Skip to the content
The Update Bureau

Windows Server

Windows Server updates

All published releases for Windows Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 13, 2026.

24 active known issues →

Windows Server updates

  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day Updated

    KB5120238

    Exploited WinSock flaw patched; SMB backups recover

    An actively exploited WinSock driver flaw is patched, and scheduled File History backups to network shares work again. Secure Boot certificate coverage also expands.

    Check the newer update, KB5122876

    Key changes 183 CVEs · 3 changes

    • Improved Secure Boot: More devices qualify to receive new Secure Boot certificates automatically. Certificate deployment continues over the coming months.
    • Improved Servicing stack update (SSU): The update improves checks that confirm whether a device is hosted on Azure.
    • Fix Backup: Scheduled File History backups to network shares copy files again instead of failing with an incorrect credentials error.

    Read update Source: Microsoft

    Build
    17763.9121
    Security
    183 fixed · 18 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day Updated

    KB5120418

    Exploited WinSock flaw; File History backup failures fixed

    An actively exploited WinSock driver flaw gets a security fix, and scheduled File History backups to SMB shares work again after failing with invalid credentials.

    Check the newer update, KB5123099
    Windows Server 2016 reaches end of support on January 12, 2027.

    Key changes 165 CVEs · 2 changes

    • Improved Secure Boot: More devices can qualify to receive new Secure Boot certificates automatically.
    • Fix Backup: Scheduled File History backups to shared folders work again instead of failing with an “invalid credentials” error.
    • Exploited CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14393.9418
    Security
    165 fixed · 16 critical · 1 exploited
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update
    Zero-day Updated

    KB5099536

    Actively exploited AD FS and Shell flaws addressed

    The update addresses actively exploited flaws in AD FS and Windows Shell, along with a publicly disclosed BitLocker flaw. It also adds cryptography support and fixes several reported problems.

    Check the newer update, KB5120233
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 390 CVEs · 16 changes

    • New Cryptography: TLS 1.3 can use hybrid post-quantum key exchange to help protect secure network connections.
    • New Cryptography: Cryptographic signatures and keys can combine traditional and post-quantum algorithms.
    • New Distributed Key Manager (DKM): AD FS can detect insecure DKM container permissions and offers an optional way to improve them.

    Read update Source: Microsoft

    Build
    26100.33158
    Security
    390 fixed · 31 critical · 2 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day Updated

    KB5099540

    Exploited AD FS flaw patched; BitLocker recovery prompt remains possible

    An actively exploited AD FS elevation flaw and a Windows Shell spoofing flaw get security fixes. Check BitLocker settings before installing on affected managed servers.

    Check the newer update, KB5120242
    Mainstream support ends October 13, 2026; the October 2026 security update is the last mainstream update. Monthly security updates continue through October 14, 2031.
    Known issues: 2 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details
    • Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    Key changes 327 CVEs · 11 changes

    • New Distributed Key Manager (DKM): A new check can spot insecure AD FS key-container permissions, with an optional way for administrators to improve them.
    • Improved Secure Boot: More eligible devices can receive the updated Secure Boot certificates automatically.
    • Improved Authentication: Identity auditing records more sign-ins that use NTLM, helping administrators spot identity threats.

    Read update Source: Microsoft

    Build
    20348.5386
    Security
    327 fixed · 28 critical · 2 exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day Updated

    KB5099538

    Exploited AD FS flaw patched; Secure Boot status reporting added

    Attackers are exploiting an AD FS privilege flaw, and the update adds Secure Boot status reporting. It also fixes issues in File Explorer, OLE Automation, and the Recycle Bin.

    Check the newer update, KB5120238

    Key changes 313 CVEs · 10 changes

    • New Secure Boot: Windows Security can now report Secure Boot status.
    • New Distributed Key Manager (DKM): AD FS can detect insecure DKM container settings and offers an optional way to improve them.
    • Improved Input: In rare cases, some built-in Windows features might temporarily stop responding to keyboard shortcuts.

    Read update Source: Microsoft

    Build
    17763.9020
    Security
    313 fixed · 27 critical · 2 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day Updated

    KB5099535

    Exploited AD FS flaw prompts new key-container checks

    An actively exploited AD FS privilege flaw gets new key-container checks, alongside fixes for OLE Automation, File Explorer, and Recycle Bin problems.

    Check the newer update, KB5120418
    Free updates and security fixes for Windows Server 2016 end on January 12, 2027.

    Key changes 250 CVEs · 7 changes

    • New Distributed Key Manager (DKM): AD FS can detect insecure key-container permissions and gives administrators an optional way to strengthen them.
    • New Remote Desktop (RDP) Security: Trusted Remote Desktop publishers can use SHA-2 certificate thumbprints. SHA-1 remains for older setups, but Microsoft plans to remove...
    • Improved Secure Boot: More eligible devices can receive newer Secure Boot certificates automatically through Windows updates.

    Read update Source: Microsoft

    Build
    14393.9339
    Security
    250 fixed · 25 critical · 2 exploited
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update

    KB5094125

    DNS over HTTPS arrives as Secure Boot coverage expands

    Windows Server 2025 DNS can now use encrypted server-to-client queries, while Secure Boot certificate rollout reaches more eligible devices. The update also resolves an issue that could make Outlook and other WNS apps stop responding.

    Check the newer update, KB5099536
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 109 CVEs · 9 changes

    • New Secure Boot: A new policy lets administrators limit the Secure Boot data Windows sends to Microsoft.
    • New Networking: DNS can encrypt queries between a Windows Server DNS server and its clients, helping protect their privacy.
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates through a controlled rollout.

    Read update Source: Microsoft

    Build
    26100.32995
    Security
    109 fixed · 20 critical
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update

    KB5094128

    Remote Desktop and HTTP.sys remote-code flaws addressed

    Remote Desktop, HTTP.sys, Hyper-V, and other components receive security fixes. File Explorer search and app reliability also improve.

    Check the newer update, KB5099540
    Windows Server 2022 reaches the end of mainstream support on October 13, 2026. Its October 2026 security update is the last mainstream support update; extended support continues through October 14, 2031.
    Known issues: 2 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details
    • Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    Key changes 105 CVEs · 8 changes

    • New Secure Boot: Administrators can limit the Secure Boot service data Windows sends to Microsoft.
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates automatically, in a controlled rollout.
    • Improved App: Windows Security shows real-time status updates for Secure Boot.

    Read update Source: Microsoft

    Build
    20348.5256
    Security
    105 fixed · 20 critical
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

    KB5094123

    HTTP.sys remote-code flaw patched; Outlook hangs fixed

    A critical HTTP.sys remote-code flaw is patched, and an issue that could hang Outlook and other notification apps is resolved.

    Check the newer update, KB5099538

    Key changes 89 CVEs · 6 changes

    • New Secure Boot: A new setting lets administrators limit the Secure Boot data Windows sends to Microsoft.
    • Improved Secure Boot: Secure Boot status reporting is enabled in the Windows Security app.
    • Improved Secure Boot: More devices that qualify can receive new Secure Boot certificates. They get the certificates after enough successful update signals.

    Read update Source: Microsoft

    Build
    17763.8880
    Security
    89 fixed · 15 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5094122

    Secure Boot controls added; DFS fixed for 15-character hostnames

    A new Secure Boot policy limits data sent to Microsoft, and more eligible devices can receive updated certificates. The update also fixes DFS Namespaces on servers with exactly 15-character hostnames.

    Check the newer update, KB5099535
    Windows Server 2016 support ends January 12, 2027.

    Key changes 76 CVEs · 4 changes

    • New Secure Boot: Administrators can use a new policy to limit the Secure Boot data Windows sends to Microsoft.
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates automatically after showing enough successful update signals.
    • Improved Folder customization: Some downloaded or remote folders might lose custom icons or localized names. Folder access is not affected.

    Read update Source: Microsoft

    Build
    14393.9234
    Security
    76 fixed · 14 critical
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update

    KB5087539

    Secure Boot certificate rollout expands; ML-DSA signing added

    Secure Boot certificate updates can reach more eligible devices, and certificate authorities can use post-quantum signatures. The update also fixes a Remote Desktop warning dialog that could render incorrectly across monitors.

    Check the newer update, KB5094125
    Known issues: 2 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details
    • Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    Key changes 66 CVEs · 9 changes

    • New Secure Boot: Eligible devices get a new folder with scripts that help IT teams check and deploy Secure Boot certificate updates.
    • New Active Directory Certificate Services: Certificate services can use new post-quantum signatures for certificates used in code signing and secure connections.
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates, but the rollout waits for signs that updates are working well.

    Read update Source: Microsoft

    Build
    26100.32860
    Security
    66 fixed · 5 critical
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update

    KB5087545

    Critical Netlogon flaw patched; BitLocker recovery risk remains

    Fixes 58 vulnerabilities, including five critical flaws, and addresses a Remote Desktop warning-dialog issue. Some BitLocker configurations might prompt for a recovery key after the first restart.

    Check the newer update, KB5094128
    Secure Boot certificates used by most Windows devices started expiring in June 2026; devices without newer certificates continue to start and receive standard updates. Windows Server 2022 reaches the end of mainstream support on October 13, 2026.
    Known issues: 2 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details
    • Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    Key changes 58 CVEs · 8 changes

    • New Secure Boot: Eligible devices get a new C:\Windows\SecureBoot folder containing sample scripts for checking certificate-update status and managing d...
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates automatically, through a controlled rollout that waits for successful up...
    • Improved App: Apps and system components get more consistent calculation results, especially when working with very small values.

    Read update Source: Microsoft

    Build
    20348.5139
    Security
    58 fixed · 5 critical
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

    KB5087538

    Remote Desktop warnings and account sign-in failures fixed

    The update fixes a Remote Desktop security warning display problem and a Microsoft account sign-in failure. It also expands the phased delivery of new Secure Boot certificates.

    Check the newer update, KB5094123

    Key changes 55 CVEs · 7 changes

    • New Secure Boot: Eligible devices get a C:\Windows\SecureBoot folder containing example scripts for checking certificate update status and automating de...
    • Improved Secure Boot: Windows Security can report the device's Secure Boot state.
    • Improved Secure Boot: More eligible devices can automatically receive new Secure Boot certificates, in a controlled, phased rollout after showing enough succ...

    Read update Source: Microsoft

    Build
    17763.8755
    Security
    55 fixed · 4 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5087537

    Four critical remote-code flaws; Secure Boot coverage expands

    Addresses 47 vulnerabilities, including four critical remote-code execution flaws, and expands the devices eligible for Secure Boot certificate updates. It also fixes Remote Desktop warnings and Microsoft-account sign-in problems.

    Check the newer update, KB5094122
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and prepare to update them.

    Key changes 47 CVEs · 5 changes

    • New Secure Boot: Eligible devices get a SecureBoot folder containing example scripts for organizations that manage updates across their devices.
    • Improved Daylight Savings Time (DST): Daylight saving time support is updated for the Arab Republic of Egypt.
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates automatically, with the certificates deployed in a controlled, phased ro...

    Read update Source: Microsoft

    Build
    14393.9140
    Security
    47 fixed · 4 critical
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Out-of-band update
    Out-of-band

    KB5091157

    Domain controller startup and update installation problems fixed

    Domain controllers in some multi-domain forests can start again, and affected Server 2025 devices can install the April security update. The out-of-band release also includes open BitLocker, WSUS, and Remote Desktop issues.

    Check the newer update, KB5087539
    Known issues: 3 open
    • Windows Server Update Services (WSUS) does not display error details
    • Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key
    • Warnings related to Remote Desktop might not display correctly

    Key changes 3 changes

    • Improved Servicing stack update (SSU): The component that installs Windows updates gets quality improvements.
    • Fix Active Directory: Some domain controllers in multi-domain forests could have startup problems after the April security update. This release fixes the pro...
    • Fix Windows update installation: Some Windows Server 2025 devices could not install the April 14 security update. This release fixes that problem.

    Read update Source: Microsoft

    Build
    26100.32698
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Out-of-band update
    Out-of-band

    KB5091575

    PAM-related domain controller startup failures fixed

    Domain controllers in multi-domain forests using PAM can start again after restart failures caused by the April 14 update. This out-of-band release is available only from the Microsoft Update Catalog.

    Check the newer update, KB5087545
    Known issues: 3 open
    • Windows Server Update Services (WSUS) does not display error details
    • Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key
    • Warnings related to Remote Desktop might not display correctly

    Key changes 1 change

    • Fix Domain controllers (known issue): Domain controllers in multi-domain forests using PAM can start again after restart failures caused by the April 14 update.

    Read update Source: Microsoft

    Build
    20348.5024
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10
    Out-of-band

    KB5091573

    Fixes startup failures on multi-domain PAM domain controllers

    Fixes startup problems on multi-domain domain controllers that use Privileged Access Management after installing the April 14 update. It is available only from the Microsoft Update Catalog.

    Check the newer update, KB5087538

    Key changes 2 changes

    • Improved Servicing stack: The included servicing stack update improves verification of whether a device is hosted on Azure.
    • Fix Domain controllers (known issue): Startup problems are fixed for domain controllers in multi-domain forests that use Privileged Access Management and might have been aff...

    Read update Source: Microsoft

    Build
    17763.8647
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Out-of-band update Also for Windows 10
    Out-of-band

    KB5091572

    PAM domain controllers recover from startup failures

    Fixes startup problems on Windows Server 2016 domain controllers with multi-domain forests using PAM after the April 14 update. It is available only from the Update Catalog.

    Check the newer update, KB5087537
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Microsoft recommends reviewing its guidance and updating certificates in advance.

    Key changes 1 change

    • Fix Domain controllers (known issue): Fixes startup problems that could affect domain controllers in multi-domain forests using PAM after installing the April 14, 2026 secur...

    Read update Source: Microsoft

    Build
    14393.9062
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update

    KB5082063

    Secure Boot hardening and new recovery-key and Remote Desktop issues

    Secure Boot certificate updates reach more eligible devices, while changes to driver blocking and Windows Deployment Services can affect backup apps and Hands-Free Deployment. Some BitLocker, WSUS, and Remote Desktop issues remain listed.

    Check the newer update, KB5091157
    Secure Boot certificates used by most Windows devices start to expire in June 2026. Review Microsoft's guidance and prepare to update them.
    Known issues: 3 open
    • Windows Server Update Services (WSUS) does not display error details
    • Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key
    • Warnings related to Remote Desktop might not display correctly

    Key changes 125 CVEs · 13 changes

    • New Texts and Fonts: Windows fonts include the new Saudi Riyal currency symbol.
    • Improved Secure Boot: Secure Boot certificates reach more eligible devices through a phased rollout.
    • Improved Kerberos protocol: Kerberos uses AES-SHA1 by default for accounts without an explicit encryption setting.

    Read update Source: Microsoft

    Build
    26100.32690
    Security
    125 fixed · 3 critical
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update

    KB5082142

    Critical IKE flaw patched; BitLocker recovery risk remains

    A critical flaw in the Windows IKE service could allow remote code execution. Some managed servers might also ask for a BitLocker recovery key after the first restart.

    Check the newer update, KB5091575
    Known issues: 3 open
    • Windows Server Update Services (WSUS) does not display error details
    • Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key
    • Warnings related to Remote Desktop might not display correctly

    Key changes 117 CVEs · 11 changes

    • New Texts and Fonts: Windows fonts now include the Saudi Riyal currency symbol.
    • Improved Connectivity: Audio features are more reliable, which can reduce system slowdowns linked to sound activity.
    • Improved Kernel: Large file operations are more stable, with fewer unexpected interruptions during work or file transfers.

    Read update Source: Microsoft

    Build
    20348.5020
    Security
    117 fixed · 3 critical
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

    KB5082123

    Three critical remote-code flaws; Secure Boot and server changes

    Fixes 107 vulnerabilities, including three critical remote-code execution flaws, and changes Secure Boot, Remote Desktop, Kerberos, and WDS behavior. A domain-controller restart issue is resolved by KB5091573, not this update.

    Check the newer update, KB5091573

    Key changes 107 CVEs · 9 changes

    • New Secure Boot: Windows Security can report Secure Boot status dynamically. These status alerts are disabled by default on commercial devices and serve...
    • Improved Remote Desktop: Before connecting from an .rdp file, Remote Desktop shows all requested connection settings, with each setting turned off by default. A...
    • Improved Vulnerable driver blocklist: Known vulnerable kernel drivers are added to the Microsoft vulnerable driver blocklist. Backup applications that rely on blocked driver...

    Read update Source: Microsoft

    Build
    17763.8644
    Security
    107 fixed · 3 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5082198

    Remote Desktop files get safer defaults; Secure Boot coverage expands

    Remote Desktop shows requested connection settings before opening an .rdp file, and Secure Boot certificate targeting expands. The update also changes WDS, Kerberos, and WinCS behavior.

    Check the newer update, KB5091572
    Windows Server 2016 support ends January 12, 2027.

    Key changes 88 CVEs · 5 changes

    • Improved Remote Desktop: Before an .rdp file connects, Remote Desktop shows its requested connection settings, with each setting off by default. A one-time secu...
    • Improved Kerberos protocol: Kerberos uses AES-SHA1 by default for accounts without an explicit encryption-types setting.
    • Improved Secure Boot: More eligible devices can be targeted to receive new Secure Boot certificates automatically, but certificates are delivered only after...

    Read update Source: Microsoft

    Build
    14393.9060
    Security
    88 fixed · 3 critical
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update

    KB5078740

    Secure Boot targeting expands; newer server errors are handled

    Fixes 39 Important vulnerabilities and expands targeted delivery of new Secure Boot certificates. It also improves hardware error reporting on newer server platforms.

    Check the newer update, KB5082063
    Secure Boot certificates used by most Windows devices start expiring in June 2026. Microsoft recommends reviewing its guidance and preparing to update certificates; servers are unlikely to qualify for automatic delivery of the new certificates.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 39 CVEs · 4 changes

    • Improved Catalog tab: The x64 update string shown on the Catalog tab is corrected.
    • Improved Secure Boot: Eligible devices receive new Secure Boot certificates through a controlled, phased rollout. Servers are unlikely to qualify, though the...
    • Improved System services and reliability: Newer server platforms can report and handle supported hardware errors as expected, including systems with up to 64 Machine Check Archi...

    Read update Source: Microsoft

    Build
    26100.32522
    Security
    39 vulnerabilities fixed
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update

    KB5078766

    Secure Boot certificate targeting expands; catalog selection gets safer

    The update fixes 40 Important-severity vulnerabilities and improves Secure Boot certificate targeting and trusted catalog selection in Windows System Image Manager.

    Check the newer update, KB5082142
    Secure Boot certificates used by most Windows devices started expiring in June 2026. Devices without newer certificates continue to start and operate normally, and standard Windows updates continue to install.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 40 CVEs · 3 changes

    • Improved Secure Boot: Eligible devices are more likely to receive new Secure Boot certificates automatically. Servers are unlikely to qualify.
    • Improved Windows System Image Manager: A warning helps you confirm that a catalog file you select comes from a trusted source.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements to help devices receive and install updates reliably.

    Read update Source: Microsoft

    Build
    20348.4893
    Security
    40 vulnerabilities fixed
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

    KB5078752

    Secure Boot certificate targeting expands; File History backs up more files

    The update fixes 38 Important-severity vulnerabilities and expands phased Secure Boot certificate targeting. File History can now back up files with certain Chinese and Private Use Area characters.

    Check the newer update, KB5082123
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and prepare to update certificates to avoid disruption.

    Key changes 38 CVEs · 4 changes

    • New Windows System Image Manager: A warning dialog helps you confirm that a selected catalog file comes from a trusted source.
    • Improved File History: File History can back up new files with names containing certain Chinese and Private Use Area characters.
    • Improved Secure Boot: More eligible devices can be targeted to receive new Secure Boot certificates automatically, through a controlled phased rollout.

    Read update Source: Microsoft

    Build
    17763.8511
    Security
    38 vulnerabilities fixed
    Restart
    Required