Windows Server 17763.7009 → 17763.9020

25 releases · 0 breaking changes · 95 security fixes · 48 advisories fixed

95security0breaking1deprecated6feature20fix

Is 17763.7009 affected? · What changed up to 26100.33650

Vulnerabilities fixed by this upgrade

7.8 CVE-2026-42982 Windows Secure Kernel Mode Elevation of Privilege Vulnerability
8.8 CVE-2026-48564 DHCP Server Service Remote Code Execution Vulnerability
8.1 CVE-2026-49164 Windows Active Directory Domain Services Remote Code Execution Vulnerability
7.8 CVE-2026-49796 Windows GDI+ Remote Code Execution Vulnerability
8.8 CVE-2026-50370 DHCP Server Service Remote Code Execution Vulnerability
9.6 CVE-2026-50380 Windows GDI+ Remote Code Execution Vulnerability
8.8 CVE-2026-50382 DirectX Graphics Kernel Remote Code Execution Vulnerability
8.8 CVE-2026-50444 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
8.8 CVE-2026-50474 Remote Desktop Client Remote Code Execution Vulnerability
9.8 CVE-2026-50518 Windows DHCP Server Remote Code Execution Vulnerability
7.8 CVE-2026-50655 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
8.2 CVE-2026-50680 Windows Hyper-V Elevation of Privilege Vulnerability
8.1 CVE-2026-50694 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
8.8 CVE-2026-54121 Active Directory Certificate Services Elevation of Privilege Vulnerability
8.4 CVE-2026-54128 Windows DHCP Client Remote Code Execution Vulnerability
8.8 CVE-2026-54982 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
8.4 CVE-2026-54992 Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
8.1 CVE-2026-54995 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
8.8 CVE-2026-54999 Windows TCP/IP Remote Code Execution Vulnerability
7.8 CVE-2026-56155KEV Active Directory Federation Services Elevation of Privilege Vulnerability
9.8 CVE-2026-56159 DHCP Server Service Remote Code Execution Vulnerability
9.8 CVE-2026-56188 Windows Server Network driver Remote Code Execution Vulnerability
7.8 CVE-2026-56189 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
8.8 CVE-2026-57087 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
8.8 CVE-2026-57090 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
9.9 CVE-2026-57092 Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
8.8 CVE-2026-57094 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
8.8 CVE-2026-58608 Windows Print Spooler Remote Code Execution Vulnerability
7.8 CVE-2026-33828 Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
8.8 CVE-2026-42985 Remote Desktop Client Remote Code Execution Vulnerability
8.1 CVE-2026-42987 Windows Deployment Services (WDS) Remote Code Execution
7.5 CVE-2026-42992 Remote Desktop Client Remote Code Execution Vulnerability
7.5 CVE-2026-44799 Remote Desktop Client Remote Code Execution Vulnerability
7.5 CVE-2026-44801 Remote Desktop Client Remote Code Execution Vulnerability
7.8 CVE-2026-44803 Windows Graphics Component Remote Code Execution Vulnerability
7.8 CVE-2026-44812 Windows Graphics Component Remote Code Execution Vulnerability
9.8 CVE-2026-44815 DHCP Client Service Remote Code Execution Vulnerability
8.4 CVE-2026-45607 Windows Hyper-V Remote Code Execution Vulnerability
7.1 CVE-2026-47288 Windows Kerberos Key Distribution Center (KDC) Remote Code Execution
8.8 CVE-2026-47289 Remote Desktop Client Remote Code Execution Vulnerability
9.8 CVE-2026-47291 HTTP.sys Remote Code Execution Vulnerability
7.5 CVE-2026-47654 Remote Desktop Client Remote Code Execution Vulnerability
7.5 CVE-2026-48563 Remote Desktop Client Remote Code Execution Vulnerability
7.8 CVE-2026-48574 Windows Media Remote Code Execution Vulnerability
7.5 CVE-2026-32161 Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
7.8 CVE-2026-35421 Windows GDI Remote Code Execution Vulnerability
8.8 CVE-2026-40403 Windows Graphics Component Remote Code Execution Vulnerability
9.8 CVE-2026-41089 Windows Netlogon Remote Code Execution Vulnerability

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-56155: Active Directory Federation Services Elevation of Privilege Vulnerability in 17763.9020
security Fixes CVE-2026-57092: Microsoft Windows VMSwitch Elevation of Privilege Vulnerability in 17763.9020
security Fixes CVE-2026-50518: Windows DHCP Server Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-56159: DHCP Server Service Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-56188: Windows Server Network driver Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-50380: Windows GDI+ Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-48564: DHCP Server Service Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-50370: DHCP Server Service Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-50382: DirectX Graphics Kernel Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-50444: Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability in 17763.9020
security Fixes CVE-2026-50474: Remote Desktop Client Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-54121: Active Directory Certificate Services Elevation of Privilege Vulnerability in 17763.9020
security Fixes CVE-2026-54982: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-54999: Windows TCP/IP Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-57087: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-57090: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-57094: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-58608: Windows Print Spooler Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-54128: Windows DHCP Client Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-54992: Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-50680: Windows Hyper-V Elevation of Privilege Vulnerability in 17763.9020
security Fixes CVE-2026-49164: Windows Active Directory Domain Services Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-50694: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-54995: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-42982: Windows Secure Kernel Mode Elevation of Privilege Vulnerability in 17763.9020
security Fixes CVE-2026-49796: Windows GDI+ Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-50655: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-56189: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 17763.9020
security Fixes CVE-2026-44815: DHCP Client Service Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-47291: HTTP.sys Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-42985: Remote Desktop Client Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-47289: Remote Desktop Client Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-45607: Windows Hyper-V Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-42987: Windows Deployment Services (WDS) Remote Code Execution in 17763.8880
security Fixes CVE-2026-33828: Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability in 17763.8880
security Fixes CVE-2026-44803: Windows Graphics Component Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-44812: Windows Graphics Component Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-48574: Windows Media Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-42992: Remote Desktop Client Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-44799: Remote Desktop Client Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-44801: Remote Desktop Client Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-47654: Remote Desktop Client Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-48563: Remote Desktop Client Remote Code Execution Vulnerability in 17763.8880
security Fixes CVE-2026-47288: Windows Kerberos Key Distribution Center (KDC) Remote Code Execution in 17763.8880
security Fixes CVE-2026-41089: Windows Netlogon Remote Code Execution Vulnerability in 17763.8755
security Fixes CVE-2026-40403: Windows Graphics Component Remote Code Execution Vulnerability in 17763.8755
security Fixes CVE-2026-35421: Windows GDI Remote Code Execution Vulnerability in 17763.8755
security Fixes CVE-2026-32161: Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability in 17763.8755
security Security update: includes the April 2026 Security Updates in 17763.8647
security [Domain controllers (known issue)] Fixed: After installing the April 14, 2026, (KB5082123) Windows security update and restarting, domain controllers with multi-domain forests that use Privileged Access Management (PAM), might experience startup issues. In some cases, Local Security Authority… in 17763.8647
security Security update: includes the April 2026 Security Updates in 17763.8644
security [Remote Desktop] This update improves protection against phishing attacks that use Remote Desktop (.rdp) files. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. A one-time security warning also appears… in 17763.8644
security [Vulnerable driver blocklist] This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. Backup applications that rely on blocked drivers might experience failures when attempting to mount or manage disk images. These… in 17763.8644
security [Windows Deployment Services (WDS)] This update disables the “Hands-Free Deployment” feature in WDS by default and is no longer a supported feature. For more information about this change, see Windows Deployment Services (WDS) Hands-Free Deployment Hardening Guidance related to CVE-2026-0386. in 17763.8644
security [Kerberos protocol] This update changes the default DefaultDomainSupportedEncTypes value for Kerberos Key Distribution Center (KDC) operations to leverage AES-SHA1 for accounts that do not have an explicit msds-SupportedEncryptionTypes Active Directory attribute defined. For more information see,… in 17763.8644
security This update enables dynamic status reporting for Secure Boot states in the Windows Security App (Settings > Update & Security > Windows Security). Learn more about the status alerts via badges and notifications. Note that these enhancements are disabled by default on commercial devices and servers. in 17763.8644
security Security update: includes the March 2026 Security Updates in 17763.8511
security Security update: includes the February 2026 Security Updates in 17763.8389
security [OS Security (known issue)] Fixed: After installing the Windows security update released on or after January 13, 2026, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts. in 17763.8389
security Security update: includes the January 2026 Security Updates in 17763.8281
security Security update: includes the January 2026 Security Updates in 17763.8280
security Security update: includes the January 2026 Security Updates in 17763.8276
security [Credentials autofill] This update introduces a security hardening behavior restricting certain applications to autofill credentials during remote support sessions or automated authentication workflows. With this change, credential dialogs do not respond to virtual keyboard input from remote… in 17763.8276
security [WinSqlite3.dll] Fixed: The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. Note WinSqlite3.dll is a separate component from sqlite3.dll, which is found in application-specific directories and is not a… in 17763.8276
security Security update: includes the December 2025 Security Updates in 17763.8148
security Security update: includes the December 2025 Security Updates in 17763.8146
security [PowerShell 5.1] The Invoke-WebRequest command now includes a confirmation prompt with a security warning of a script execution risk. You can choose to continue or cancel the request. For additional details, see CVE-2025-54100 and KB5074596: PowerShell 5.1: Preventing script execution from web… in 17763.8146
security Security update: includes the November 2025 Security Updates in 17763.8027
security [App compatibility (known issue)] Fixed: This update addresses an issue that created unexpected User Account Control (UAC) prompts for some apps, including Autodesk AutoCAD. For more information, see Unexpected UAC prompts when running MSI repair operations after installing the August 2025 Windows… in 17763.8027
security [Internal Windows OS] This update contains miscellaneous security improvements to internal Windows OS functionality. No specific issues are documented for this release. in 17763.8027
security Security update: includes the October 2025 Security Updates in 17763.7922
security [Windows Server Update Services (WSUS)] Fixed: This update addresses a remote code execution (RCE) vulnerability that was identified in WSUS reporting web services. For more information about the security fix, see CVE-2025-59287. in 17763.7922
security Security update: includes the October 2025 Security Updates in 17763.7919
security This update enforces a security hardening improvement by requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. If you experience problems with smart card authentication as a result of this design change, see the Windows… in 17763.7919
security After installing this update, File Explorer automatically disables the preview feature for files downloaded from the internet. This change is designed to enhance security by preventing a vulnerability when users preview potentially unsafe files. For details, including steps to unblock files, see… in 17763.7919
security Fixed: This update addresses an issue observed in rare cases after installing the May 2025 security update and subsequent updates causing devices to experience stability issues. Some devices became unresponsive and stopped responding in specific scenarios. in 17763.7919
security Security update: includes the September 2025 Security Updates in 17763.7792
security [App compatibility (known issue)] Fixed: Addresses an issue that caused non-admin users to receive unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions. These actions might include configuration or repair operations in the foreground or background,… in 17763.7792
security [File Server] New! This update enables auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA. This allows customers to assess their environment and identify any potential device or software incompatibility issues before deploying the hardening measures that are already… in 17763.7792
security Security update: includes the August 2025 Security Updates in 17763.7683
security [Fix for reset and recovery issue] This update addresses an issue introduced by the August 2025 security update (KB5063877) in which attempts to reset and recover the device fails. This issue happens when users perform one or more of the following processes: For more information on this issue, see… in 17763.7683
security Security update: includes the August 2025 Security Updates in 17763.7678
security Security update: includes the July 2025 Security Updates in 17763.7558
security [Network Security and Containers] Fixed: An issue in the CharNextW function which caused incorrect character rendering for GB18030-2022 compliance. The function has been deprecated and replaced with a modern ICU-based solution to ensure proper handling of GB18030-2022 requirements. in 17763.7558
security [Microsoft RPC Netlogon protocol] This update includes a security hardening change to the Microsoft RPC Netlogon protocol. This change improves security by tightening access checks for a set of remote procedure call (RPC) requests. After this update is installed, Active Directory domain… in 17763.7558
security Security update: includes the June 2025 Security Updates in 17763.7434
security Security update: includes the May 2025 Security Updates in 17763.7322
security Security update: includes the May 2025 Security Updates in 17763.7314
security [OS Security] Updates to the Windows Kernel Vulnerable Driver Blocklist (DriverSiPolicy.p7b). Additions have been made to blocklist drivers with security vulnerabilities that have been used in Bring Your Own Vulnerable Driver (BYOVD) attacks. in 17763.7314
security It addresses a known issue where Audit Logon/Logoff events in the local policy of the Active Directory Group Policy might not show as enabled on the device even if they are enabled and working as expected. This can be observed in the Local Group Policy Editor or Local Security Policy, where local… in 17763.7240
security Security update: includes the April 2025 Security Updates in 17763.7136
security This update addresses security issues for your Windows operating system. in 17763.7136
security [OS Security] After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device. This behavior is part of changes… in 17763.7136
security [Kerberos Authentication] Change of behavior: Adds protections for a vulnerability which occurs when a certificate authority is part of the Windows root store but not the NTAuth store. This change enabled by default might cause Event ID: 45 events to be logged on the domain controller. For more… in 17763.7136
security [Windows Hello] After installing this update or a later Windows update, for enhanced security, Windows Hello facial recognition requires color cameras to see a visible face when signing in. For more information, see CVE-2025-26644. in 17763.7136

Deprecations

deprecated [People app] After installing this update, the People icon on the taskbar will no longer respond. This feature is being deprecated in Windows Server 2019 and Windows 10, version 1809. in 17763.8146

Every release in between

17763.9020 Jul 14, 2026 Release notes ↗

securityFixes CVE-2026-56155: Active Directory Federation Services Elevation of Privilege Vulnerability

securityFixes CVE-2026-57092: Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

securityFixes CVE-2026-50518: Windows DHCP Server Remote Code Execution Vulnerability

securityFixes CVE-2026-56159: DHCP Server Service Remote Code Execution Vulnerability

securityFixes CVE-2026-56188: Windows Server Network driver Remote Code Execution Vulnerability

securityFixes CVE-2026-50380: Windows GDI+ Remote Code Execution Vulnerability

securityFixes CVE-2026-48564: DHCP Server Service Remote Code Execution Vulnerability

securityFixes CVE-2026-50370: DHCP Server Service Remote Code Execution Vulnerability

securityFixes CVE-2026-50382: DirectX Graphics Kernel Remote Code Execution Vulnerability

securityFixes CVE-2026-50444: Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability

securityFixes CVE-2026-50474: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-54121: Active Directory Certificate Services Elevation of Privilege Vulnerability

securityFixes CVE-2026-54982: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

securityFixes CVE-2026-54999: Windows TCP/IP Remote Code Execution Vulnerability

securityFixes CVE-2026-57087: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

securityFixes CVE-2026-57090: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

securityFixes CVE-2026-57094: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

securityFixes CVE-2026-58608: Windows Print Spooler Remote Code Execution Vulnerability

securityFixes CVE-2026-54128: Windows DHCP Client Remote Code Execution Vulnerability

securityFixes CVE-2026-54992: Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability

securityFixes CVE-2026-50680: Windows Hyper-V Elevation of Privilege Vulnerability

securityFixes CVE-2026-49164: Windows Active Directory Domain Services Remote Code Execution Vulnerability

securityFixes CVE-2026-50694: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

securityFixes CVE-2026-54995: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

securityFixes CVE-2026-42982: Windows Secure Kernel Mode Elevation of Privilege Vulnerability

securityFixes CVE-2026-49796: Windows GDI+ Remote Code Execution Vulnerability

securityFixes CVE-2026-50655: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

securityFixes CVE-2026-56189: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

17763.8880 Jun 9, 2026 Release notes ↗

securityFixes CVE-2026-44815: DHCP Client Service Remote Code Execution Vulnerability

securityFixes CVE-2026-47291: HTTP.sys Remote Code Execution Vulnerability

securityFixes CVE-2026-42985: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-47289: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-45607: Windows Hyper-V Remote Code Execution Vulnerability

securityFixes CVE-2026-42987: Windows Deployment Services (WDS) Remote Code Execution

securityFixes CVE-2026-33828: Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability

securityFixes CVE-2026-44803: Windows Graphics Component Remote Code Execution Vulnerability

securityFixes CVE-2026-44812: Windows Graphics Component Remote Code Execution Vulnerability

securityFixes CVE-2026-48574: Windows Media Remote Code Execution Vulnerability

securityFixes CVE-2026-42992: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-44799: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-44801: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-47654: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-48563: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-47288: Windows Kerberos Key Distribution Center (KDC) Remote Code Execution

17763.8755 May 12, 2026 Release notes ↗

securityFixes CVE-2026-41089: Windows Netlogon Remote Code Execution Vulnerability

securityFixes CVE-2026-40403: Windows Graphics Component Remote Code Execution Vulnerability

securityFixes CVE-2026-35421: Windows GDI Remote Code Execution Vulnerability

securityFixes CVE-2026-32161: Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability

17763.8647 Apr 19, 2026 Release notes ↗

securitySecurity update: includes the April 2026 Security Updates

security[Domain controllers (known issue)] Fixed: After installing the April 14, 2026, (KB5082123) Windows security update and restarting, domain controllers with multi-domain forests that use Privileged Access Management (PAM), might experience startup issues. In some cases, Local Security Authority…

17763.8644 Apr 14, 2026 Release notes ↗

securitySecurity update: includes the April 2026 Security Updates

fix[PowerShell (known issue)] Fixed: After installing Windows updates released on or after January 13, 2026, Japanese language installations of Windows Server 2019 might not correctly display Japanese characters in the PowerShell console.

security[Remote Desktop] This update improves protection against phishing attacks that use Remote Desktop (.rdp) files. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. A one-time security warning also appears…

security[Vulnerable driver blocklist] This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. Backup applications that rely on blocked drivers might experience failures when attempting to mount or manage disk images. These…

security[Windows Deployment Services (WDS)] This update disables the “Hands-Free Deployment” feature in WDS by default and is no longer a supported feature. For more information about this change, see Windows Deployment Services (WDS) Hands-Free Deployment Hardening Guidance related to CVE-2026-0386.

security[Kerberos protocol] This update changes the default DefaultDomainSupportedEncTypes value for Kerberos Key Distribution Center (KDC) operations to leverage AES-SHA1 for accounts that do not have an explicit msds-SupportedEncryptionTypes Active Directory attribute defined. For more information see,…

securityThis update enables dynamic status reporting for Secure Boot states in the Windows Security App (Settings > Update & Security > Windows Security). Learn more about the status alerts via badges and notifications. Note that these enhancements are disabled by default on commercial devices and servers.

fixThis update fixes an issue that could cause a device to enter BitLocker Recovery after Secure Boot updates.

featureWith this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Devices receive the new certificates only after demonstrating sufficient successful update signals,…

17763.8511 Mar 10, 2026 Release notes ↗

securitySecurity update: includes the March 2026 Security Updates

feature[Windows System Image Manager] This update adds a warning dialog to help users confirm that the selected catalog file comes from a trusted source.

feature[File History] Improved: File History in Control Panel when backing up files. New files with names containing some Chinese and Private Use Area characters can now be backed up.

feature[Secure Boot] With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. This targeting is based primarily on client device diagnostic data; due to limited data,…

17763.8389 Feb 10, 2026 Release notes ↗

securitySecurity update: includes the February 2026 Security Updates

other[Fonts] This update includes changes to Chinese fonts to meet GB18030-2022A compliance.

security[OS Security (known issue)] Fixed: After installing the Windows security update released on or after January 13, 2026, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts.

fix[Folders] Fixed: This update fixes an issue that affects folder renaming with desktop.ini files in File Explorer. The LocalizedResourceName setting was ignored, so custom folder names did not show. Now, custom folder names appear as expected.

fix[Graphics] Fixed: A stability issue affecting certain graphics processing units (GPUs) configurations.

17763.8281 Jan 24, 2026 Release notes ↗

securitySecurity update: includes the January 2026 Security Updates

fix[File System] Fixed: After installing the Windows update released on and after January 13, 2026, some applications became unresponsive or encountered unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations…

17763.8280 Jan 17, 2026 Release notes ↗

securitySecurity update: includes the January 2026 Security Updates

fix[Remote Desktop] Fixed: Some users experienced sign-in failures during Remote Desktop connections. This issue affected authentication steps for different Remote Desktop applications on Windows such as the Windows App.

17763.8276 Jan 13, 2026 Release notes ↗

securitySecurity update: includes the January 2026 Security Updates

security[Credentials autofill] This update introduces a security hardening behavior restricting certain applications to autofill credentials during remote support sessions or automated authentication workflows. With this change, credential dialogs do not respond to virtual keyboard input from remote…

feature[Windows Deployment Services (WDS)] This update introduces a change in behavior in which WDS will stop supporting hands-free deployment functionality by default. Admins should review guidance and follow instructions provided in Windows Deployment Services (WDS) Hands-Free Deployment Hardening…

other[Drivers] This update removes the following modem drivers: agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64) and smserial.sys (x86). Modem hardware dependent on these specific drivers will no longer work in Windows.

security[WinSqlite3.dll] Fixed: The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. Note WinSqlite3.dll is a separate component from sqlite3.dll, which is found in application-specific directories and is not a…

17763.8148 Dec 18, 2025 Release notes ↗

securitySecurity update: includes the December 2025 Security Updates

fix[Message queuing (MSMQ) (known issue)] Fixed: After installing the Windows updates released on December 9, 2025, users experienced issues with the Message Queuing (MSMQ) functionality. This issue also impacts a clustered MSMQ environment under load. This issue might lead to message queues becoming…

17763.8146 Dec 9, 2025 Release notes ↗

securitySecurity update: includes the December 2025 Security Updates

security[PowerShell 5.1] The Invoke-WebRequest command now includes a confirmation prompt with a security warning of a script execution risk. You can choose to continue or cancel the request. For additional details, see CVE-2025-54100 and KB5074596: PowerShell 5.1: Preventing script execution from web…

deprecated[People app] After installing this update, the People icon on the taskbar will no longer respond. This feature is being deprecated in Windows Server 2019 and Windows 10, version 1809.

17763.8027 Nov 11, 2025 Release notes ↗

securitySecurity update: includes the November 2025 Security Updates

security[App compatibility (known issue)] Fixed: This update addresses an issue that created unexpected User Account Control (UAC) prompts for some apps, including Autodesk AutoCAD. For more information, see Unexpected UAC prompts when running MSI repair operations after installing the August 2025 Windows…

security[Internal Windows OS] This update contains miscellaneous security improvements to internal Windows OS functionality. No specific issues are documented for this release.

17763.7922 Oct 23, 2025 Release notes ↗

securitySecurity update: includes the October 2025 Security Updates

security[Windows Server Update Services (WSUS)] Fixed: This update addresses a remote code execution (RCE) vulnerability that was identified in WSUS reporting web services. For more information about the security fix, see CVE-2025-59287.

17763.7919 Oct 14, 2025 Release notes ↗

securitySecurity update: includes the October 2025 Security Updates

fixFixed: An issue with the Chinese Input Method Editor (IME). Private Unicode characters were shown incorrectly and did not meet GB18030 standard.

fixFixed: An issue that affects USER32 Edit controls. Surrogate pairs appear as empty boxes when text fields reach their length limit.

fixFixed: An issue that affects PowerShell Remoting and WinRM in which commands time out after 600 seconds.

otherThis update removes the ltmdm64.sys driver. Fax modem hardware dependent on this specific driver will no longer work in Windows.

securityThis update enforces a security hardening improvement by requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. If you experience problems with smart card authentication as a result of this design change, see the Windows…

securityAfter installing this update, File Explorer automatically disables the preview feature for files downloaded from the internet. This change is designed to enhance security by preventing a vulnerability when users preview potentially unsafe files. For details, including steps to unblock files, see…

securityFixed: This update addresses an issue observed in rare cases after installing the May 2025 security update and subsequent updates causing devices to experience stability issues. Some devices became unresponsive and stopped responding in specific scenarios.

17763.7792 Sep 9, 2025 Release notes ↗

securitySecurity update: includes the September 2025 Security Updates

fix[Input and Composition] Fixed: An issue with the Chinese Simplified Input Method Editor (IME). Some extended characters were showing as empty boxes.

security[App compatibility (known issue)] Fixed: Addresses an issue that caused non-admin users to receive unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions. These actions might include configuration or repair operations in the foreground or background,…

security[File Server] New! This update enables auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA. This allows customers to assess their environment and identify any potential device or software incompatibility issues before deploying the hardening measures that are already…

feature[Active Directory] New! Adds support for Certificate Revocation List (CRL) partitioning in Windows Certificate Authorities.

17763.7683 Aug 19, 2025 Release notes ↗

securitySecurity update: includes the August 2025 Security Updates

security[Fix for reset and recovery issue] This update addresses an issue introduced by the August 2025 security update (KB5063877) in which attempts to reset and recover the device fails. This issue happens when users perform one or more of the following processes: For more information on this issue, see…

otherSystem >Recovery > Reset my PC

otherSystem > Recovery >Fix problems using Windows Update

17763.7678 Aug 12, 2025 Release notes ↗

securitySecurity update: includes the August 2025 Security Updates

fix[Input and Composition] Fixed: A known issue with the Microsoft Changjie Input Method. Users were unable to select words after a recent update.

fix[Cluster Service] Fixed: A known issue affecting Windows Server 2019 where the Cluster Service would repeatedly stop and restart. This behavior caused nodes to fail to rejoin the cluster or enter quarantine, virtual machines to restart multiple times, and frequent Event ID 7031 errors in the event…

17763.7558 Jul 8, 2025 Release notes ↗

securitySecurity update: includes the July 2025 Security Updates

fix[Input and Composition] Fixed: An issue affecting the complete removal of unused language packs and Feature on Demand (FOD) packages. This issue led to unnecessary storage use and increased Windows update installation time.

security[Network Security and Containers] Fixed: An issue in the CharNextW function which caused incorrect character rendering for GB18030-2022 compliance. The function has been deprecated and replaced with a modern ICU-based solution to ensure proper handling of GB18030-2022 requirements.

fix[DHCP Server (known issue] Fixed: An issue in which the DHCP Server service might intermittently stop responding and affects IP renewal for clients.

security[Microsoft RPC Netlogon protocol] This update includes a security hardening change to the Microsoft RPC Netlogon protocol. This change improves security by tightening access checks for a set of remote procedure call (RPC) requests. After this update is installed, Active Directory domain…

17763.7434 Jun 10, 2025 Release notes ↗

securitySecurity update: includes the June 2025 Security Updates

fix[GDI and GDI+] Fixed: Some characters were rendered wider, and the sample paragraph was broken.

fix[Windows Hello] Fixed: This update addresses an issue that prevents users from signing in with self-signed certificates when using Windows Hello for Business with the Key Trust model.

17763.7322 May 27, 2025 Release notes ↗

securitySecurity update: includes the May 2025 Security Updates

fix[Hyper-V Platform] Fixed: An issue in the direct send path for a guest physical address (GPA). This issue caused confidential virtual machines running on Hyper-V with Windows Server 2022 to intermittently stop responding or restart unexpectedly. As a result, service availability was affected, and…

17763.7314 May 13, 2025 Release notes ↗

securitySecurity update: includes the May 2025 Security Updates

security[OS Security] Updates to the Windows Kernel Vulnerable Driver Blocklist (DriverSiPolicy.p7b). Additions have been made to blocklist drivers with security vulnerabilities that have been used in Bring Your Own Vulnerable Driver (BYOVD) attacks.

fix[GRFX-Graphics] This update addresses an issue causing an error message on a blue screen particularly in cases linked to recent GDI updates with CHS GB18030-2022 fonts. Corruption occurs while the associated thread remains active, leading to an error message.

other[Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)] This update applies improvements to SBAT for the detection of Linux systems.

17763.7249 Apr 16, 2025 Release notes ↗

fixThis update fixes an issue caused by 2025.04 B container images released on April 8, 2025 where Windows containers running in Hyper-V isolation mode could fail to start in some cases if their update level didn’t match that of the hosting utility virtual machine (UVM). The mismatch caused…

17763.7240 Apr 11, 2025 Release notes ↗

securityIt addresses a known issue where Audit Logon/Logoff events in the local policy of the Active Directory Group Policy might not show as enabled on the device even if they are enabled and working as expected. This can be observed in the Local Group Policy Editor or Local Security Policy, where local…

17763.7136 Apr 8, 2025 Release notes ↗

securitySecurity update: includes the April 2025 Security Updates

securityThis update addresses security issues for your Windows operating system.

other[Daylight Saving Time (DST)] Update for the Aysen region in Chile to support the government DST change order in 2025. For more information about DST changes, see the Daylight Saving Time & Time Zone Blog.

security[OS Security] After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device. This behavior is part of changes…

security[Kerberos Authentication] Change of behavior: Adds protections for a vulnerability which occurs when a certificate authority is part of the Windows root store but not the NTAuth store. This change enabled by default might cause Event ID: 45 events to be logged on the domain controller. For more…

security[Windows Hello] After installing this update or a later Windows update, for enhanced security, Windows Hello facial recognition requires color cameras to see a visible face when signing in. For more information, see CVE-2025-26644.