Skip to the content
The Update Bureau
Windows Server 2019 Windows Server 2019 Security update
Patch Tuesday

KB5082123

KB5082123: Cumulative update for Windows Server, version 2019, April 2026. Three critical remote-code flaws; Secure Boot and server changes

In short

Fixes 107 vulnerabilities, including three critical remote-code execution flaws, and changes Secure Boot, Remote Desktop, Kerberos, and WDS behavior. A domain-controller restart issue is resolved by KB5091573, not this update.

Does it affect you? Applies to: Devices running Windows Server 2019 (x64). The update page also describes Secure Boot certificate changes affecting Windows devices.

Build
17763.8644
Security
107 fixed · 3 critical
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • In detail The update adds dynamic Secure Boot status reporting, but these enhancements are disabled by default on commercial devices and servers.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 5 changes

Remote Desktop

Verified in package

For: Users opening .rdp files

  • Before connecting from an .rdp file, Remote Desktop shows all requested connection settings, with each setting turned off by default. A one-time security warning appears the first time an .rdp file is opened on a device.1
    Improves protection against phishing attacks that use Remote Desktop (.rdp) files.

Vulnerable driver blocklist

Verified in package
  • Known vulnerable kernel drivers are added to the Microsoft vulnerable driver blocklist. Backup applications that rely on blocked drivers might fail when mounting or managing disk images.2
    Affected backup apps might report that Microsoft VSS timed out during snapshot creation or show VSS_E_BAD_STATE. Update the application to a newer version that uses newer drivers with the required protections.

Kerberos protocol

For: Kerberos environments with accounts lacking an explicit encryption-types attribute

  • Kerberos uses AES-SHA1 by default for accounts that do not have an explicit encryption-types setting.3
    Changes the default DefaultDomainSupportedEncTypes value for KDC operations when an account has no explicit msds-SupportedEncryptionTypes Active Directory attribute.

Secure Boot

Gradual rollout Verified in package

For: Devices eligible for new Secure Boot certificates

  • More eligible devices can receive new Secure Boot certificates automatically, through a controlled, phased rollout.4
    Adds high-confidence device-targeting data to Windows quality updates. Devices receive new certificates only after showing sufficient successful update signals.

Servicing stack

  • Azure-hosted devices get updated certificate-chain checks to verify Azure hosting. They need access to the required certificate update domains to download and install certificate updates.5
    The combined servicing stack update includes enhanced logic for Azure-hosting verification using an updated certificate chain.

Fixes 2 changes

PowerShell (known issue)

  • Japanese-language installations display Japanese characters correctly in the PowerShell console again.6
    Fixes the display issue that might occur after Windows updates released on or after January 13, 2026.

Secure Boot

Verified in package

For: Devices receiving Secure Boot updates

  • A device is less likely to enter BitLocker Recovery after Secure Boot updates.7
    Fixes an issue that could cause a device to enter BitLocker Recovery after Secure Boot updates.

New feature 1 change

Secure Boot

Verified in package

For: Windows devices; alerts disabled by default on commercial devices and servers

  • Windows Security can report Secure Boot status dynamically. These status alerts are disabled by default on commercial devices and servers.8
    Adds dynamic Secure Boot state reporting in Windows Security under Settings > Update & Security > Windows Security.

Removal 1 change

Windows Deployment Services (WDS)

For: IT administrators using WDS Hands-Free Deployment

  • Hands-Free Deployment in WDS is disabled by default and is no longer supported.9

Known issues

  1. Resolved Affects: Everyone Resolved by KB5087538

    Remote Desktop security warnings might not display correctly

    On systems using multiple monitors with different display scaling settings, the Remote Desktop warning for .rdp files might show overlapping text or partly hidden buttons. This issue is resolved in updates released on and after May 12, 2026, such as KB5087538.10

    Resolution Fixed in KB5087538

    Install KB5087538 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Organizations and IT administrators Resolved by KB5091573

    Domain controllers might restart repeatedly after installing this update

    In forests with multiple domains that use Privileged Access Management, domain controllers might crash during startup and restart repeatedly after this update. This issue is addressed by out-of-band update KB5091573.11

    Resolution Fixed in KB5091573

    Install KB5091573 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-04-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5078752, KB5075904, KB5078131, KB5077795
+17 earlier KB5073723, KB5074975, KB5071544, KB5068791, KB5070883, KB5066586, KB5065428, KB5066187, KB5063877, KB5062557, KB5060531, KB5061978, KB5058392, KB5059091, KB5058922, KB5050008, KB5037425
Replaced by
KB5091573
VersionBuildChannel
2019 17763.8644 General availability

Security

107 vulnerabilities fixed
3 critical 101 important 1 moderate 2 not rated
VulnerabilitySeverityCVSS
CVE-2026-33824
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-33827
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-33826
Windows Active Directory Remote Code Execution Vulnerability
 Critical 8.0

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 107 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2019
812.8 MB
windows10.0-kb5082123-x64.msu Main update · KB5082123 SHA-1: 3c1a2626…9d083c

Updated components

858 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio11
Secure Boot10
Graphics and display9
Hyper-V and virtualization7
Networking7
Security and sign-in7
File Explorer and shell6
Kernel6
Search4
Settings4
Bluetooth2
Remote Desktop2

Verified in package: changed files confirm Remote Desktop, Vulnerable driver blocklist, Secure Boot.

Sources

Updated
Cited passages from Microsoft's official notes (11)
  1. 1. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. support.microsoft.com
  2. 2. This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. support.microsoft.com
  3. 3. This update changes the default DefaultDomainSupportedEncTypes value for Kerberos Key Distribution Center (KDC) operations to leverage AES-SHA1 for accounts that do not have an explicit msds-SupportedEncryptionTypes Active Directory attribute defined. support.microsoft.com
  4. 4. Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout. support.microsoft.com
  5. 5. This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. support.microsoft.com
  6. 6. Fixed: After installing Windows updates released on or after January 13, 2026, Japanese language installations of Windows Server 2019 might not correctly display Japanese characters in the PowerShell console. support.microsoft.com
  7. 7. This update fixes an issue that could cause a device to enter BitLocker Recovery after Secure Boot updates. support.microsoft.com
  8. 8. This update enables dynamic status reporting for Secure Boot states in the Windows Security App support.microsoft.com
  9. 9. This update disables the “Hands-Free Deployment” feature in WDS by default and is no longer a supported feature. support.microsoft.com
  10. 10. This issue is resolved in Windows updates released on and after May 12, 2026 (such as KB5087538). support.microsoft.com
  11. 11. This issue is addressed in out-of-band update KB5091573. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 11 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake