Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5073722

KB5073722: Cumulative update for Windows Server, version 2016, January 2026. Exploited Desktop Window Manager flaw patched; modem drivers removed

In short

Fixes an actively exploited Desktop Window Manager flaw, removes four modem drivers, and changes credential autofill and WDS behavior. Review the Secure Boot certificate guidance to avoid possible boot disruption.

Does it affect you? Applies to: Devices running Windows Server 2016.

Build
14393.8783
Security
53 fixed · 1 critical · 1 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Fix 1 change

WinSqlite3.dll

For: Users whose security software flagged WinSqlite3.dll

  • The Windows WinSqlite3.dll component is updated to address cases where security software detected it as vulnerable.1
    This is separate from sqlite3.dll in application-specific directories; contact the app developer if security software still flags that file.

Improvement 1 change

Windows Deployment Services (WDS)

For: IT administrators using WDS hands-free deployment

  • Hands-free deployment is no longer supported by default in Windows Deployment Services.2
    Administrators should review the Windows Deployment Services (WDS) Hands-Free Deployment Hardening Guidance.

New feature 1 change

Credentials autofill

Verified in package
  • In certain remote support or automated authentication workflows, credential dialogs no longer accept virtual keyboard input from remote desktop or screen-sharing tools or apps.3
    Introduces security hardening that restricts certain applications from autofilling credentials during these workflows.

Removal 1 change

Drivers

For: Users with modem hardware that depends on these drivers

  • Modems that depend on four removed drivers will no longer work in Windows.4
    Removes agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64), and smserial.sys (x86).

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-01-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5074974, KB5071543, KB5068864, KB5070882
+14 earlier KB5066836, KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5075999
VersionBuildChannel
2016 14393.8783 General availability

Security

53 vulnerabilities fixed
1 exploited 1 critical 51 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-20805 Exploited
Desktop Window Manager Information Disclosure Vulnerability
 Important 5.5
CVE-2026-20822
Windows Graphics Component Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2023-31096
MITRE: CVE-2023-31096 Windows Agere Soft Modem Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21265
Secure Boot Certificate Expiration Security Feature Bypass Vulnerability
 Important 6.4

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 53 vulnerabilities →

Updated components

355 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display11
Security and sign-in9
Hyper-V and virtualization6
Kernel6
Search4
Secure Boot4
File Explorer and shell3
Networking3
Settings2
Remote Desktop1
Storage and file systems1

Verified in package: changed files confirm Credentials autofill.

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. Fixed: The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. support.microsoft.com
  2. 2. This update introduces a change in behavior in which WDS will stop supporting hands-free deployment functionality by default. support.microsoft.com
  3. 3. With this change, credential dialogs do not respond to virtual keyboard input from remote desktop or screen sharing tools or apps. support.microsoft.com
  4. 4. This update removes the following modem drivers: agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64) and smserial.sys (x86). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake