Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Out-of-band security update
Out-of-band

KB5070881

KB5070881: Cumulative update for Windows Server, version 2025, October 2025. WSUS remote-code flaw patched; error details temporarily disappear

In short

The WSUS remote code execution flaw CVE-2025-59287 gets a patch. WSUS synchronization error details are temporarily unavailable, and a small number of Hotpatch servers may miss updates.

Does it affect you? Applies to: Devices running Windows Server 2025, x64. A Hotpatch issue affects a very limited number of Windows Server 2025 devices and virtual machines enrolled for Hotpatch that received this update.

Build
26100.6905
Security
1 fixed · 1 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • In short Machines that installed this update will not be offered Hotpatch updates in November and December. They will instead be offered regular monthly security updates that require a restart.
  • Known issues Only Hotpatch-enrolled machines that installed this update miss Hotpatch updates in November and December and are offered regular monthly security updates instead. Machines that downloaded but did not install it can get the correct update and remain on the Hotpatch train.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 11.

What changes

Fix 1 change

Windows Server Update Services (WSUS)

  • WSUS reporting web services get a fix for a remote code execution flaw.1
    Addresses CVE-2025-59287 in WSUS reporting web services.

Improvement 1 change

Servicing stack

  • The component that installs Windows updates gets quality improvements.2
    Servicing stack update KB5067360, build 26100.6893.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    After installing this update or a later one, WSUS does not show synchronization error details. Microsoft temporarily removed this function to address the remote code execution vulnerability.3

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Active Directory Replication

    On Windows Server 2025 domain controllers with the schema master role, duplicate schema entries can cause Active Directory replication errors. This remains listed as an open issue here; the page points to KB5068861 as addressing it.4

    How to apply the workaround Workaround

    The page points to KB5068861 as addressing the issue.4

  3. Open Affects: Organizations and IT administrators

    Directory synchronization (DirSync)

    After the September 2025 security update, apps using the DirSync control for on-premises AD DS can miss members when syncing groups with more than 10,000 members. This remains listed as open here; the page points to KB5068861 as addressing it.5

    How to apply the workaround Workaround

    The page points to KB5068861 as addressing the issue.5

  4. Open Affects: Organizations and IT administrators

    IIS websites might fail to load

    The IIS connection failure described for the October update does not affect Windows Server 2025. It affects only Windows 11, versions 25H2 and 24H2.6

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  5. Open Affects: Organizations and IT administrators

    Some machines enrolled for Hotpatch might temporarily lose Hotpatch status

    A very limited number of Hotpatch-enrolled Windows Server 2025 machines received this update. Those machines temporarily lose Hotpatch updates and get regular monthly updates that require a restart in November and December; the January 2026 baseline restores Hotpatch eligibility.7

    How to apply the workaround Workaround

    If the machine installed this update, install the regular monthly updates in November and December, then the January 2026 baseline. If it downloaded but has not installed the update, pause updates, resume them, and scan again.7

    Step-by-step workaround instructions
    2 steps
    Show steps Hide steps
    Step-by-step procedure
    1. For a machine that downloaded but has not installed the update, open Settings > Windows Update and select Pause updates.
    2. Resume updates, then scan for updates again.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-10-23
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5070773, KB5066835, KB5068221, KB5065426
+13 earlier KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5043080, KB5044284
Replaced by
KB5068861
VersionBuildChannel
2025 26100.6905 General availability

Security

1 vulnerability fixed
1 critical
VulnerabilitySeverityCVSS
CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
 Critical 9.8

Updated components

328 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display9
Kernel5
Secure Boot4
Hyper-V and virtualization3
Networking3
Security and sign-in3
Windows Update2
File Explorer and shell1
Settings1

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. Fixed: This update addresses a remote code execution (RCE) vulnerability that was identified in WSUS reporting web services. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
  4. 4. When this occurs, Active Directory replication fails with a schema mismatch error, such as error 8418: The replication operation failed because of a schema mismatch between the servers involved. support.microsoft.com
  5. 5. applications that use the Active Directory directory synchronization (DirSync) control for on-premises Active Directory Domain Services (AD DS), such as when using Microsoft Entra Connect Sync, can result in incomplete synchronization of large AD security groups exceeding 10,000 members. support.microsoft.com
  6. 6. After further investigation, Microsoft determined that this issue doesn’t apply to Windows Server 2025. It affects only Windows 11, versions 25H2 and 24H2. Windows Server 2025 users don’t need to take action. support.microsoft.com
  7. 7. Go to Settings > Windows Update and select Pause updates. Then un-pause and scan for updates. You will then be offered the correct update. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Nov 6, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake