Skip to the content
The Update Bureau

Windows Server

Windows Server updates

All published releases for Windows Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 13, 2026.

24 active known issues →

Windows Server updates

  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5078938

    Secure Boot certificate targeting expands ahead of expirations

    The update expands targeting for automatic Secure Boot certificate delivery and adds a trusted-source warning in Windows System Image Manager. Secure Boot certificates have started expiring in June 2026, which might affect some devices’ ability to boot securely.

    Check the newer update, KB5082198
    Secure Boot certificates have started expiring in June 2026. Some devices might be affected if their certificates are not updated in time; Microsoft recommends reviewing its guidance and acting in advance.

    Key changes 34 CVEs · 2 changes

    • New Windows System Image Manager: A warning dialog helps users confirm that a selected catalog file comes from a trusted source.
    • Improved Secure Boot: More eligible devices can receive new Secure Boot certificates automatically, but servers are unlikely to qualify.
    • CVSS 8.8 CVE-2026-23669: RPC Runtime Library Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8957
    Security
    34 vulnerabilities fixed
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Out-of-band update
    Out-of-band

    KB5082314

    ADFS certificate-renewal issue addressed for specific deployments

    Addresses a Windows Hello for Business certificate-renewal issue in certain ADFS deployments on Windows Server 2022. The fix is disabled by default and must be enabled through Microsoft Support.

    Check the newer update, KB5078766
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 1 change

    • Fix Windows Hello for Business: Addresses a certificate-renewal issue in certain Windows Hello for Business deployments using ADFS on Windows Server 2022. The fix is d...

    Read update Source: Microsoft

    Build
    20348.4776
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update
    Zero-day

    KB5075899

    Exploited Shell and MSHTML bypasses patched

    Fixes security flaws already being exploited, including Windows Shell and MSHTML security-feature bypasses. It also adds DNS features, while WSUS still does not show synchronization error details.

    Check the newer update, KB5078740
    Secure Boot certificates used by most Windows devices started expiring in June 2026. Devices without newer certificates continue to start and receive standard updates; administrators can follow Microsoft's Windows Server guidance.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 29 CVEs · 7 changes

    • New Networking: Windows DNS Server adds DNS over HTTPS support in public preview for evaluating traffic between the server and its clients. The preview...
    • New Networking: DNS Server can randomly shuffle resource records in responses, helping reduce the chance that the first-listed record becomes overloade...
    • Improved Fonts & Display: Chinese fonts support the GB18030-2022A standard for character coverage and display.

    Read update Source: Microsoft

    Build
    26100.32370
    Security
    29 vulnerabilities fixed · 5 actively exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day

    KB5075906

    Exploited Shell and MSHTML bypasses patched; folder names fixed

    Fixes 27 security vulnerabilities, including five that are being exploited, and addresses several Windows Server issues. It also adds optional DNS response record shuffling.

    Check the newer update, KB5082314
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Devices without newer certificates continue to start and operate normally; administrators should follow Microsoft’s Windows Server guidance.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 27 CVEs · 6 changes

    • New Networking: DNS Server can now shuffle the order of resource records in its responses, helping reduce the chance that one record becomes overloaded...
    • Improved Fonts & Display: Chinese fonts are updated to support the GB18030-2022A character coverage and display standard.
    • Improved Servicing stack: Includes quality improvements to the component that installs Windows updates.

    Read update Source: Microsoft

    Build
    20348.4773
    Security
    27 vulnerabilities fixed · 5 actively exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day

    KB5075904

    Exploited Shell and MSHTML security bypasses patched

    Fixes 24 vulnerabilities, including five that attackers are exploiting. It also fixes shutdown, folder-name, and graphics problems.

    Check the newer update, KB5078752

    Key changes 24 CVEs · 5 changes

    • Improved Fonts: Chinese fonts are updated to meet GB18030-2022A compliance.
    • Improved Servicing stack: The update includes quality improvements to the component that installs Windows updates.
    • Fix OS Security: Some Secure Launch-capable PCs with Virtual Secure Mode enabled can shut down or hibernate instead of restarting.

    Read update Source: Microsoft

    Build
    17763.8389
    Security
    24 vulnerabilities fixed · 5 actively exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5075999

    Exploited Shell and MSHTML bypasses patched; GPU stability fixed

    The update patches five exploited vulnerabilities, including Windows Shell and MSHTML security feature bypasses, and fixes a graphics stability issue affecting certain GPU configurations.

    Check the newer update, KB5078938
    Windows Server 2016 reaches end of support on January 12, 2027. Microsoft says free updates, technical assistance, and security fixes from Windows Update will end then; see its ESU guidance for availability.

    Key changes 21 CVEs · 1 change

    • Fix Graphics: A stability issue affecting certain graphics processor configurations is fixed.
    • Exploited CVE-2026-21510: Windows Shell Security Feature Bypass Vulnerability
    • Exploited CVE-2026-21513: MSHTML Framework Security Feature Bypass Vulnerability

    Read update Source: Microsoft

    Build
    14393.8868
    Security
    21 vulnerabilities fixed · 5 actively exploited
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Out-of-band update
    Out-of-band

    KB5078135

    Cloud-file errors and Outlook hangs fixed; WSUS details remain missing

    Fixes errors opening or saving cloud-based files, including Outlook hangs in some OneDrive PST configurations. WSUS synchronization error details remain unavailable.

    Check the newer update, KB5075899
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Fix File System: Some applications can open files from and save files to cloud-based storage without the unresponsiveness or unexpected errors caused by...

    Read update Source: Microsoft

    Build
    26100.32236
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Out-of-band update
    Out-of-band

    KB5078136

    Cloud-file errors and Outlook hangs get a fix

    Apps that open or save files in cloud storage might stop responding after the January 13 update. This out-of-band update fixes that problem, including hangs in some Outlook setups.

    Check the newer update, KB5075906
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Fix File System: Apps can open and save cloud files again without the errors or hangs reported after the January 13 update.

    Read update Source: Microsoft

    Build
    20348.4651
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10
    Out-of-band

    KB5078131

    Cloud-file errors and Outlook hangs fixed

    Fixes file access problems that could leave some apps unresponsive and cause Outlook to hang when PST files are stored on OneDrive.

    Check the newer update, KB5075904

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Fix File System: Some apps can open or save files in cloud storage again without becoming unresponsive. In certain Outlook setups, PST files stored on O...

    Read update Source: Microsoft

    Build
    17763.8281
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Out-of-band update
    Out-of-band

    KB5077793

    Remote Desktop sign-in failures fixed

    Remote Desktop connections work again for users who had sign-in failures after the January security update. The update also includes a servicing stack improvement.

    Check the newer update, KB5078135
    Known issues: 2 open
    • Windows Server Update Services (WSUS) does not display error details
    • Apps might become unresponsive when saving files to cloud-based storage

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Fix Remote Desktop: Some users who could not sign in to Remote Desktop connections can sign in again.

    Read update Source: Microsoft

    Build
    26100.32234
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Out-of-band update
    Out-of-band

    KB5077800

    Remote Desktop sign-ins work again after the January update

    A sign-in failure affecting some Remote Desktop apps after the January 13 security update is fixed. The package also includes servicing stack improvements.

    Check the newer update, KB5078136
    Known issues: 2 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details
    • Apps might become unresponsive when saving files to cloud-based storage

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Fix Remote Desktop: Some people who had sign-in failures with Remote Desktop apps can connect again.

    Read update Source: Microsoft

    Build
    20348.4650
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10
    Out-of-band

    KB5077795

    Remote Desktop sign-in failures fixed

    Fixes sign-in failures during Remote Desktop connections, including with the Windows App. It also includes servicing stack improvements.

    Check the newer update, KB5078131
    Secure Boot certificates started expiring in June 2026. Review Microsoft’s guidance and update certificates in advance to avoid disruption.
    Known issues: 1 open
    • Apps might become unresponsive when saving files to cloud-based storage

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements intended to improve the reliability of update installation.
    • Fix Remote Desktop: Some users can sign in again during Remote Desktop connections.

    Read update Source: Microsoft

    Build
    17763.8280
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update
    Zero-day

    KB5073379

    An exploited desktop display flaw exposes information

    Attackers are exploiting a flaw in the desktop display system to expose information. The update also changes credential input during remote support and includes a known cloud-file issue.

    Check the newer update, KB5077793
    Known issues: 2 open
    • Windows Server Update Services (WSUS) does not display error details
    • Apps might become unresponsive when saving files to cloud-based storage

    Key changes 86 CVEs · 8 changes

    • New Credentials autofill: In some remote support and automated sign-in situations, credential dialogs no longer accept typing from virtual keyboards in remote de...
    • New Secure Boot: Windows quality updates use device eligibility data to deliver new Secure Boot certificates in phases.
    • Improved Windows Deployment Services: Hands-free deployment is no longer supported by default.

    Read update Source: Microsoft

    Build
    26100.32230
    Security
    86 fixed · 3 critical · 1 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day

    KB5073457

    Exploited Desktop Window Manager flaw patched; modem drivers removed

    An exploited Desktop Window Manager flaw is addressed, and four modem drivers are removed, so hardware that depends on them stops working.

    Check the newer update, KB5077800
    Secure Boot certificates used by most Windows devices started expiring in June 2026. Devices without newer certificates continue to start and receive standard updates.
    Known issues: 2 open
    • Windows Server Update Services (WSUS) does not display error details
    • Apps might become unresponsive when saving files to cloud-based storage

    Key changes 78 CVEs · 6 changes

    • Improved Credentials autofill: Some credential dialogs no longer accept typing sent by remote desktop or screen sharing tools.
    • Improved Windows Deployment Services (WDS): Hands-free deployment is no longer supported by default.
    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.

    Read update Source: Microsoft

    Build
    20348.4648
    Security
    78 fixed · 1 critical · 1 exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day

    KB5073723

    Exploited DWM flaw patched; modem drivers removed

    An actively exploited Desktop Window Manager flaw is patched. The update also removes several modem drivers, so hardware that depends on them stops working.

    Check the newer update, KB5077795
    Known issues: 1 open
    • Apps might become unresponsive when saving files to cloud-based storage

    Key changes 72 CVEs · 5 changes

    • Improved Credentials autofill: Credential dialogs ignore virtual keyboard input from remote access tools during some remote support or automated sign-in sessions.
    • Improved Windows Deployment Services (WDS): Hands-free deployment is no longer supported by default. Administrators should follow Microsoft's guidance.
    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.

    Read update Source: Microsoft

    Build
    17763.8276
    Security
    72 fixed · 1 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5073722

    Exploited Desktop Window Manager flaw patched; modem drivers removed

    Fixes an actively exploited Desktop Window Manager flaw, removes four modem drivers, and changes credential autofill and WDS behavior. Review the Secure Boot certificate guidance to avoid possible boot disruption.

    Check the newer update, KB5075999
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Certain personal and business devices might not boot securely if the certificates are not updated in time; review Microsoft's guidance and prepare in advance.

    Key changes 53 CVEs · 4 changes

    • New Credentials autofill: In certain remote support or automated authentication workflows, credential dialogs no longer accept virtual keyboard input from remote...
    • Improved Windows Deployment Services (WDS): Hands-free deployment is no longer supported by default in Windows Deployment Services.
    • Fix WinSqlite3.dll: The Windows WinSqlite3.dll component is updated to address cases where security software detected it as vulnerable.

    Read update Source: Microsoft

    Build
    14393.8783
    Security
    53 fixed · 1 critical · 1 exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10
    Out-of-band

    KB5074975

    Message Queuing failures after December updates fixed

    Fixes Message Queuing problems that could leave queues inactive or prevent applications from writing messages, mainly in enterprise or managed environments.

    Check the newer update, KB5073723

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Fix Message queuing (MSMQ) (known issue): Message Queuing problems that could leave queues inactive or stop applications from writing messages are fixed for affected environment...

    Read update Source: Microsoft

    Build
    17763.8148
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Out-of-band update Also for Windows 10
    Out-of-band

    KB5074974

    Message Queuing failures after the December update resolved

    Fixes Message Queuing problems that appeared after the December 9, 2025 updates, including in clustered environments under load.

    Check the newer update, KB5073722
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Microsoft recommends reviewing its guidance and updating certificates in advance.

    Key changes 1 change

    • Fix Message queuing (MSMQ) (known issue): Message Queuing works again after the December 9, 2025 updates caused queues to become inactive or prevented applications from writing...

    Read update Source: Microsoft

    Build
    14393.8692
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update Also for Windows 11
    Zero-day

    KB5072033

    Exploited Cloud Files flaw patched; RemoteApp may fail

    Attackers are exploiting a Cloud Files driver flaw, while RemoteApp connections might fail on Azure Virtual Desktop. The update also adds privacy prompts and other features.

    Check the newer update, KB5073379
    Secure Boot certificates have started expiring in June 2026. Devices without newer certificates should still start and receive standard updates.
    Known issues: 2 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details
    • RemoteApp sessions might fail to start on Azure Virtual Desktop

    Key changes 34 CVEs · 24 changes

    • New File Explorer: Dividers now separate the top-level icons in File Explorer's right-click menu.
    • New When an app asks to use your camera, microphone, location, or another device feature, a redesigned prompt appears in the center of a di...
    • New Search on the Taskbar: A new grid view helps you find images more quickly and accurately in taskbar search.

    Read update Source: Microsoft

    Build
    26100.7462
    Security
    34 vulnerabilities fixed · 1 actively exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day

    KB5071547

    Exploited Cloud Files driver flaw patched; WSUS still hides sync errors

    The update fixes 29 Important vulnerabilities, including an exploited Cloud Files Mini Filter Driver flaw and a publicly disclosed PowerShell flaw. WSUS synchronization error details remain unavailable after KB5070884 or later.

    Check the newer update, KB5073457
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 29 CVEs · 2 changes

    • New PowerShell 5.1: Invoke-WebRequest now shows a security warning and asks whether to continue or cancel a request that could run scripts.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Exploited CVE-2025-62221: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    20348.4529
    Security
    29 vulnerabilities fixed · 1 actively exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day

    KB5071544

    Closes exploited Cloud Files flaw; People icon stops responding

    The update closes exploited CVE-2025-62221 in the Cloud Files Mini Filter Driver, adds a script-risk prompt to PowerShell 5.1 web requests, and makes the People taskbar icon unresponsive.

    Check the newer update, KB5074975
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Microsoft recommends reviewing its guidance and updating certificates in advance to avoid disruption.

    Key changes 26 CVEs · 3 changes

    • Improved PowerShell 5.1: PowerShell warns you about script execution risks before an Invoke-WebRequest request continues. You can choose to continue or cancel.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Removed People app: The People icon on the taskbar no longer responds because the feature is being deprecated.

    Read update Source: Microsoft

    Build
    17763.8146
    Security
    26 vulnerabilities fixed · 1 actively exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5071543

    PowerShell warns before web content can run scripts

    PowerShell 5.1 now warns before `Invoke-WebRequest` content can run scripts, addressing a publicly disclosed remote code execution risk. The update also addresses 15 Important vulnerabilities; an MSMQ issue was later resolved by KB5074974.

    Check the newer update, KB5074974
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review the guidance and prepare to update certificates to avoid possible boot disruptions.

    Key changes 15 CVEs · 1 change

    • Improved PowerShell 5.1: PowerShell 5.1 now warns about script execution risk before a web request, letting you continue or cancel.
    • CVSS 8.8 CVE-2025-62549: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2025-54100: PowerShell Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8688
    Security
    15 vulnerabilities fixed
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Out-of-band update Also for Windows 11
    Out-of-band

    KB5072359

    Prevents NVMe boot failures during Server 2025 upgrades

    The out-of-band update prevents a boot failure during some upgrades from Windows Server 2022 to Windows Server 2025 on Intel C2030 systems with Samsung NVMe devices. It also improves the component that installs Windows updates.

    Check the newer update, KB5072033
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates receives a quality improvement.
    • Fix Upgrade to Windows Server 2025: Upgrades from Windows Server 2022 no longer encounter the described boot failure on some Intel C2030 systems with Samsung NVMe devices.

    Read update Source: Microsoft

    Build
    26100.7178
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update Also for Windows 11
    Zero-day

    KB5068861

    Closes an exploited kernel flaw and adds post-quantum cryptography

    Fixes 31 vulnerabilities, including an exploited Windows Kernel elevation-of-privilege flaw, and adds support for two post-quantum cryptography algorithms. WSUS still does not show synchronization error details.

    Check the newer update, KB5072359
    Secure Boot certificates used by most Windows devices started expiring in June 2026. Devices without newer certificates continue to start and operate normally, and standard updates continue to install.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 31 CVEs · 18 changes

    • New Start menu: Administrators can apply Start menu pins once, so users can then change their pinned layout and keep their changes.
    • New Post-Quantum Cryptography: Apps can use two new post-quantum cryptography algorithms for key exchange, signing, and decryption.
    • Improved Servicing stack: Includes an update to the component that installs Windows updates, intended to make update installation more reliable.

    Read update Source: Microsoft

    Build
    26100.7171
    Security
    31 fixed · 2 critical · 1 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day

    KB5068787

    Exploited Windows kernel flaw patched; unexpected UAC prompts addressed

    The update fixes 30 vulnerabilities, including an actively exploited Windows kernel flaw, and addresses unexpected UAC prompts and HTTP request parsing behavior.

    Check the newer update, KB5071547
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 30 CVEs · 4 changes

    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Fix App compatibility (known issue): The update addresses unexpected User Account Control prompts for some apps, including Autodesk AutoCAD.
    • Fix Security: The update addresses a problem that could disrupt cloud communication after promoting a domain controller.

    Read update Source: Microsoft

    Build
    20348.4405
    Security
    30 fixed · 2 critical · 1 exploited
    Restart
    Required