Skip to the content
The Update Bureau

Windows Server

Windows Server updates

All published releases for Windows Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 13, 2026.

24 active known issues →

Windows Server updates

  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5053594

    Exploited kernel, NTFS and FAT flaws addressed

    Addresses actively exploited flaws in Windows, including kernel, NTFS and FAT vulnerabilities, and adds safer temporary-file storage for system processes.

    Check the newer update, KB5055521

    Key changes 34 CVEs · 3 changes

    • Improved Temporary files: System processes can store temporary files in a protected folder, reducing the risk of unauthorized access.
    • Improved Daylight saving time (DST): Daylight-saving-time changes for Paraguay are included.
    • Fix Use-after-free (UAF) risk: Process creation no longer has the reported risk of using freed memory.

    Read update Source: Microsoft

    Build
    14393.7876
    Security
    34 fixed · 5 critical · 6 exploited
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update Also for Windows 11
    Zero-day

    KB5051987

    Exploited storage and networking flaws patched; Remote Desktop issues noted

    Fixes 38 vulnerabilities, including two critical flaws and two vulnerabilities already exploited. It also fixes USB audio and camera problems, while known issues affect Citrix update installation, Remote Desktop, and Azure Arc Setup.

    Check the newer update, KB5053598
    Known issues: 3 open
    • Citrix
    • Remote desktop
    • Azure Arc Setup wizard app

    Key changes 38 CVEs · 4 changes

    • Improved Microsoft RPC Netlogon protocol: The update page now clarifies that Microsoft RPC Netlogon protocol was enabled by default on Windows Server 2025 starting in May 2025.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Fix Digital/Analog converter (DAC): USB audio devices might stop working and stop playback less often, especially when using a USB 1.0-based DAC audio driver.

    Read update Source: Microsoft

    Build
    26100.3194
    Security
    38 fixed · 2 critical · 2 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day

    KB5051979

    Exploited Storage and Winsock driver flaws patched

    Attackers are exploiting elevation-of-privilege flaws in Windows Storage and the Winsock ancillary function driver. The update also fixes server issues, including USB audio playback problems.

    Check the newer update, KB5053603
    Known issues: 3 open
    • Citrix
    • System Guard Runtime Monitor Broker service
    • Open Secure Shell service

    Key changes 34 CVEs · 11 changes

    • New GB18030-2022: Adds support for the GB18030-2022 amendment.
    • Improved Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b): Adds more at-risk drivers to the blocklist that helps protect against attacks using vulnerable drivers.
    • Improved Servicing stack: Includes an update to the component that installs Windows updates.

    Read update Source: Microsoft

    Build
    20348.3207
    Security
    34 fixed · 1 critical · 2 exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day

    KB5052000

    Fixes 34 vulnerabilities (1 critical, 2 exploited)

    Windows Storage and WinSock elevation-of-privilege flaws are under active attack. The update also fixes USB camera, audio, and Microsoft Edge issues.

    This update is no longer available as of March 31, 2026. Windows Server 2019 updates end January 9, 2029.
    Known issues: 2 open Organizations and IT administrators
    • Citrix
    • Open Secure Shell service

    Key changes 34 CVEs · 7 changes

    • New GB18030-2022: Adds support for the GB18030-2022 amendment.
    • Improved Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b): Adds drivers at risk from Bring Your Own Vulnerable Driver attacks to the blocklist.
    • Improved Servicing stack: The component that installs Windows updates gets quality improvements to help devices receive and install updates reliably.

    Read update Source: Microsoft

    Build
    17763.6893
    Security
    34 fixed · 1 critical · 2 exploited
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5052006

    USB camera status and audio playback issues fixed

    The update fixes a USB camera status problem and USB audio failures, including a playback issue more likely with some DAC drivers. It also closes 33 vulnerabilities, including one critical flaw and two being exploited.

    Check the newer update, KB5053594

    Key changes 33 CVEs · 3 changes

    • Fix USB cameras: Devices recognize when the camera is on again after the January 2025 security update.
    • Fix USB audio device drivers: Certain external audio management devices no longer show a code 10 “This device cannot start” error when connected.
    • Fix Digital/Analog converter (DAC): USB audio devices that might stop working and interrupt playback are addressed. This is more likely with a DAC audio driver based on US...

    Read update Source: Microsoft

    Build
    14393.7785
    Security
    33 fixed · 1 critical · 2 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Out-of-band update
    Out-of-band

    KB5052819

    Fixes startup failures on servers with multiple NUMA nodes

    Fixes a startup failure affecting some servers with two or more NUMA nodes and improves the servicing stack.

    Check the newer update, KB5051979

    Key changes 2 changes

    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Fix Non-uniform memory access (NUMA) nodes: Some servers with two or more NUMA nodes can start up again.

    Read update Source: Microsoft

    Build
    20348.3095
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update Also for Windows 11
    Zero-day

    KB5050009

    Exploited Hyper-V flaws patched; USB audio issues reported

    Fixes 126 vulnerabilities, including three exploited Hyper-V elevation-of-privilege flaws. It also expands the vulnerable-driver blocklist; USB audio might stop working after installation.

    Check the newer update, KB5051987

    Key changes 126 CVEs · 2 changes

    • Improved Windows Kernel Vulnerable Driver Blocklist file: More at-risk drivers are added to the blocklist to help protect against attacks that use vulnerable drivers.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Exploited CVE-2025-21333: Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    26100.2894
    Security
    126 fixed · 9 critical · 3 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update

    KB5049983

    Remote Desktop and OLE flaws patched; vulnerable-driver list grows

    Patches 122 vulnerabilities, including eight critical flaws, and adds at-risk drivers to the blocklist to help guard against BYOVD attacks.

    Check the newer update, KB5052819

    Key changes 122 CVEs · 2 changes

    • Improved Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b): The vulnerable-driver blocklist includes more drivers that could be used in BYOVD attacks.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Critical CVE-2025-21298: Windows OLE Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    20348.3091
    Security
    122 fixed · 8 critical
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10

    KB5050008

    Critical OLE and Remote Desktop flaws patched; driver blocklist expanded

    Fixes 118 vulnerabilities, including 8 Critical flaws across several Windows components. It also adds vulnerable drivers to the blocklist to help guard against BYOVD attacks.

    Check the newer update, KB5058922

    Key changes 118 CVEs · 2 changes

    • Improved Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b): The list of drivers considered at risk of BYOVD attacks grows.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements.
    • Critical CVE-2025-21298: Windows OLE Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    17763.6775
    Security
    118 fixed · 8 critical
    Restart
    Required
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10

    KB5049993

    Windows OLE remote-code-execution flaw among critical fixes

    Addresses 111 vulnerabilities, including 8 critical flaws. It also adds at-risk drivers to the vulnerable driver blocklist; USB audio problems are resolved by KB5052006.

    Check the newer update, KB5052006

    Key changes 111 CVEs · 1 change

    • Improved Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b): The vulnerable driver blocklist covers more drivers that attackers could abuse by bringing their own vulnerable driver.
    • Critical CVE-2025-21298: Windows OLE Remote Code Execution Vulnerability
    • Critical CVE-2025-21307: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.7699
    Security
    111 fixed · 8 critical
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update Also for Windows 11
    Zero-day

    KB5048667

    Actively exploited Common Log File System flaw addressed

    The update addresses an actively exploited flaw in the Common Log File System Driver. It covers 57 vulnerabilities, including 15 critical ones.

    Check the newer update, KB5050009

    Key changes 57 CVEs · 2 changes

    • Improved Internal OS functionality: Parts of the operating system get security improvements.
    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Exploited CVE-2024-49138: Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    26100.2605
    Security
    57 fixed · 15 critical · 1 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day

    KB5048654

    Exploited log-file driver flaw patched; motherboard activation fixed

    The update patches 41 vulnerabilities, including an actively exploited flaw in the Common Log File System Driver, and fixes Windows activation after a motherboard replacement.

    Check the newer update, KB5049983

    Key changes 41 CVEs · 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements to help devices receive and install updates reliably.
    • Fix Motherboard replacement: Windows activates again after a motherboard replacement.
    • Exploited CVE-2024-49138: Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    20348.2966
    Security
    41 fixed · 15 critical · 1 exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day

    KB5048661

    Exploited log-file driver flaw patched; motherboard activation fixed

    Fixes a Windows activation problem after motherboard replacement and addresses security issues, including an actively exploited privilege-escalation flaw in the Common Log File System Driver.

    As of March 31, 2026, this update is no longer available through Microsoft release channels; Microsoft recommends updating devices to the latest Windows version.

    Key changes 55 CVEs · 2 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements to help devices receive and install Microsoft updates reliably.
    • Fix Motherboard replacement: Windows activates after you replace a motherboard.
    • Exploited CVE-2024-49138: Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    17763.6659
    Security
    55 fixed · 13 critical · 1 exploited
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5048671

    Exploited CLFS driver flaw patched; critical LDAP risks addressed

    The update patches 32 vulnerabilities, including 11 critical ones. It addresses an exploited Common Log File System Driver flaw and a publicly disclosed Winlogon flaw.

    Check the newer update, KB5049993

    Key changes 32 CVEs · 1 change

    • Improved Windows operating system: The update includes miscellaneous security improvements to internal operating system functionality. No additional issues are documented...
    • Exploited CVE-2024-49138: Windows Common Log File System Driver Elevation of Privilege Vulnerability
    • Critical CVE-2024-49112: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    14393.7606
    Security
    32 fixed · 11 critical · 1 exploited
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Security update Also for Windows 11
    Zero-day

    KB5046617

    Exploited Task Scheduler flaw patched; Dev Drive access restored

    The update fixes 32 vulnerabilities, including two critical ones and two that attackers are exploiting. It also restores Dev Drive access from WSL and fixes several other installation and connectivity problems.

    Check the newer update, KB5048667

    Key changes 32 CVEs · 5 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements.
    • Fix Task Manager: Task Manager shows the correct group count on the Processes tab when you turn on “Group by type.”
    • Fix Windows Subsystem for Linux (WSL): You can access your Dev Drive from WSL again.

    Read update Source: Microsoft

    Build
    26100.2314
    Security
    32 fixed · 2 critical · 2 exploited
    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day

    KB5046616

    Exploited Task Scheduler flaw patched; backup failure fixed

    Fixes 37 vulnerabilities, including two critical flaws and two that are being exploited. It also fixes Windows Backup failures on devices with an EFI system partition.

    Check the newer update, KB5048654

    Key changes 37 CVEs · 9 changes

    • Improved Product activation phone numbers: New product activation phone numbers are available for several regions.
    • Improved Windows Kernel Vulnerable Driver Blocklist file: The blocklist includes more drivers that could put devices at risk.
    • Improved Remote Desktop Connection Broker in high availability mode: Smart-card authentication now uses Kerberos in Remote Desktop Connection Broker high availability mode.

    Read update Source: Microsoft

    Build
    20348.2849
    Security
    37 fixed · 2 critical · 2 exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day

    KB5046615

    Exploited Task Scheduler flaw patched; VM switch crash fixed

    Fixes a VM switch stop error and addresses exploited security flaws, including one in Task Scheduler. It also expands the vulnerable-driver blocklist.

    As of March 31, 2026, this update is no longer available through Microsoft Update Catalog or other release channels. Microsoft recommends updating devices to the latest version of Windows.

    Key changes 31 CVEs · 3 changes

    • Improved Servicing stack: The component that installs Windows updates gets quality improvements to help devices receive and install updates reliably.
    • Fix vmswitch: A stop error no longer occurs in the described virtual machine setup when using two virtual switches.
    • Fix Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b): The vulnerable-driver blocklist includes additional drivers that could be used in BYOVD attacks.

    Read update Source: Microsoft

    Build
    17763.6532
    Security
    31 fixed · 1 critical · 2 exploited
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5046612

    Exploited NTLM and Task Scheduler flaws patched; vmswitch crash fixed

    The update fixes 27 vulnerabilities, including exploited CVE-2024-43451 and CVE-2024-49039, and fixes a vmswitch stop error in a specific LBFO and SR-IOV setup.

    Check the newer update, KB5048671

    Key changes 27 CVEs · 1 change

    • Fix vmswitch: A vmswitch stop error is fixed when a virtual machine uses LBFO teaming with two virtual switches, one using SR-IOV.
    • Exploited CVE-2024-49039: Windows Task Scheduler Elevation of Privilege Vulnerability
    • Exploited CVE-2024-43451: NTLM Hash Disclosure Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    14393.7515
    Security
    27 fixed · 1 critical · 2 exploited
    Restart
    Required
  • Windows Server 2025 Windows Server 2025 Out-of-band update Also for Windows 11
    Out-of-band

    KB5044284

    Out-of-band update requires a restart

    This out-of-band cumulative update for Windows Server 2025 requires a restart. The available information does not describe specific fixes or features.

    Check the newer update, KB5046617

    Key security notes

    • Other This is an out-of-band cumulative update; no specific fixes or features are listed in the available information.

    Read update Source: Microsoft

    Restart
    Required
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day

    KB5044281

    Exploited MMC and MSHTML flaws patched; server issues fixed

    Fixes 67 vulnerabilities, including two exploited flaws and a critical Remote Desktop Protocol server flaw. It also improves large-scale SDN performance and fixes several server and app problems.

    Check the newer update, KB5047767

    Key changes 67 CVEs · 9 changes

    • New Software Defined Networking (SDN): The SDN API performs better in large-scale deployments. Load balancer connectivity issues might occur after installation.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements to help devices receive and install updates reliably.
    • Fix MSIX applications: MSIX apps installed from an HTTPS address open correctly when their download is complete.

    Read update Source: Microsoft

    Build
    20348.2762
    Security
    67 fixed · 1 critical · 2 exploited
    Restart
    Required
  • Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day

    KB5044277

    Exploited MMC and MSHTML flaws patched; Remote Desktop fixed

    Fixes security issues, including flaws attackers are exploiting, and addresses sporadic Remote Desktop disconnections on some servers.

    As of March 31, 2026, this update is no longer available through Microsoft release channels. Microsoft recommends updating devices to the latest version of Windows.

    Key changes 79 CVEs · 3 changes

    • Improved Servicing stack: The included servicing stack update improves the component that installs Windows updates.
    • Fix FrameShutdownDelay: The browser honors the FrameShutdownDelay value in the registry.
    • Fix Remote Desktop: Fixes an issue that could sporadically disrupt Remote Desktop connections on Windows Servers using a legacy protocol in the Remote Desk...

    Read update Source: Microsoft

    Build
    17763.6414
    Security
    79 fixed · 1 critical · 2 exploited
  • Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day

    KB5044293

    Exploited MMC flaw addressed; Remote Desktop drops fixed

    The update addresses 56 security vulnerabilities, including actively exploited MMC remote-code-execution and MSHTML spoofing flaws, and fixes Remote Desktop disconnections with legacy gateway protocols. It is no longer available as of March 31, 2026.

    As of March 31, 2026, this update is no longer available through Microsoft Update Catalog or other release channels. Microsoft recommends updating devices to the latest version of Windows.

    Key changes 56 CVEs · 1 change

    • Fix Remote Desktop (known issue): Remote Desktop connections on Windows Servers might no longer drop sporadically when a legacy protocol is used in the Remote Desktop Ga...
    • Exploited CVE-2024-43572: Microsoft Management Console Remote Code Execution Vulnerability
    • Exploited CVE-2024-43573: Windows MSHTML Platform Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    14393.7428
    Security
    56 vulnerabilities fixed · 2 actively exploited
  • Windows Server 2022 Windows Server 2022 Security update
    Zero-day

    KB5042881

    Exploited Windows flaws closed; installer prompts change

    The update fixes 41 security vulnerabilities, including three being exploited, and changes how Windows Installer repairs prompt for credentials. Some users might be unable to change their account profile picture.

    Check the newer update, KB5044281
    Known issues: 1 open
    • After installing this update, you might be unable to [change your user account profile picture](https://support.microsoft.com/en-us/windows/change-your-account-picture-3645cdc7-acab-49d2-76a9-4ce7e5e…

    Key changes 41 CVEs · 6 changes

    • Improved Windows Installer: When Windows Installer repairs an application, a User Account Control prompt now asks for credentials.
    • Improved Dual boot of Windows and Linux (known issue): Linux might fail to start when Windows and Linux are set up to boot on the same device.
    • Improved Servicing stack: The component that installs Windows updates receives quality improvements to help devices receive and install updates reliably.

    Read update Source: Microsoft

    Build
    20348.2700
    Security
    41 fixed · 2 critical · 3 exploited
    Restart
    Required