Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday

KB5087537

KB5087537: Cumulative update for Windows Server, version 2016, May 2026. Four critical remote-code flaws; Secure Boot coverage expands

In short

Addresses 47 vulnerabilities, including four critical remote-code execution flaws, and expands the devices eligible for Secure Boot certificate updates. It also fixes Remote Desktop warnings and Microsoft-account sign-in problems.

Does it affect you? Applies to: Devices running Windows Server 2016. The Secure Boot certificate changes apply only to eligible devices.

Build
14393.9140
Security
47 fixed · 4 critical
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Fixes 2 changes

Remote Desktop security warnings

Verified in package

For: Devices using multiple monitors with different display scaling settings

  • The Remote Desktop Connection security warning dialog no longer renders incorrectly in multi-monitor setups with different display scaling settings.1
    The issue might occur after installing a Windows security update released on or after April 14, 2026.

Sign-In

For: Some users signing in with a Microsoft account

  • Some users can sign in to apps with a Microsoft account without the “no Internet” error blocking access to Microsoft services and apps.2
    The issue can affect users after installing a Windows update released on or after March 10, 2026, even when the device has a working Internet connection.

Improvements 2 changes

Daylight Savings Time (DST)

For: Devices using Egypt time settings

  • Daylight saving time support is updated for the Arab Republic of Egypt.3
    Supports the government DST change order in 2023.

Secure Boot

Gradual rollout Verified in package
  • More eligible devices can receive new Secure Boot certificates automatically, with the certificates deployed in a controlled, phased rollout.4
    Adds high-confidence device-targeting data. Devices receive the certificates only after demonstrating sufficient successful update signals.

New feature 1 change

Secure Boot

Verified in package

For: Eligible devices; organizations managing device fleets

  • Eligible devices get a SecureBoot folder containing example scripts for organizations that manage updates across their devices.5
    The folder is created under C:\Windows. The scripts can detect Secure Boot certificate update status and automate deployment through a safe rollout mechanism in an Active Directory environment.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5094122

    Domain Controller lookup might fail for 15-character hostnames

    On Windows Server 2016 systems with a 15-character hostname, domain controller discovery might fail after this update. KB5094122 resolves the issue.6

    Resolution Fixed in KB5094122

    Install KB5094122 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-05-12
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5091572, KB5082198, KB5078938, KB5075999
+19 earlier KB5073722, KB5074974, KB5071543, KB5068864, KB5070882, KB5066836, KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5094122
VersionBuildChannel
2016 14393.9140 General availability

Security

47 vulnerabilities fixed
4 critical 43 important
VulnerabilitySeverityCVSS
CVE-2026-41089
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-40403
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-35421
Windows GDI Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-32161
Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 47 vulnerabilities →

Updated components

386 files changed since the previous update for the same versions.

Top changed componentsFiles
WPF14
Graphics and display8
Hyper-V and virtualization7
Networking7
Search4
Secure Boot4
File Explorer and shell3
Kernel2
Remote Desktop2
Security and sign-in2
Settings2
Printing1

Verified in package: changed files confirm Remote Desktop security warnings, Secure Boot.

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. Fixed: The Remote Desktop Connection security warning dialog might render incorrectly in multi-monitor configurations with different display scaling settings. support.microsoft.com
  2. 2. Fixed: After you install the Windows update released on or after March 10, 2026, some users might experience an issue signing in to apps with a Microsoft account. support.microsoft.com
  3. 3. Update for Arab Republic of Egypt to support the government DST change order in 2023. support.microsoft.com
  4. 4. With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  5. 5. This update adds a new SecureBoot folder under C:\Windows on eligible devices. support.microsoft.com
  6. 6. This issue is resolved in Windows updates released on and after June 9, 2026 (KB5094122). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake