Skip to the content
The Update Bureau

Windows Server

Windows Server updates

All published releases for Windows Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 13, 2026.

24 active known issues →

Windows Server updates

  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day

    KB5068791

    Exploited Windows kernel flaw addressed; unexpected UAC prompts fixed

    The update addresses an actively exploited Windows kernel flaw and unexpected UAC prompts during some app repairs. It also includes security improvements and a servicing stack update.

    Check the newer update, KB5071544
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid possible boot disruption.

    Key changes 32 CVEs · 3 changes

    • Improved Internal Windows OS: Windows includes miscellaneous security improvements to internal functionality; no specific issues are documented.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Fix App compatibility (known issue): Unexpected UAC prompts during MSI repair operations for some apps, including Autodesk AutoCAD, are addressed.

    Read update Source: Microsoft

    Build
    17763.8027
    Security
    32 fixed · 2 critical · 1 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5068864

    Critical GDI+ flaw patched; unexpected UAC prompts addressed

    Fixes 24 security vulnerabilities, including critical GDI+ remote code execution flaw CVE-2025-60724, and addresses unexpected UAC prompts for some apps, including Autodesk AutoCAD.

    Check the newer update, KB5071543
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Certain devices might lose the ability to boot securely if their certificates are not updated; review Microsoft's guidance and prepare in advance.

    Key changes 24 CVEs · 2 changes

    • Improved Internal Windows OS: Internal Windows OS functionality receives miscellaneous security improvements; no specific issues are documented.
    • Fix App compatibility (known issue): Unexpected User Account Control prompts for some apps, including Autodesk AutoCAD, are addressed.
    • Critical CVE-2025-60724: Windows GDI+ Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8594
    Security
    24 fixed · 1 critical
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Out-of-band security update Also for Windows 11
    Out-of-band

    KB5070881

    WSUS remote-code flaw patched; error details temporarily disappear

    The WSUS remote code execution flaw CVE-2025-59287 gets a patch. WSUS synchronization error details are temporarily unavailable, and a small number of Hotpatch servers may miss updates.

    Check the newer update, KB5068861
    Secure Boot certificates used by most Windows devices start expiring in June 2026. Review Microsoft's guidance and update certificates in advance.
    Known issues: 5 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details
    • Active Directory Replication
    • and 3 more

    Key changes 1 CVE · 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Fix Windows Server Update Services (WSUS): WSUS reporting web services get a fix for a remote code execution flaw.
    • Critical CVE-2025-59287: Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    26100.6905
    Security
    1 fixed · 1 critical
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Out-of-band security update
    Out-of-band

    KB5070884

    WSUS remote-code flaw fixed; synchronization error details disappear

    Fixes a critical remote code execution vulnerability in WSUS reporting web services. WSUS synchronization error details are temporarily unavailable after installation.

    Check the newer update, KB5068787
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid possible boot disruption.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 1 CVE · 3 changes

    • Improved Includes the security fixes and improvements from the October 14, 2025 update, KB5066782.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Fix Windows Server Update Services (WSUS): The remote code execution vulnerability in WSUS reporting web services is addressed.

    Read update Source: Microsoft

    Build
    20348.4297
    Security
    1 fixed · 1 critical
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Out-of-band security update Also for Windows 10
    Out-of-band

    KB5070883

    Critical WSUS flaw fixed; synchronization error details stay hidden

    Fixes a critical remote code execution flaw in WSUS reporting web services. WSUS synchronization error details are temporarily unavailable after installation.

    Check the newer update, KB5068791
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 1 CVE · 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements intended to help make update installation more reliable.
    • Fix Windows Server Update Services (WSUS): WSUS reporting web services receive a fix for a remote code execution vulnerability.
    • Critical CVE-2025-59287: Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    17763.7922
    Security
    1 fixed · 1 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Out-of-band security update Also for Windows 10
    Out-of-band

    KB5070882

    WSUS remote-code-execution flaw patched; sync error details hidden

    Addresses a critical remote code execution vulnerability in WSUS reporting web services. WSUS synchronization error details are temporarily unavailable after installation.

    Check the newer update, KB5068864
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid possible boot disruption.
    Known issues: 1 open Organizations and IT administrators
    • Windows Server Update Services (WSUS) does not display error details

    Key changes 1 CVE · 1 change

    • Fix Windows Server Update Services (WSUS): The remote code execution vulnerability in WSUS reporting web services is addressed.
    • Critical CVE-2025-59287: Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.8524
    Security
    1 fixed · 1 critical
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Out-of-band update Also for Windows 11
    Out-of-band

    KB5070773

    USB keyboards and mice work again in WinRE

    USB keyboards and mice work again in WinRE after the October 14 security update stopped them from working there. They continued to work normally in Windows.

    Check the newer update, KB5070881
    Secure Boot certificates used by most Windows devices start expiring in June 2026. Review Microsoft's guidance and update certificates in advance.
    Known issues: 3 open Organizations and IT administrators
    • Active Directory Replication
    • Directory synchronization (DirSync)
    • IIS websites might fail to load

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements to help devices receive and install updates reliably.
    • Fix USB: USB keyboards and mice work again in Windows Recovery Environment. They continued to work normally in Windows.

    Read update Source: Microsoft

    Build
    26100.6901
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update Also for Windows 11
    Zero-day

    KB5066835

    Exploited Remote Access flaw patched; recovery USB issue remains

    Fixes actively exploited Windows flaws, including one in Remote Access Connection Manager, and adds security and usability changes. USB keyboards and mice might not work in the recovery environment.

    Check the newer update, KB5070773
    Secure Boot certificates used by most Windows devices start expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid boot problems.
    Known issues: 4 open Organizations and IT administrators
    • Active Directory Replication
    • Directory synchronization (DirSync)
    • and 2 more

    Key changes 131 CVEs · 33 changes

    • New App defaults: In the European Economic Area, choosing a default browser can also set more file and link types and pin it to Start and the taskbar.
    • New Narrator: Screen Curtain blacks out the screen while Narrator reads aloud, helping keep visible content private.
    • New Narrator: Narrator guides users through prompts that explain new features and changes.

    Read update Source: Microsoft

    Build
    26100.6899
    Security
    131 fixed · 2 critical · 3 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day

    KB5066782

    Exploited Remote Access flaw addressed; downloaded-file previews disabled

    The update addresses security vulnerabilities, including exploited flaws, and changes File Explorer so it disables previews of files downloaded from the internet. It also fixes several server issues and removes a fax modem driver.

    Check the newer update, KB5070884
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid disruption.

    Key changes 104 CVEs · 10 changes

    • Improved Cryptography: RSA-based smart card certificates now use a security-hardened method, which might affect smart card authentication.
    • Improved File Explorer: File Explorer automatically disables previews for files downloaded from the internet, helping prevent a vulnerability when previewing p...
    • Improved Servicing stack: The update includes quality improvements to the component that installs Windows updates.

    Read update Source: Microsoft

    Build
    20348.4294
    Security
    104 fixed · 2 critical · 3 exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day

    KB5066586

    Exploited Remote Access Connection Manager flaw addressed

    Addresses an actively exploited elevation-of-privilege flaw in Remote Access Connection Manager and fixes several input and remote-management problems. It also changes File Explorer previews for downloaded files.

    Check the newer update, KB5070883
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and prepare to update certificates to avoid possible secure-boot disruption.

    Key changes 98 CVEs · 8 changes

    • Improved Cryptography: RSA-based smart card certificates must use the newer certificate storage method. Smart card authentication might be affected by this ch...
    • Improved File Explorer: File Explorer automatically disables previews for files downloaded from the internet, helping prevent a vulnerability when previewing p...
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements intended to make the update process more reliable.

    Read update Source: Microsoft

    Build
    17763.7919
    Security
    98 fixed · 2 critical · 3 exploited
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5066836

    Exploited modem and Remote Access flaws addressed

    Addresses exploited Windows modem and Remote Access flaws, fixes WinRM timeouts, and removes support for a fax modem driver. File Explorer also disables previews for files downloaded from the internet.

    Check the newer update, KB5070882

    Key changes 77 CVEs · 5 changes

    • Improved Cryptography: RSA-based smart card certificates now require Key Storage Provider instead of Cryptographic Service Provider. Smart card authentication...
    • Improved File Explorer: File Explorer automatically disables previews for files downloaded from the internet.
    • Fix Windows Remote Management (WinRM): PowerShell Remoting and WinRM commands no longer time out after 600 seconds.

    Read update Source: Microsoft

    Build
    14393.8519
    Security
    77 fixed · 1 critical · 3 exploited
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Out-of-band update Also for Windows 11
    Out-of-band

    KB5068221

    App-V Office app failures fixed

    Microsoft Office apps in App-V environments no longer fail because of a double handle closure. Plan for a restart after installing the update.

    Check the newer update, KB5066835
    Known issues: 3 open Organizations and IT administrators
    • Active Directory Replication
    • Directory synchronization (DirSync)
    • SMBv1 protocol connectivity

    Key changes 1 change

    • Fix Virtualization and platform compatibility: Office apps in App-V environments no longer fail because of a double handle closure.

    Read update Source: Microsoft

    Build
    26100.6588
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update Also for Windows 11

    KB5065426

    SMB flaw disclosed; older print clients lose access to updated servers

    An SMB elevation-of-privilege flaw is publicly disclosed, and older Windows print clients can no longer print to updated servers. PowerShell 2.0 is also removed.

    Check the newer update, KB5068221
    Known issues: 4 open Organizations and IT administrators
    • Active Directory Replication
    • Directory synchronization (DirSync)
    • and 2 more

    Key changes 64 CVEs · 31 changes

    • New Settings: Settings adds a FAQs section with answers about Windows Server setup, performance, and compatibility.
    • New Taskbar: Admins can let users unpin selected apps without those apps returning at the next policy refresh.
    • New Voice Access: Voice Access can highlight its new features and improvements in an in-app guide.

    Read update Source: Microsoft

    Build
    26100.6584
    Security
    64 fixed · 8 critical
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update

    KB5065432

    SMB flaw disclosed; MSI repair prompts reduced

    A publicly disclosed SMB elevation-of-privilege flaw is addressed, and fixes reduce unexpected prompts during some MSI repairs. Secure Boot certificates also need attention before they begin expiring in June 2026.

    Check the newer update, KB5066782
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and update certificates in advance.
    Known issues: 2 open Organizations and IT administrators
    • SMBv1 protocol connectivity
    • PSDirect connections failing in hotpatched devices

    Key changes 59 CVEs · 5 changes

    • New File server: Customers can check whether devices or software might have problems with SMB Server security settings before applying them.
    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Fix App compatibility (known issue): Some non-admin users see fewer unexpected prompts when apps repair or configure themselves. This can help those apps run.

    Read update Source: Microsoft

    Build
    20348.4171
    Security
    59 fixed · 8 critical
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

    KB5065428

    SMB compatibility auditing added; MSI repair prompts reduced

    The update adds SMB compatibility auditing and Certificate Revocation List partitioning, and reduces unexpected UAC prompts during some MSI repairs. It also addresses 52 vulnerabilities, including 7 Critical vulnerabilities.

    Check the newer update, KB5066586
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Microsoft recommends reviewing its guidance and updating certificates in advance to avoid disruption.

    Key changes 52 CVEs · 3 changes

    • New Active Directory: Windows Certificate Authorities can use Certificate Revocation List partitioning.
    • New File Server: IT administrators can check whether SMB clients might be incompatible with SMB Server signing and EPA before deploying the related hard...
    • Fix App compatibility (known issue): Unexpected UAC prompts during some MSI repairs are reduced. IT administrators can allowlist specific apps to disable prompts for those...

    Read update Source: Microsoft

    Build
    17763.7792
    Security
    52 fixed · 7 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5065427

    SMB compatibility auditing added; MSI repair prompts reduced

    Adds a way to audit SMB client compatibility before hardening and reduces unexpected UAC prompts during some MSI actions. The update also addresses 45 vulnerabilities, including five rated critical.

    Check the newer update, KB5066836

    Key changes 45 CVEs · 2 changes

    • New File Server: IT teams can check SMB client compatibility before deploying SMB Server hardening measures.
    • Fix App compatibility (known issue): Non-admin users are less likely to see unexpected UAC prompts during certain MSI installer actions, including repairs.
    • Critical CVE-2025-54918: Windows NTLM Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14393.8422
    Security
    45 fixed · 5 critical
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Out-of-band update Also for Windows 10
    Out-of-band

    KB5066187

    Secure Boot certificates begin expiring in June 2026

    Improves the servicing stack. Secure Boot certificates used by most Windows devices have started expiring in June 2026, so review Microsoft's guidance and prepare to update them.

    Check the newer update, KB5065428
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and prepare to update certificates to avoid possible boot disruption.

    Key changes 1 change

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements intended to make the update process more reliable.

    Read update Source: Microsoft

    Build
    17763.7683
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update Also for Windows 11

    KB5063878

    Critical graphics flaws patched; Active Directory issue remains open

    Critical graphics and DirectX flaws get security fixes, alongside fixes for network and File Explorer problems. Active Directory replication issues remain listed, with KB5068861 named as addressing them.

    Check the newer update, KB5065426
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and update certificates in advance.
    Known issues: 1 open Organizations and IT administrators
    • Active Directory Replication

    Key changes 61 CVEs · 20 changes

    • Improved Desktop icons: Packaged app icons on the desktop no longer have a colored background plate and are easier to see.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Fix Display: Switching display modes with Win + P works without pressing the shortcut twice.

    Read update Source: Microsoft

    Build
    26100.4946
    Security
    61 fixed · 5 critical
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update

    KB5063880

    Critical GDI+ remote-code flaw patched; Changjie IME fixed

    A critical GDI+ flaw could allow remote code execution, and the Changjie Chinese input problem is fixed. Standard users might also see UAC prompts during MSI repairs.

    Check the newer update, KB5065432
    Secure Boot certificates have started expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid possible boot problems.

    Key changes 56 CVEs · 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Fix Input (know issue): The Changjie input method for Traditional Chinese works again after problems with typing, word selection, and the candidate window.
    • Critical CVE-2025-53766: GDI+ Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    20348.4052
    Security
    56 fixed · 4 critical
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

    KB5063877

    GDI+ remote-code flaw fixed; BitLocker cluster restarts stopped

    Fixes 54 vulnerabilities, including three critical flaws, and stops repeated Cluster Service failures on BitLocker configurations using Cluster Shared Volumes.

    Check the newer update, KB5066187
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid possible boot disruption.

    Key changes 54 CVEs · 3 changes

    • Improved Servicing stack: The component that installs Windows updates gets reliability improvements that help mitigate potential problems during installation.
    • Fix Cluster Service: The Cluster Service no longer repeatedly stops and restarts on the affected servers, preventing cluster nodes from failing to rejoin or...
    • Fix Input and Composition: Users can select words again with the Microsoft Changjie Input Method.

    Read update Source: Microsoft

    Build
    17763.7678
    Security
    54 fixed · 3 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5063871

    GDI+ flaw patched; Changjie word selection restored

    The update fixes 48 vulnerabilities, including three critical flaws in GDI+, Microsoft Message Queuing, and Windows NTLM. It also restores word selection in the Microsoft Changjie Input Method.

    Check the newer update, KB5065427

    Key changes 48 CVEs · 1 change

    • Fix Input and Composition: Users can select words again with the Microsoft Changjie Input Method.
    • Critical CVE-2025-53766: GDI+ Remote Code Execution Vulnerability
    • Critical CVE-2025-53778: Windows NTLM Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    14393.8330
    Security
    48 fixed · 3 critical
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Out-of-band update Also for Windows 11
    Out-of-band

    KB5064489

    Azure VM startup issue addressed; Active Directory replication risk remains

    Some Azure virtual machines with Virtualization-Based Security enabled could not start; this update addresses that issue. Active Directory replication can still fail on affected domain controllers.

    Check the newer update, KB5063878
    Secure Boot certificates began expiring in June 2026. Review Microsoft's guidance and update certificates in advance to avoid boot problems.
    Known issues: 1 open Organizations and IT administrators
    • Active Directory Replication

    Key changes 3 changes

    • Improved Includes the security fixes and improvements from the July 8, 2025 security update.
    • Improved Servicing stack: The servicing stack update improves the component that installs Windows updates.
    • Fix Azure Virtual Machines: Some Azure virtual machines could not start when Virtualization-Based Security was enabled. This update addresses the issue.

    Read update Source: Microsoft

    Build
    26100.4656
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update Also for Windows 11

    KB5062553

    Fixes 102 vulnerabilities (5 critical)

    Critical flaws in NEGOEX and Hyper-V are among the security fixes. The update also fixes issues with authentication, graphics, and other server features.

    Check the newer update, KB5064489
    Secure Boot certificates have started expiring in June 2026. Microsoft recommends reviewing its guidance and updating certificates in advance.
    Known issues: 2 open Organizations and IT administrators
    • Active Directory Replication
    • Azure VM with Trusted Launch disabled

    Key changes 102 CVEs · 23 changes

    • Improved Task manager: Task Manager uses consistent CPU workload measures on its Processes, Performance, and Users pages.
    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Fix Application installation: Installing apps with many files takes less time in some cases.

    Read update Source: Microsoft

    Build
    26100.4652
    Security
    102 fixed · 5 critical
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update

    KB5062572

    Critical NEGOEX flaw patched; Changjie typing issue remains

    A critical SPNEGO NEGOEX flaw could allow remote code execution. Some users might also have trouble typing Traditional Chinese with the Changjie input method.

    Check the newer update, KB5063880
    Secure Boot certificates used by most Windows devices have started expiring in June 2026. Review Microsoft's guidance and prepare to update them.

    Key changes 96 CVEs · 5 changes

    • Improved Microsoft RPC Netlogon protocol: Some anonymous requests to domain controllers are blocked. Certain file and print software might be affected.
    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Fix DHCP Server (known issue): The DHCP Server service might stop responding and disrupt IP renewal for clients. This issue is fixed.

    Read update Source: Microsoft

    Build
    20348.3932
    Security
    96 fixed · 5 critical
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

    KB5062557

    SPNEGO remote-code flaw patched; DHCP renewal failures fixed

    Patches critical vulnerabilities, including a remote-code execution flaw in SPNEGO, and fixes DHCP service interruptions that affected client IP renewal.

    Check the newer update, KB5063877
    Secure Boot certificates have started expiring and might affect secure startup from June 2026. Review Microsoft's guidance and update certificates in advance.

    Key changes 94 CVEs · 4 changes

    • Improved Microsoft RPC Netlogon protocol: Some Netlogon requests have tighter access checks, which improves security.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Fix Network Security and Containers: Character rendering works correctly for GB18030-2022 compliance.

    Read update Source: Microsoft

    Build
    17763.7558
    Security
    94 fixed · 5 critical
    Restart
    Required