6. the dropdown menu might not display completely, making the bottom part inaccessible. support.microsoft.com
  7. 7. File operation progress dialogs might stop appearing when displayed from apps. support.microsoft.com
  8. 8. Syncing more SharePoint sites to File Explorer might slow performance when navigating folders or opening the context menu. support.microsoft.com
  9. 9. File Explorer Home might unexpectedly only display a single folder (for example, Desktop), rather than the expected content with recent files and more. support.microsoft.com
  10. 10. An issue where external graphics cards connected through Thunderbolt weren’t always recognized in some cases. support.microsoft.com
  11. 11. When you select a Windows notification, it might not bring the related app to the foreground as expected support.microsoft.com
  12. 12. Settings might stop responding when you try to save Wi-Fi network credentials. support.microsoft.com
  13. 13. This update addresses an issue observed in rare cases after installing the May 2025 security update and subsequent updates causing devices to experience stability issues. support.microsoft.com
  14. 14. After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. support.microsoft.com
  15. 15. Secure Boot certificates used by most Windows devices have started expiring in June 2026. support.microsoft.com
  16. 16. [Start menu] New! We are adding a Boolean option to the Configure Start Pins policy to allow admins to apply Start menu pins once. support.microsoft.com
  17. 17. this update adds API support for NIST post-quantum cryptography algorithms ML-KEM and ML-DSA in accordance with FIPS 203 and FIPS 204 standards. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 17 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake