The Update BureauKB5078938: Cumulative update for Windows Server, version 2016, March 2026. Secure Boot certificate targeting expands ahead of expirations
The update expands targeting for automatic Secure Boot certificate delivery and adds a trusted-source warning in Windows System Image Manager. Secure Boot certificates have started expiring in June 2026, which might affect some devices’ ability to boot securely.
Does it affect you? Applies to: Devices running Windows Server 2016. Servers are unlikely to qualify for automatic receipt of the new Secure Boot certificates, although they are not explicitly excluded.
Microsoft publishes separate notes for this KB for Windows 10.
What changes
Improvement 1 change
Secure Boot
For: Devices eligible for automatic certificate updates
-
More eligible devices can receive new Secure Boot certificates automatically, but servers are unlikely to qualify.1
Additional high-confidence device-targeting data is based primarily on client device diagnostic data. Devices receive certificates only after sufficient successful update signals in a controlled, phased rollout; servers are not explicitly excluded.
New feature 1 change
Windows System Image Manager
For: Windows System Image Manager users
- A warning dialog helps users confirm that a selected catalog file comes from a trusted source.2
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-03-10
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5075999, KB5073722, KB5074974, KB5071543
- Replaced by
- KB5082198
| Version | Build | Channel |
|---|---|---|
| 2016 | 14393.8957 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|
The table lists the 0 exploited, publicly disclosed or critical vulnerabilities. See all 34 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
229 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Graphics and display | 8 |
| Hyper-V and virtualization | 5 |
| Networking | 5 |
| Search | 5 |
| File Explorer and shell | 4 |
| Security and sign-in | 4 |
| Settings | 3 |
| Storage and file systems | 3 |
| Kernel | 2 |
| Secure Boot | 2 |
| Bluetooth | 1 |
| Remote Desktop | 1 |
Verified in package: changed files confirm Secure Boot.
Sources
Cited passages from Microsoft's official notes (2)
-
1.
[Secure Boot] With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates.
support.microsoft.com -
2.
[Windows System Image Manager] This update adds a warning dialog to help users confirm that the selected catalog file comes from a trusted source.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 5/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake