Windows Server 20348.2113 → 20348.5622

45 releases · 0 breaking changes · 200 security fixes · 137 advisories fixed

200security0breaking1deprecated20feature119fix

Is 20348.2113 affected? · What changed up to 26100.33650

Vulnerabilities fixed by this upgrade

7.5 CVE-2026-69789 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
8.8 CVE-2026-69499 Windows Imaging Component Remote Code Execution Vulnerability
7.0 CVE-2026-69501 Windows Secure Kernel Mode Elevation of Privilege Vulnerability
8.8 CVE-2026-69518 Windows Remote Desktop Remote Code Execution Vulnerability
8.1 CVE-2026-69530 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
9.8 CVE-2026-69579 Windows Message Queuing Remote Code Execution Vulnerability
9.8 CVE-2026-69590 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
9.8 CVE-2026-69595 Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
8.8 CVE-2026-69601 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
8.8 CVE-2026-69603 Windows Hyper-V Remote Code Execution Vulnerability
8.8 CVE-2026-69676 Windows Kerberos Remote Code Execution Vulnerability
8.8 CVE-2026-69712 Windows Key Distribution Center Remote Code Execution Vulnerability
9.8 CVE-2026-69730 Windows DNS Server Remote Code Execution Vulnerability
9.8 CVE-2026-69769 Windows HTTP Print Provider Remote Code Execution Vulnerability
8.1 CVE-2026-69813 Windows DNS Server Remote Code Execution Vulnerability
8.1 CVE-2026-69827 Windows DNS Server Remote Code Execution Vulnerability
9.8 CVE-2026-69829 Windows Shell Remote Code Execution Vulnerability
9.8 CVE-2026-69845 Windows DHCP Server Remote Code Execution Vulnerability
8.2 CVE-2026-69846 Windows Secure Kernel Mode Elevation of Privilege Vulnerability
7.5 CVE-2026-69852 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
8.1 CVE-2026-69858 Windows DNS Server Remote Code Execution Vulnerability
8.8 CVE-2026-69860 Windows Imaging Component Remote Code Execution Vulnerability
8.2 CVE-2026-69874 Windows ALPC Elevation of Privilege Vulnerability
7.5 CVE-2026-69890 Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
8.2 CVE-2026-69906 Windows Secure Kernel Mode Elevation of Privilege Vulnerability
8.8 CVE-2026-70203 Windows Media Player Remote Code Execution Vulnerability
9.8 CVE-2026-70296 Windows Imaging Component Remote Code Execution Vulnerability
7.0 CVE-2026-70585 Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
8.8 CVE-2026-70586 Windows Paint Remote Code Execution Vulnerability
8.8 CVE-2026-72950 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
7.5 CVE-2026-72954 Windows Deployment Services Remote Code Execution Vulnerability
7.8 CVE-2026-72957 Windows Deployment Services Remote Code Execution Vulnerability
8.8 CVE-2026-72959 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
8.8 CVE-2026-72960 Windows Media Player Remote Code Execution Vulnerability
8.2 CVE-2026-72961 Windows Hyper-V Elevation of Privilege Vulnerability
8.2 CVE-2026-72962 Windows USB Video Driver Elevation of Privilege Vulnerability
9.8 CVE-2026-72979 Windows DHCP Server Remote Code Execution Vulnerability
4.4 CVE-2026-72980 Windows Hello Security Feature Bypass Vulnerability
8.1 CVE-2026-72981 IP Helper Remote Code Execution Vulnerability
9.8 CVE-2026-72982 Windows Netlogon Remote Code Execution Vulnerability
9.8 CVE-2026-72983 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
8.8 CVE-2026-72986 Graphic Fonts Remote Code Execution Vulnerability
8.1 CVE-2026-72987 Windows DNS Remote Code Execution Vulnerability
8.8 CVE-2026-73006 DirectWrite Remote Code Execution Vulnerability
9.8 CVE-2026-73009 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
9.8 CVE-2026-73010 Microsoft Failover Cluster Remote Code Execution Vulnerability
8.8 CVE-2026-73013 Windows Imaging Component Remote Code Execution Vulnerability
7.5 CVE-2026-73017 Graphics Kernel Remote Code Execution Vulnerability
8.8 CVE-2026-73018 Graphic Fonts Remote Code Execution Vulnerability
8.8 CVE-2026-73023 Windows Imaging Component Remote Code Execution Vulnerability
9.8 CVE-2026-77493 Windows Graphics Component Remote Code Execution Vulnerability
8.8 CVE-2026-77495 Windows Imaging Component Remote Code Execution Vulnerability
8.8 CVE-2026-77504 Microsoft Office Word Remote Code Execution Vulnerability
8.1 CVE-2026-77505 Windows DNS Server Remote Code Execution Vulnerability
8.1 CVE-2026-78444 Microsoft Failover Cluster Remote Code Execution Vulnerability
9.8 CVE-2026-78445 Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
8.1 CVE-2026-78449 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
8.1 CVE-2026-78450 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
8.8 CVE-2026-80083 Windows Hyper-V Remote Code Execution Vulnerability
7.5 CVE-2026-81355 Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
8.8 CVE-2026-81955 Windows Graphics Component Remote Code Execution Vulnerability
7.8 CVE-2026-85880KEV Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
9.8 CVE-2026-62815 Microsoft QUIC Remote Code Execution Vulnerability
8.8 CVE-2026-62816 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
8.8 CVE-2026-62817 Windows DNS Server Remote Code Execution Vulnerability
8.8 CVE-2026-62818 Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
8.1 CVE-2026-62819 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
8.1 CVE-2026-62820 Windows DNS Server Remote Code Execution Vulnerability
8.8 CVE-2026-62822 Windows GDI+ Remote Code Execution Vulnerability
8.8 CVE-2026-62823 Windows DHCP Server Remote Code Execution Vulnerability
9.8 CVE-2026-62878 Windows DNS Server Remote Code Execution Vulnerability
8.1 CVE-2026-62889 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
7.8 CVE-2026-62890 Windows GDI+ Elevation of Privilege Vulnerability
9.8 CVE-2026-62893 Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
8.1 CVE-2026-65679 Windows iSCSI Target Service Remote Code Execution Vulnerability
8.1 CVE-2026-65789 Windows DNS Server Remote Code Execution Vulnerability
9.8 CVE-2026-65791 Windows iSCSI Target Service Remote Code Execution Vulnerability
8.1 CVE-2026-65796 Windows iSCSI Target Service Remote Code Execution Vulnerability
7.8 CVE-2026-66799 Windows Key Guard Elevation of Privilege Vulnerability
8.1 CVE-2026-66802 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
7.0 CVE-2026-68820KEV Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
8.1 CVE-2026-71331 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
7.8 CVE-2026-42982 Windows Secure Kernel Mode Elevation of Privilege Vulnerability
8.8 CVE-2026-48564 DHCP Server Service Remote Code Execution Vulnerability
8.1 CVE-2026-49164 Windows Active Directory Domain Services Remote Code Execution Vulnerability
7.8 CVE-2026-49796 Windows GDI+ Remote Code Execution Vulnerability
8.8 CVE-2026-50370 DHCP Server Service Remote Code Execution Vulnerability
9.6 CVE-2026-50380 Windows GDI+ Remote Code Execution Vulnerability
8.8 CVE-2026-50382 DirectX Graphics Kernel Remote Code Execution Vulnerability
8.8 CVE-2026-50444 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
8.8 CVE-2026-50474 Remote Desktop Client Remote Code Execution Vulnerability
9.8 CVE-2026-50518 Windows DHCP Server Remote Code Execution Vulnerability
7.8 CVE-2026-50655 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
8.2 CVE-2026-50680 Windows Hyper-V Elevation of Privilege Vulnerability
8.1 CVE-2026-50694 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
8.8 CVE-2026-54121 Active Directory Certificate Services Elevation of Privilege Vulnerability
7.4 CVE-2026-54127 Windows Hyper-V Elevation of Privilege Vulnerability
8.4 CVE-2026-54128 Windows DHCP Client Remote Code Execution Vulnerability
8.8 CVE-2026-54982 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
8.4 CVE-2026-54992 Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
8.1 CVE-2026-54995 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
8.8 CVE-2026-54999 Windows TCP/IP Remote Code Execution Vulnerability
7.8 CVE-2026-56155KEV Active Directory Federation Services Elevation of Privilege Vulnerability
9.8 CVE-2026-56159 DHCP Server Service Remote Code Execution Vulnerability
9.8 CVE-2026-56188 Windows Server Network driver Remote Code Execution Vulnerability
7.8 CVE-2026-56189 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
8.8 CVE-2026-57087 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
8.8 CVE-2026-57090 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
9.9 CVE-2026-57092 Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
8.8 CVE-2026-57094 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
8.8 CVE-2026-58608 Windows Print Spooler Remote Code Execution Vulnerability
7.8 CVE-2026-33828 Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
8.8 CVE-2026-42985 Remote Desktop Client Remote Code Execution Vulnerability
8.1 CVE-2026-42987 Windows Deployment Services (WDS) Remote Code Execution
7.5 CVE-2026-42992 Remote Desktop Client Remote Code Execution Vulnerability
7.5 CVE-2026-44799 Remote Desktop Client Remote Code Execution Vulnerability
7.5 CVE-2026-44801 Remote Desktop Client Remote Code Execution Vulnerability
7.8 CVE-2026-44803 Windows Graphics Component Remote Code Execution Vulnerability
8.4 CVE-2026-44810 Microsoft Cryptographic Services Elevation of Privilege Vulnerability
7.8 CVE-2026-44812 Windows Graphics Component Remote Code Execution Vulnerability
9.8 CVE-2026-44815 DHCP Client Service Remote Code Execution Vulnerability
8.4 CVE-2026-45607 Windows Hyper-V Remote Code Execution Vulnerability
8.4 CVE-2026-45641 Windows Hyper-V Remote Code Execution Vulnerability
8.8 CVE-2026-45648 Windows Active Directory Domain Services Remote Code Execution Vulnerability
9.8 CVE-2026-45657 Windows Kernel Remote Code Execution Vulnerability
7.1 CVE-2026-47288 Windows Kerberos Key Distribution Center (KDC) Remote Code Execution
8.8 CVE-2026-47289 Remote Desktop Client Remote Code Execution Vulnerability
9.8 CVE-2026-47291 HTTP.sys Remote Code Execution Vulnerability
8.2 CVE-2026-47652 Windows Hyper-V Remote Code Execution Vulnerability
7.5 CVE-2026-47654 Remote Desktop Client Remote Code Execution Vulnerability
7.5 CVE-2026-48563 Remote Desktop Client Remote Code Execution Vulnerability
7.8 CVE-2026-48574 Windows Media Remote Code Execution Vulnerability
7.5 CVE-2026-32161 Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
7.8 CVE-2026-35421 Windows GDI Remote Code Execution Vulnerability
9.3 CVE-2026-40402 Windows Hyper-V Elevation of Privilege Vulnerability
8.8 CVE-2026-40403 Windows Graphics Component Remote Code Execution Vulnerability
9.8 CVE-2026-41089 Windows Netlogon Remote Code Execution Vulnerability

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-85880: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability in 20348.5622
security Fixes CVE-2026-69579: Windows Message Queuing Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69590: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69595: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69730: Windows DNS Server Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69769: Windows HTTP Print Provider Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69829: Windows Shell Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69845: Windows DHCP Server Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-70296: Windows Imaging Component Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-72979: Windows DHCP Server Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-72982: Windows Netlogon Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-72983: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-73009: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-73010: Microsoft Failover Cluster Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-77493: Windows Graphics Component Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-78445: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69499: Windows Imaging Component Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69518: Windows Remote Desktop Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69601: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69603: Windows Hyper-V Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69676: Windows Kerberos Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69712: Windows Key Distribution Center Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69860: Windows Imaging Component Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-70203: Windows Media Player Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-70586: Windows Paint Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-72950: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-72959: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-72960: Windows Media Player Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-72986: Graphic Fonts Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-73006: DirectWrite Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-73013: Windows Imaging Component Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-73018: Graphic Fonts Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-73023: Windows Imaging Component Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-77495: Windows Imaging Component Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-77504: Microsoft Office Word Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-80083: Windows Hyper-V Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-81955: Windows Graphics Component Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69846: Windows Secure Kernel Mode Elevation of Privilege Vulnerability in 20348.5622
security Fixes CVE-2026-69874: Windows ALPC Elevation of Privilege Vulnerability in 20348.5622
security Fixes CVE-2026-69906: Windows Secure Kernel Mode Elevation of Privilege Vulnerability in 20348.5622
security Fixes CVE-2026-72961: Windows Hyper-V Elevation of Privilege Vulnerability in 20348.5622
security Fixes CVE-2026-72962: Windows USB Video Driver Elevation of Privilege Vulnerability in 20348.5622
security Fixes CVE-2026-69530: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69813: Windows DNS Server Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69827: Windows DNS Server Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69858: Windows DNS Server Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-72981: IP Helper Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-72987: Windows DNS Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-77505: Windows DNS Server Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-78444: Microsoft Failover Cluster Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-78449: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-78450: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-72957: Windows Deployment Services Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69789: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69852: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69890: Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability in 20348.5622
security Fixes CVE-2026-72954: Windows Deployment Services Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-73017: Graphics Kernel Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-81355: Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-69501: Windows Secure Kernel Mode Elevation of Privilege Vulnerability in 20348.5622
security Fixes CVE-2026-70585: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability in 20348.5622
security Fixes CVE-2026-72980: Windows Hello Security Feature Bypass Vulnerability in 20348.5622
security Security update: includes the September 2026 Security Updates in 20348.5622
security Fixes CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability in 20348.5499
security Fixes CVE-2026-62815: Microsoft QUIC Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-62878: Windows DNS Server Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-62893: Windows Deployment Services TFTP Server Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-65791: Windows iSCSI Target Service Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-62816: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-62817: Windows DNS Server Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-62818: Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-62822: Windows GDI+ Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-62823: Windows DHCP Server Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-62819: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-62820: Windows DNS Server Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-62889: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-65679: Windows iSCSI Target Service Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-65789: Windows DNS Server Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-65796: Windows iSCSI Target Service Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-66802: Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-71331: Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability in 20348.5499
security Fixes CVE-2026-62890: Windows GDI+ Elevation of Privilege Vulnerability in 20348.5499
security Fixes CVE-2026-66799: Windows Key Guard Elevation of Privilege Vulnerability in 20348.5499
security Security update: includes the August 2026 Security Updates in 20348.5499
security Fixes CVE-2026-56155: Active Directory Federation Services Elevation of Privilege Vulnerability in 20348.5386
security Fixes CVE-2026-57092: Microsoft Windows VMSwitch Elevation of Privilege Vulnerability in 20348.5386
security Fixes CVE-2026-50518: Windows DHCP Server Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-56159: DHCP Server Service Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-56188: Windows Server Network driver Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-50380: Windows GDI+ Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-48564: DHCP Server Service Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-50370: DHCP Server Service Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-50382: DirectX Graphics Kernel Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-50444: Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability in 20348.5386
security Fixes CVE-2026-50474: Remote Desktop Client Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-54121: Active Directory Certificate Services Elevation of Privilege Vulnerability in 20348.5386
security Fixes CVE-2026-54982: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-54999: Windows TCP/IP Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-57087: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-57090: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-57094: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-58608: Windows Print Spooler Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-54128: Windows DHCP Client Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-54992: Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-50680: Windows Hyper-V Elevation of Privilege Vulnerability in 20348.5386
security Fixes CVE-2026-49164: Windows Active Directory Domain Services Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-50694: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-54995: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-42982: Windows Secure Kernel Mode Elevation of Privilege Vulnerability in 20348.5386
security Fixes CVE-2026-49796: Windows GDI+ Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-50655: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-56189: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 20348.5386
security Fixes CVE-2026-54127: Windows Hyper-V Elevation of Privilege Vulnerability in 20348.5386
security Fixes CVE-2026-44815: DHCP Client Service Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-45657: Windows Kernel Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-47291: HTTP.sys Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-42985: Remote Desktop Client Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-45648: Windows Active Directory Domain Services Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-47289: Remote Desktop Client Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-44810: Microsoft Cryptographic Services Elevation of Privilege Vulnerability in 20348.5256
security Fixes CVE-2026-45607: Windows Hyper-V Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-45641: Windows Hyper-V Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-47652: Windows Hyper-V Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-42987: Windows Deployment Services (WDS) Remote Code Execution in 20348.5256
security Fixes CVE-2026-33828: Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability in 20348.5256
security Fixes CVE-2026-44803: Windows Graphics Component Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-44812: Windows Graphics Component Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-48574: Windows Media Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-42992: Remote Desktop Client Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-44799: Remote Desktop Client Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-44801: Remote Desktop Client Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-47654: Remote Desktop Client Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-48563: Remote Desktop Client Remote Code Execution Vulnerability in 20348.5256
security Fixes CVE-2026-47288: Windows Kerberos Key Distribution Center (KDC) Remote Code Execution in 20348.5256
security Fixes CVE-2026-41089: Windows Netlogon Remote Code Execution Vulnerability in 20348.5139
security Fixes CVE-2026-40402: Windows Hyper-V Elevation of Privilege Vulnerability in 20348.5139
security Fixes CVE-2026-40403: Windows Graphics Component Remote Code Execution Vulnerability in 20348.5139
security Fixes CVE-2026-35421: Windows GDI Remote Code Execution Vulnerability in 20348.5139
security Fixes CVE-2026-32161: Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability in 20348.5139
security [Domain controllers (known issue)] Fixed: After installing the April 14, 2026, (KB5082142) Windows security update and restarting, domain controllers with multi-domain forests that use Privileged Access Management (PAM), might experience startup issues. In some cases, Local Security Authority… in 20348.5024
security Security update: includes the April 2026 Security Updates in 20348.5020
security [Kerberos protocol] This update changes the default DefaultDomainSupportedEncTypes value for Kerberos Key Distribution Center (KDC) operations to leverage AES-SHA1 for accounts that do not have an explicit msds-SupportedEncryptionTypes Active Directory attribute defined. For more information see,… in 20348.5020
security [Remote Desktop] This update improves protection against phishing attacks that use Remote Desktop (.rdp) files. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. A one-time security warning also appears… in 20348.5020
security [Vulnerable driver blocklist] This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. Backup applications that rely on blocked drivers might experience failures when attempting to mount or manage disk images. These… in 20348.5020
security [Windows Deployment Services (WDS)] This update disables the “Hands-Free Deployment” feature in WDS by default and is no longer a supported feature. For more information about this change, see Windows Deployment Services (WDS) Hands-Free Deployment Hardening Guidance related to CVE-2026-0386. in 20348.5020
security Security update: includes the March 2026 Security Updates in 20348.4893
security [Graphics] Fixed: This update addresses an issue where certain GPU configurations might recently have experienced a system error related to dxgmms2.sys, resulting in the KERNEL_SECURITY_CHECK_FAILURE error. in 20348.4773
security [OS Security (known issue)] Fixed: After installing the Windows security update released on or after January 13, 2026, some PCs which run Virtual Secure Mode (VSM) are unable to shut down or enter hibernation. Instead, the device restarts. in 20348.4773
security [Remote Desktop] Fixed: After installing the January 2026 Windows security update (KB5073457), some users experienced sign-in failures during Remote Desktop connections. This issue affected authentication steps for different Remote Desktop applications on Windows such as the Windows App. in 20348.4650
security [Credentials autofill] This update introduces a security hardening behavior restricting certain applications to autofill credentials during remote support sessions or automated authentication workflows. With this change, credential dialogs do not respond to virtual keyboard input from remote… in 20348.4648
security [WinSqlite3.dll] Fixed: The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. Note WinSqlite3.dll is a separate component from sqlite3.dll, which is found in application-specific directories and is not a… in 20348.4648
security [PowerShell 5.1] Invoke-WebRequest now includes a confirmation prompt with a security warning of script execution risk. You can choose to continue or cancel the request. For additional details, see CVE-2025-54100 and KB5074596: PowerShell 5.1: Preventing script execution from web content. in 20348.4529
security [App compatibility (known issue)] Fixed: This update addresses an issue that created unexpected User Account Control (UAC) prompts for some apps, including Autodesk AutoCAD. For more information, see Unexpected UAC prompts when running MSI repair operations after installing the August 2025 Windows… in 20348.4405
security [Security] Fixed: This update addresses an issue that affects Windows Server domain controllers using Microsoft Defender for Endpoint. After domain controller promotion, changes to registry permissions disrupted cloud-based communication. in 20348.4405
security [Windows Server Update Services (WSUS)] Fixed: This update addresses a remote code execution (RCE) vulnerability that was identified in WSUS reporting web services. For more information about the security fix, see CVE-2025-59287. in 20348.4297
security [Stability issue] Fixed: This update addresses an issue observed in rare cases after installing the May 2025 security update and subsequent updates causing devices to experience stability issues. Some devices became unresponsive and stopped responding in specific scenarios. in 20348.4294
security [Cryptography] This update enforces a security hardening improvement by requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. If you experience problems with smart card authentication as a result of this design change,… in 20348.4294
security [File Explorer] After installing this update, File Explorer automatically disables the preview feature for files downloaded from the internet. This change is designed to enhance security by preventing a vulnerability when users preview potentially unsafe files. For details, including steps to… in 20348.4294
security [App compatibility (known issue)] Fixed: Addresses an issue that caused non-admin users to receive unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions. These actions might include configuration or repair operations in the foreground or background,… in 20348.4171
security [File server]⁠ This update enabled auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA. This allows customers to assess their environment and identify any potential device or software incompatibility issues before deploying the hardening measures that are already… in 20348.4171
security Security update: includes the July 2025 Security Updates in 20348.3932
security [Microsoft RPC Netlogon protocol] This update includes a security hardening change to the Microsoft RPC Netlogon protocol. This change improves security by tightening access checks for a set of remote procedure call (RPC) requests. After this update is installed, Active Directory domain… in 20348.3932
security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.3692
security It addresses a known issue where Audit Logon/Logoff events in the local policy of the Active Directory Group Policy might not show as enabled on the device even if they are enabled and working as expected. This can be observed in the Local Group Policy Editor or Local Security Policy, where local… in 20348.3561
security Security update: includes the April 2025 Security Updates in 20348.3453
security [OS Security] After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device. This behavior is part of changes… in 20348.3453
security [Kerberos Authentication] Change of behavior: Adds protections for a vulnerability which occurs when a certificate authority is part of the Windows root store but not the NTAuth store. This change enabled by default might cause Event ID: 45 events to be logged on the domain controller. For more… in 20348.3453
security Security update: includes the February 2025 Security Updates in 20348.3207
security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.3207
security [USB cameras] Fixed: Your device does not recognize the camera is on. This issue occurs after you install the January 2025 security update. in 20348.3207
security Security update: includes the January 2025 Security Updates in 20348.3091
security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.3091
security Security update: includes the December 2024 Security Updates in 20348.2966
security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.2849
security Security update: includes the October 2024 Security Updates in 20348.2762
security Security update: includes the September 2024 Security Updates in 20348.2700
security [Dual boot of Windows and Linux (known issue)] Linux might fail to start up when you turn on dual-boot setup for Windows and Linux on your device. The error message is, “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security… in 20348.2700
security Security update: includes the August 2024 Security Updates in 20348.2655
security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.2655
security [BitLocker (known issue)] A BitLocker recovery screen shows when you start up your device. This occurs after you install the July 9, 2024, update. This issue is more likely to occur if device encryption is on. Go to Settings > Privacy & Security > Device encryption. To unlock your drive, Windows… in 20348.2655
security [Lock screen] This update addresses CVE-2024-38143. Because of this, the “Use my Windows user account” checkbox is not available on the lock screen to connect to Wi-Fi. in 20348.2655
security [Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)] This update applies SBAT to systems that run Windows. This stops vulnerable Linux EFI (Shim bootloaders) from running. This SBAT update will not apply to systems that dual-boot Windows and Linux. After the SBAT… in 20348.2655
security [Domain Name System (DNS)] This update hardens DNS server security to address CVE-2024-37968. If the configurations of your domains are not up to date, you might get the SERVFAIL error or time out. in 20348.2655
security Security update: includes the July 2024 Security Updates in 20348.2582
security [BitLocker] This update adds PCR 4 to PCR 7 and 11 for the default Secure Boot validation profile. See CVE-2024-38058 for more information. in 20348.2582
security Security update: includes the June 2024 Security Updates in 20348.2527
security This update addresses an issue that affects lsass.exe. It stops responding. This occurs after you install the April 2024 security updates on Windows servers. in 20348.2527
security This update addresses an issue that affects lsass.exe. It leaks memory. This occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call. in 20348.2527
security Security update: includes the May 2024 Security Updates in 20348.2461
security This update includes quarterly changes to the Windows Kernel Vulnerable Driver Blocklist file, DriverSiPolicy.p7b. It adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.2461
security This update addresses an issue that affects Group Policy Folder Redirection in a multi-forest deployment. The issue stops you from choosing a group account from the target domain. Because of this, you cannot apply advanced folder redirection settings to that domain. This issue occurs when the… in 20348.2461
security Security update: includes the April 2024 Security Updates in 20348.2402
security This update addresses a known issue that affects the Local Security Authority Subsystem Service (LSASS). It might leak memory on domain controllers (DCs). This issue occurs after you install KB5035857 (March 12, 2024). The leak occurs when on-premises and cloud-based Active Directory DCs process… in 20348.2342
security Security update: includes the March 2024 Security Updates in 20348.2340
security The update affects Active Directory domains that host mobile device management (MDM) providers. They can transition from “Compatibility mode” to the strong certificate mapping “Enforcement mode.” To do this, they can allow an Active Directory Key Distribution Center (KDC) to read user security… in 20348.2340
security Security update: includes the February 2024 Security Updates in 20348.2322
security This update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). It might stop working. This occurs when you access the Active Directory database. in 20348.2322
security This update includes quarterly changes to the Windows Kernel Vulnerable Driver Blocklist file, DriverSiPolicy.p7b. It adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.2322
security Security update: includes the January 2024 Security Updates in 20348.2227
security Security update: includes the December 2023 Security Updates in 20348.2159

Deprecations

deprecated [Line Printer Daemon (LPD) protocol] Using this deprecated protocol to print might not work as you expect or fail. This issue occurs after you install the July 9, 2024, and later updates. Note When it is no longer available, clients, like UNIX, that use it will not connect to a server to print.… in 20348.2655

Every release in between

20348.5622 Sep 8, 2026 Release notes ↗

securityFixes CVE-2026-85880: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

securityFixes CVE-2026-69579: Windows Message Queuing Remote Code Execution Vulnerability

securityFixes CVE-2026-69590: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

securityFixes CVE-2026-69595: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

securityFixes CVE-2026-69730: Windows DNS Server Remote Code Execution Vulnerability

securityFixes CVE-2026-69769: Windows HTTP Print Provider Remote Code Execution Vulnerability

securityFixes CVE-2026-69829: Windows Shell Remote Code Execution Vulnerability

securityFixes CVE-2026-69845: Windows DHCP Server Remote Code Execution Vulnerability

securityFixes CVE-2026-70296: Windows Imaging Component Remote Code Execution Vulnerability

securityFixes CVE-2026-72979: Windows DHCP Server Remote Code Execution Vulnerability

securityFixes CVE-2026-72982: Windows Netlogon Remote Code Execution Vulnerability

securityFixes CVE-2026-72983: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

securityFixes CVE-2026-73009: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

securityFixes CVE-2026-73010: Microsoft Failover Cluster Remote Code Execution Vulnerability

securityFixes CVE-2026-77493: Windows Graphics Component Remote Code Execution Vulnerability

securityFixes CVE-2026-78445: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

securityFixes CVE-2026-69499: Windows Imaging Component Remote Code Execution Vulnerability

securityFixes CVE-2026-69518: Windows Remote Desktop Remote Code Execution Vulnerability

securityFixes CVE-2026-69601: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

securityFixes CVE-2026-69603: Windows Hyper-V Remote Code Execution Vulnerability

securityFixes CVE-2026-69676: Windows Kerberos Remote Code Execution Vulnerability

securityFixes CVE-2026-69712: Windows Key Distribution Center Remote Code Execution Vulnerability

securityFixes CVE-2026-69860: Windows Imaging Component Remote Code Execution Vulnerability

securityFixes CVE-2026-70203: Windows Media Player Remote Code Execution Vulnerability

securityFixes CVE-2026-70586: Windows Paint Remote Code Execution Vulnerability

securityFixes CVE-2026-72950: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

securityFixes CVE-2026-72959: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

securityFixes CVE-2026-72960: Windows Media Player Remote Code Execution Vulnerability

securityFixes CVE-2026-72986: Graphic Fonts Remote Code Execution Vulnerability

securityFixes CVE-2026-73006: DirectWrite Remote Code Execution Vulnerability

securityFixes CVE-2026-73013: Windows Imaging Component Remote Code Execution Vulnerability

securityFixes CVE-2026-73018: Graphic Fonts Remote Code Execution Vulnerability

securityFixes CVE-2026-73023: Windows Imaging Component Remote Code Execution Vulnerability

securityFixes CVE-2026-77495: Windows Imaging Component Remote Code Execution Vulnerability

securityFixes CVE-2026-77504: Microsoft Office Word Remote Code Execution Vulnerability

securityFixes CVE-2026-80083: Windows Hyper-V Remote Code Execution Vulnerability

securityFixes CVE-2026-81955: Windows Graphics Component Remote Code Execution Vulnerability

securityFixes CVE-2026-69846: Windows Secure Kernel Mode Elevation of Privilege Vulnerability

securityFixes CVE-2026-69874: Windows ALPC Elevation of Privilege Vulnerability

securityFixes CVE-2026-69906: Windows Secure Kernel Mode Elevation of Privilege Vulnerability

+28 more items in the release notes

20348.5499 Aug 11, 2026 Release notes ↗

securityFixes CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

securityFixes CVE-2026-62815: Microsoft QUIC Remote Code Execution Vulnerability

securityFixes CVE-2026-62878: Windows DNS Server Remote Code Execution Vulnerability

securityFixes CVE-2026-62893: Windows Deployment Services TFTP Server Remote Code Execution Vulnerability

securityFixes CVE-2026-65791: Windows iSCSI Target Service Remote Code Execution Vulnerability

securityFixes CVE-2026-62816: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

securityFixes CVE-2026-62817: Windows DNS Server Remote Code Execution Vulnerability

securityFixes CVE-2026-62818: Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability

securityFixes CVE-2026-62822: Windows GDI+ Remote Code Execution Vulnerability

securityFixes CVE-2026-62823: Windows DHCP Server Remote Code Execution Vulnerability

securityFixes CVE-2026-62819: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

securityFixes CVE-2026-62820: Windows DNS Server Remote Code Execution Vulnerability

securityFixes CVE-2026-62889: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

securityFixes CVE-2026-65679: Windows iSCSI Target Service Remote Code Execution Vulnerability

securityFixes CVE-2026-65789: Windows DNS Server Remote Code Execution Vulnerability

securityFixes CVE-2026-65796: Windows iSCSI Target Service Remote Code Execution Vulnerability

securityFixes CVE-2026-66802: Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability

securityFixes CVE-2026-71331: Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability

securityFixes CVE-2026-62890: Windows GDI+ Elevation of Privilege Vulnerability

securityFixes CVE-2026-66799: Windows Key Guard Elevation of Privilege Vulnerability

securitySecurity update: includes the August 2026 Security Updates

feature[Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Certificate deployment via Windows updates continues across supported PCs and non-managed business devices in the…

20348.5386 Jul 14, 2026 Release notes ↗

securityFixes CVE-2026-56155: Active Directory Federation Services Elevation of Privilege Vulnerability

securityFixes CVE-2026-57092: Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

securityFixes CVE-2026-50518: Windows DHCP Server Remote Code Execution Vulnerability

securityFixes CVE-2026-56159: DHCP Server Service Remote Code Execution Vulnerability

securityFixes CVE-2026-56188: Windows Server Network driver Remote Code Execution Vulnerability

securityFixes CVE-2026-50380: Windows GDI+ Remote Code Execution Vulnerability

securityFixes CVE-2026-48564: DHCP Server Service Remote Code Execution Vulnerability

securityFixes CVE-2026-50370: DHCP Server Service Remote Code Execution Vulnerability

securityFixes CVE-2026-50382: DirectX Graphics Kernel Remote Code Execution Vulnerability

securityFixes CVE-2026-50444: Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability

securityFixes CVE-2026-50474: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-54121: Active Directory Certificate Services Elevation of Privilege Vulnerability

securityFixes CVE-2026-54982: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

securityFixes CVE-2026-54999: Windows TCP/IP Remote Code Execution Vulnerability

securityFixes CVE-2026-57087: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

securityFixes CVE-2026-57090: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

securityFixes CVE-2026-57094: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

securityFixes CVE-2026-58608: Windows Print Spooler Remote Code Execution Vulnerability

securityFixes CVE-2026-54128: Windows DHCP Client Remote Code Execution Vulnerability

securityFixes CVE-2026-54992: Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability

securityFixes CVE-2026-50680: Windows Hyper-V Elevation of Privilege Vulnerability

securityFixes CVE-2026-49164: Windows Active Directory Domain Services Remote Code Execution Vulnerability

securityFixes CVE-2026-50694: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

securityFixes CVE-2026-54995: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

securityFixes CVE-2026-42982: Windows Secure Kernel Mode Elevation of Privilege Vulnerability

securityFixes CVE-2026-49796: Windows GDI+ Remote Code Execution Vulnerability

securityFixes CVE-2026-50655: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

securityFixes CVE-2026-56189: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

securityFixes CVE-2026-54127: Windows Hyper-V Elevation of Privilege Vulnerability

20348.5256 Jun 9, 2026 Release notes ↗

securityFixes CVE-2026-44815: DHCP Client Service Remote Code Execution Vulnerability

securityFixes CVE-2026-45657: Windows Kernel Remote Code Execution Vulnerability

securityFixes CVE-2026-47291: HTTP.sys Remote Code Execution Vulnerability

securityFixes CVE-2026-42985: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-45648: Windows Active Directory Domain Services Remote Code Execution Vulnerability

securityFixes CVE-2026-47289: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-44810: Microsoft Cryptographic Services Elevation of Privilege Vulnerability

securityFixes CVE-2026-45607: Windows Hyper-V Remote Code Execution Vulnerability

securityFixes CVE-2026-45641: Windows Hyper-V Remote Code Execution Vulnerability

securityFixes CVE-2026-47652: Windows Hyper-V Remote Code Execution Vulnerability

securityFixes CVE-2026-42987: Windows Deployment Services (WDS) Remote Code Execution

securityFixes CVE-2026-33828: Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability

securityFixes CVE-2026-44803: Windows Graphics Component Remote Code Execution Vulnerability

securityFixes CVE-2026-44812: Windows Graphics Component Remote Code Execution Vulnerability

securityFixes CVE-2026-48574: Windows Media Remote Code Execution Vulnerability

securityFixes CVE-2026-42992: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-44799: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-44801: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-47654: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-48563: Remote Desktop Client Remote Code Execution Vulnerability

securityFixes CVE-2026-47288: Windows Kerberos Key Distribution Center (KDC) Remote Code Execution

20348.5139 May 12, 2026 Release notes ↗

securityFixes CVE-2026-41089: Windows Netlogon Remote Code Execution Vulnerability

securityFixes CVE-2026-40402: Windows Hyper-V Elevation of Privilege Vulnerability

securityFixes CVE-2026-40403: Windows Graphics Component Remote Code Execution Vulnerability

securityFixes CVE-2026-35421: Windows GDI Remote Code Execution Vulnerability

securityFixes CVE-2026-32161: Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability

20348.5024 Apr 19, 2026 Release notes ↗

security[Domain controllers (known issue)] Fixed: After installing the April 14, 2026, (KB5082142) Windows security update and restarting, domain controllers with multi-domain forests that use Privileged Access Management (PAM), might experience startup issues. In some cases, Local Security Authority…

20348.5020 Apr 14, 2026 Release notes ↗

securitySecurity update: includes the April 2026 Security Updates

other[Connectivity] This update improves the reliability of audio features in Windows, helping reduce system unresponsiveness related to sound or audio activity.

other[Kernel] This update improves system stability during large file operations. Users should experience fewer unexpected interruptions while working with or transferring large files.

security[Kerberos protocol] This update changes the default DefaultDomainSupportedEncTypes value for Kerberos Key Distribution Center (KDC) operations to leverage AES-SHA1 for accounts that do not have an explicit msds-SupportedEncryptionTypes Active Directory attribute defined. For more information see,…

other[Networking] This update improves reliability when Windows uses SMB compression over QUIC. After you install this update, SMB compression requests over QUIC complete more consistently, reducing the likelihood of timeouts and supporting smoother, more dependable performance.

security[Remote Desktop] This update improves protection against phishing attacks that use Remote Desktop (.rdp) files. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. A one-time security warning also appears…

featureWith this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Devices receive the new certificates only after demonstrating sufficient successful update signals,…

fixThis update addresses an issue where the device might enter BitLocker Recovery after the Secure Boot updates.

feature[Texts and Fonts] This update improves Windows fonts by adding the new Saudi Riyal currency symbol. This change helps keep text clear, accurate, and visually consistent across your Windows apps and experiences.

security[Vulnerable driver blocklist] This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. Backup applications that rely on blocked drivers might experience failures when attempting to mount or manage disk images. These…

security[Windows Deployment Services (WDS)] This update disables the “Hands-Free Deployment” feature in WDS by default and is no longer a supported feature. For more information about this change, see Windows Deployment Services (WDS) Hands-Free Deployment Hardening Guidance related to CVE-2026-0386.

20348.4893 Mar 10, 2026 Release notes ↗

securitySecurity update: includes the March 2026 Security Updates

feature[Secure Boot] With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. This targeting is based primarily on client device diagnostic data; due to limited data,…

feature[Windows System Image Manager] Improved: This update improves the reliability of choosing trusted catalog files. It adds a warning dialog that helps you confirm that the file you select comes from a trusted source.

20348.4776 Mar 2, 2026 Release notes ↗

20348.4773 Feb 10, 2026 Release notes ↗

fix[File Explorer] Fixed: This update addresses an issue where folder renaming with desktop.ini files in File Explorer isn't work correctly. The LocalizedResourceName setting is ignored, so custom folder names don't appear.

other[Fonts & Display] Updates the Chinese fonts to support the GB18030‑2022A standard for character coverage and display.

security[Graphics] Fixed: This update addresses an issue where certain GPU configurations might recently have experienced a system error related to dxgmms2.sys, resulting in the KERNEL_SECURITY_CHECK_FAILURE error.

security[OS Security (known issue)] Fixed: After installing the Windows security update released on or after January 13, 2026, some PCs which run Virtual Secure Mode (VSM) are unable to shut down or enter hibernation. Instead, the device restarts.

feature[Networking]New! Windows Server now supports random shuffling of resource records in DNS Server responses. This helps reduce scenarios where a single resource record becomes overloaded because it appears first in the returned list. To enable, create a DWORD registry key named “RandomShuffle” at:…

20348.4651 Jan 24, 2026 Release notes ↗

fix[File System] Fixed: After installing the Windows update released on and after January 13, 2026, some applications became unresponsive or encountered unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations…

20348.4650 Jan 17, 2026 Release notes ↗

security[Remote Desktop] Fixed: After installing the January 2026 Windows security update (KB5073457), some users experienced sign-in failures during Remote Desktop connections. This issue affected authentication steps for different Remote Desktop applications on Windows such as the Windows App.

20348.4648 Jan 13, 2026 Release notes ↗

other[Compatibility] This update removes the following modem drivers: agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64) and smserial.sys (x86). Modem hardware dependent on these specific drivers will no longer work in Windows.

security[Credentials autofill] This update introduces a security hardening behavior restricting certain applications to autofill credentials during remote support sessions or automated authentication workflows. With this change, credential dialogs do not respond to virtual keyboard input from remote…

fix[Remote Desktop] Fixed: This update addresses an issue that causes SearchIndexer (the Windows service that indexes files for search) to stop responding on Citrix hosts, which might prevent users from starting remote sessions.

feature[Windows Deployment Services (WDS] This update introduces a change in behavior in which WDS will stop supporting hands-free deployment functionality by default. Detailed guidance for IT administrators is available in Windows Deployment Services (WDS) Hands‑Free Deployment Hardening Guidance.

security[WinSqlite3.dll] Fixed: The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. Note WinSqlite3.dll is a separate component from sqlite3.dll, which is found in application-specific directories and is not a…

20348.4529 Dec 9, 2025 Release notes ↗

security[PowerShell 5.1] Invoke-WebRequest now includes a confirmation prompt with a security warning of script execution risk. You can choose to continue or cancel the request. For additional details, see CVE-2025-54100 and KB5074596: PowerShell 5.1: Preventing script execution from web content.

20348.4405 Nov 11, 2025 Release notes ↗

security[App compatibility (known issue)] Fixed: This update addresses an issue that created unexpected User Account Control (UAC) prompts for some apps, including Autodesk AutoCAD. For more information, see Unexpected UAC prompts when running MSI repair operations after installing the August 2025 Windows…

security[Security] Fixed: This update addresses an issue that affects Windows Server domain controllers using Microsoft Defender for Endpoint. After domain controller promotion, changes to registry permissions disrupted cloud-based communication.

fix[Networking] Fixed: This update fixes an issue in the HTTP.sys request parser, a Windows component that reads and processes HTTP requests. The parser allowed a single line break within HTTP/1.1 chunk extensions, where the RFC 9112 standard requires a carriage return and line feed (CRLF) sequence…

20348.4297 Oct 23, 2025 Release notes ↗

security[Windows Server Update Services (WSUS)] Fixed: This update addresses a remote code execution (RCE) vulnerability that was identified in WSUS reporting web services. For more information about the security fix, see CVE-2025-59287.

20348.4294 Oct 14, 2025 Release notes ↗

fixFixed: An issue where some characters didn’t display correctly when using the Chinese Input Method Editor (IME).

fixFixed: This update addresses an issue where certain Chinese characters appeared as empty boxes in some text fields, such as those used in Connection Manager Administration Kit, when a character limit was set.

fix[Networking (known issue)] Fixed: This update addresses an issue where you might not be able to connect to shared files and folders if you're using the Server Message Block (SMB) v1 protocol on NetBIOS over TCP/IP NetBIOS (NetBT). This can happen after installing update KB5065432.

fix[PowerShell] Fixed: This update addresses an issue that affects PowerShell Remoting and Windows Remote Management (WinRM), where commands might time out after 10 minutes.

security[Stability issue] Fixed: This update addresses an issue observed in rare cases after installing the May 2025 security update and subsequent updates causing devices to experience stability issues. Some devices became unresponsive and stopped responding in specific scenarios.

fix[System services and reliability] Fixed: Addresses an issue that caused McpManagement service to appear without a description on Windows.

other[Compatibility] This update removes the ltmdm64.sys driver. Fax modem hardware dependent on this specific driver will no longer work in Windows.

security[Cryptography] This update enforces a security hardening improvement by requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. If you experience problems with smart card authentication as a result of this design change,…

security[File Explorer] After installing this update, File Explorer automatically disables the preview feature for files downloaded from the internet. This change is designed to enhance security by preventing a vulnerability when users preview potentially unsafe files. For details, including steps to…

20348.4171 Sep 9, 2025 Release notes ↗

security[App compatibility (known issue)] Fixed: Addresses an issue that caused non-admin users to receive unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions. These actions might include configuration or repair operations in the foreground or background,…

security[File server]⁠ This update enabled auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA. This allows customers to assess their environment and identify any potential device or software incompatibility issues before deploying the hardening measures that are already…

fix[Input] Fixed: This update addresses an issue with the Chinese (Simplified) Input Method Editor (IME) where some extended characters appeared as empty boxes.

fix[Performance]⁠ Fixed: This update addresses an issue where a single, oversized Certificate Revocation List (CRL) file slows down system performance. To improve speed and privacy, the system now plans to use smaller, partitioned CRLs.

20348.4052 Aug 12, 2025 Release notes ↗

fix[Input (know issue)] Fixed: An issue when using the Microsoft Changjie IME (input method editor) for Traditional Chinese might cause problems such as not being able to form or select words, unresponsive spacebar or blank key, incorrect word output, or a broken candidate window display. This can…

20348.3932 Jul 8, 2025 Release notes ↗

securitySecurity update: includes the July 2025 Security Updates

fix[DHCP Server (known issue] Fixed: An issue in which the DHCP Server service might intermittently stop responding and affects IP renewal for clients.

fix[Language and character support] Fixed: An issue that affected some Chinese characters and experienced compliance issue with GB18030. These characters didn’t display correctly or weren’t accepted when using extended Unicode. A modern ICU-based solution now properly supports GB18030-2022…

fix[Performance]⁠ Fixed: This update addresses an issue that prevented the complete removal of unused language packs and Feature on Demand packages, which previously led to unnecessary storage use and longer Windows Update installation times.

security[Microsoft RPC Netlogon protocol] This update includes a security hardening change to the Microsoft RPC Netlogon protocol. This change improves security by tightening access checks for a set of remote procedure call (RPC) requests. After this update is installed, Active Directory domain…

20348.3807 Jun 10, 2025 Release notes ↗

fixFixed: An issue where some characters appear wider than standard characters, and the sample paragraph in the font preview section doesn’t display correctly.

fixFixed: This update addresses an issue where some GB18030-2022 characters don’t display correctly within the extended Chinese character set⁠.⁠

fix[Memory leak] Fixed: This update addresses an issue in the Input Service that causes increased memory usage, potentially impacting performance in multi-user, multilingual, and remote desktop environments.

fix[Settings] Fixed: This update addresses an issue in the Settings app where turning on the "Prohibit Access to Control Panel and PC Settings" policy could make the system repeatedly restart and automatically enter repair mode.

fix[Windows Hello] Fixed: This update addresses an issue that prevents users from signing in with self-signed certificates when using Windows Hello for Business with the Key Trust model.

20348.3695 May 23, 2025 Release notes ↗

fix[Hyper-V Platform] Fixed: An issue in the direct send path for a guest physical address (GPA) where confidential virtual machines running on Hyper-V with Windows Server 2022 might intermittently stop responding or restart unexpectedly, affecting service availability and requiring manual…

20348.3692 May 13, 2025 Release notes ↗

fix[Desktop Windows Manager (DVM)] Fixed: This update addresses an issue that affects the DWM, where it stops responding due to an access error in dwmredir.dll during remote session while connection or disconnection, resulting in a black or grey screen.

fix[Graphics kernel] Fixed: This update addresses an issue that occurs when starting a new console session after closing the previous one, and the new session doesn't start successfully.

other[Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)]⁠ This update applies improvements to SBAT for the detection of Linux systems

security[Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

20348.3566 Apr 16, 2025 Release notes ↗

20348.3561 Apr 11, 2025 Release notes ↗

securityIt addresses a known issue where Audit Logon/Logoff events in the local policy of the Active Directory Group Policy might not show as enabled on the device even if they are enabled and working as expected. This can be observed in the Local Group Policy Editor or Local Security Policy, where local…

20348.3453 Apr 8, 2025 Release notes ↗

securitySecurity update: includes the April 2025 Security Updates

other[Daylight Saving Time (DST)] Update for the Aysen region in Chile to support the government DST change order in 2025. For more info about DST changes, see the Daylight Saving Time & Time Zone Blog.

security[OS Security] After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device. This behavior is part of changes…

security[Kerberos Authentication] Change of behavior: Adds protections for a vulnerability which occurs when a certificate authority is part of the Windows root store but not the NTAuth store. This change enabled by default might cause Event ID: 45 events to be logged on the domain controller. For more…

20348.3328 Mar 11, 2025 Release notes ↗

other[Daylight saving time (DST)] This update supports (DST) changes in Paraguay.

fix[Open Secure Shell (OpenSSH) (known issue)] Fixed: The service fails to start, which stops SSH connections. There is no detailed logging, and you must run the sshd.exe process manually.

feature[GB18030-2022] This update adds support for this amendment.

fix[Azure Virtual Network] Fixed: You can turn off the VNET metering feature with the following registry key. Registry key: HKLM\CurrentControlSet\Services\NcHostAgent\Parameters\Plugins\Vnet Registry key: MeteringDisabled (DWORD type) Data to be set: 1

20348.3207 Feb 11, 2025 Release notes ↗

securitySecurity update: includes the February 2025 Security Updates

fix[Task Manager] Fixed: The CPU index number might be wrong when you set process affinity. This occurs on servers that have two or more non-uniform memory access (NUMA) nodes.

feature[GB18030-2022] This update adds support for this amendment.

fix[Memory leak] Fixed: Leaks occur when predictive input ideas show.

fix[Device Health Attestation] Fixed: When you upgrade from Windows Server 2016, a crucial item is not there. Because of this, service fails.

security[Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

fix[Directory enumeration] Fixed: This might fail if a directory has symbolic links that have long target names.

fix[Bind Filter Driver] Fixed: Your system might stop responding when it accesses symbolic links.

fix[Digital/Analog converter (DAC) (known issue)] Fixed: You might experience issues with USB audio devices. This is more likely when you use a DAC audio driver based on USB 1.0. USB audio devices might stop working, which stops playback.

security[USB cameras] Fixed: Your device does not recognize the camera is on. This issue occurs after you install the January 2025 security update.

fix[USB audio device drivers] Fixed: The code 10 error message, “This device cannot start” appears. This occurs when you connect to certain external audio management devices.

20348.3095 Jan 18, 2025 Release notes ↗

fix[Non-uniform memory access (NUMA) nodes] Fixed: Some servers that have two or more NUMA nodes fail to start up.

20348.3091 Jan 14, 2025 Release notes ↗

securitySecurity update: includes the January 2025 Security Updates

security[Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

20348.2966 Dec 10, 2024 Release notes ↗

securitySecurity update: includes the December 2024 Security Updates

fix[Motherboard replacement] Fixed: Windows does not activate after you replace a motherboard.

20348.2849 Nov 12, 2024 Release notes ↗

fix[FrameShutdownDelay] Fixed: The browser ignores its value in the “HKLM\SOFTWARE\Microsoft\Internet Explorer\Main” registry key.

fix[vmswitch] Fixed: A vmswitch triggers a stop error. This occurs when you use Load Balancing and Failover (LBFO) teaming with two virtual switches on a virtual machine (VM). In this case, one virtual switch uses single root Input/Output virtualization (SR-IOV).

fix[Collector sets] Fixed: They do not close properly when an exception occurs during startup or while the set is active. Because of this, the command to stop a collector set stops responding.

feature[Product activation phone numbers] This adds new phone numbers for several regions.

security[Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

fix[Windows Backup] Fixed: Backup sometimes fails. This occurs when a device has an Extensible Firmware Interface (EFI) system partition (ESP).

fix[Cace disk] Fixed: The "Starting Maintenance mode" exception flag appears after you remove a cache disk.

other[Remote Desktop Connection Broker in high availability mode] This update turns on Kerberos authentication for smart cards.

20348.2762 Oct 8, 2024 Release notes ↗

securitySecurity update: includes the October 2024 Security Updates

feature[Software Defined Networking (SDN)]New! The SDN API now performs better for large-scale deployments. Watch for load balancer connectivity issues after you install this update. If you have any, move the SDNAPI microservice to another node. An SDN admin can move the service. To do that, use the…

fix[MSIX applications] Fixed: When you install them from an HTTPS URI, they fail to open. This issue occurs when the download of the app is not complete. This damages the package.

fix[Task Manager] Fixed: It stops responding when you select the “Performance” tab.

fix[Direct Composition batched presentations] Fixed: A brief flash of triangles or boxes show on the screen. This issue affects browsers, like Microsoft Edge, and other apps.

fix[Input Method Editor (IME)] Fixed: When a combo box has input focus, a memory leak might occur when you close that window.

fix[AppLocker] Fixed: The rule collection enforcement mode is not overwritten when rules merge with a collection that has no rules. This occurs when the enforcement mode is set to “Not Configured.”

fix[Remote Desktop (known issue)] Fixed: Windows Servers might disrupt Remote Desktop connections across your company. This issue might occur if you use a legacy protocol in the Remote Desktop Gateway. An example protocol is Remote Procedure Call over HTTP. If the issue occurs, it is sporadic, like…

fix[Containers (known issue)] Fixed: Container networking on Kubernetes might not work as you expect. Containers fail to reach external networks or communicate between pods. It might affect you when you use Calico to set up container networking on development or production instances. If affected,…

20348.2700 Sep 10, 2024 Release notes ↗

securitySecurity update: includes the September 2024 Security Updates

feature[Windows Installer] When it repairs an application, the User Account Control (UAC) does not prompt for your credentials. After you install this update, the UAC will prompt for them. Because of this, you must update your automation scripts. Application owners must add the Shield icon. It indicates…

other[IE mode] Pop-up windows open in the background instead of in the foreground.

other[AppContainer] Printers do not work as you expect when you use them in a restricted setting, like AppContainer.

other[BitLocker] You might not be able to decrypt a BitLocker data drive. This occurs when you move that drive from a newer version of Windows to an older version.

security[Dual boot of Windows and Linux (known issue)] Linux might fail to start up when you turn on dual-boot setup for Windows and Linux on your device. The error message is, “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security…

20348.2655 Aug 13, 2024 Release notes ↗

securitySecurity update: includes the August 2024 Security Updates

other[Remote Desktop Session Host (RDSH)] Users cannot connect to the RDSH, and the host loses data. This occurs because win32kbase.sys stops responding.

other[Windows Defender Application Control (WDAC)] A memory leak occurs that might exhaust system memory as time goes by. This issue occurs when you provision a device.

other[Protected Process Light (PPL) protections] You can bypass them.

security[Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

other[Microsoft 365 Defender (known issue] The Network Detection and Response (NDR) service might encounter issues. This interrupts network data reporting. If this issue affects you, a message appears on the service health page of the Microsoft 365 admin center. You can also view the status of NDR on…

security[BitLocker (known issue)] A BitLocker recovery screen shows when you start up your device. This occurs after you install the July 9, 2024, update. This issue is more likely to occur if device encryption is on. Go to Settings > Privacy & Security > Device encryption. To unlock your drive, Windows…

security[Lock screen] This update addresses CVE-2024-38143. Because of this, the “Use my Windows user account” checkbox is not available on the lock screen to connect to Wi-Fi.

other[NetJoinLegacyAccountReuse] This update removes this registry key. For more information refer to KB5020276—Netjoin: Domain join hardening changes.

security[Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)] This update applies SBAT to systems that run Windows. This stops vulnerable Linux EFI (Shim bootloaders) from running. This SBAT update will not apply to systems that dual-boot Windows and Linux. After the SBAT…

security[Domain Name System (DNS)] This update hardens DNS server security to address CVE-2024-37968. If the configurations of your domains are not up to date, you might get the SERVFAIL error or time out.

deprecated[Line Printer Daemon (LPD) protocol] Using this deprecated protocol to print might not work as you expect or fail. This issue occurs after you install the July 9, 2024, and later updates. Note When it is no longer available, clients, like UNIX, that use it will not connect to a server to print.…

20348.2582 Jul 9, 2024 Release notes ↗

securitySecurity update: includes the July 2024 Security Updates

other[Absent apps and features] Some apps and features are absent after you upgrade to Windows 11.

feature[Double-wide character set range] This update adds new ranges to the double-wide character set range. This ensures that the PowerShell console identifies and handles them the right way.

other[Input Method Editor (IME)] The candidate list fails to show or shows in the wrong position.

other[Windows Presentation Foundation (WPF)] A malformed Human Interface Device (HID) descriptor causes WPF to stop responding.

other[Remote Desktop Session Host (RDSH)] Users cannot connect to the RDSH. This occurs because dwm.exe stops responding.

other[Remote Desktop MultiPoint Server] A race condition causes the service to stop responding.

other[Windows Local Administrator Password Solution (LAPS)] Its Post Authentication Actions (PAA) do not occur at the end of the grace period. Instead, they occur at restart.

other[Remote Authentication Dial-In User Service (RADIUS) protocol] This issue is related to MD5 collisions. For more information, see KB5040268.

security[BitLocker] This update adds PCR 4 to PCR 7 and 11 for the default Secure Boot validation profile. See CVE-2024-38058 for more information.

featureThis update changes how IT administrators should set up remote paths for file shortcut icons (.LNK files). The set up now requires that you configure the policy “Allow the use of remote paths in file shortcut icons”. If you don’t configure this policy, icons on the Start menu, Windows desktop and…

20348.2529 Jun 20, 2024 Release notes ↗

otherThis update addresses a known issue that affects the BCryptSignHash API. Because of this issue, the API returns “STATUS_INVALID_PARAMETER.” This occurs when callers use NULL padding input parameters for RSA signatures. This issue is more likely to occur when Customer-Managed Key (CMK) are in use,…

20348.2527 Jun 11, 2024 Release notes ↗

securitySecurity update: includes the June 2024 Security Updates

featureNew! This update affects Server Message Block (SMB) over Quick UDP Internet Connections (QUIC). It turns on the SMB over QUIC client certificate authentication feature. Admins can use it to restrict which clients can access SMB over QUIC servers. To learn more, see Configure SMB over QUIC client…

featureNew! The LCU will no longer have the reverse differentials. The client will generate the playback delta. This change will help to reduce the LCU package size by about 20%. This change also offers a few advantages. It:

otherImproves performance on slow connections.

otherThis update affects the version of curl.exe that is in Windows. The version number is now 8.7.1.

fixThis update addresses an issue that affects Outlook and OneNote. Their search function stops working. This occurs when you use Azure Virtual Desktop (AVD).

securityThis update addresses an issue that affects lsass.exe. It stops responding. This occurs after you install the April 2024 security updates on Windows servers.

fixThis update addresses an issue that affects Windows Hello for Business. You cannot use it to authenticate to Entra ID on certain apps. This occurs when you use Web Access Management (WAM).

fixThis update addresses an issue that affects a Microsoft Entra ID account. Devices cannot authenticate a second one. This occurs after you install the Windows update, dated November 13, 2023.

fixThis update addresses an issue that affects Microsoft Edge. The UI is wrong for the Internet Options Data Settings.

fixThis update addresses an issue that affects Storage Spaces Direct (S2D) and Remote Direct Memory Access (RDMA). When you use them with SMBdirect in your networks, the networks fail. You also lose the ability to manage clusters.

fixThis update addresses an issue that affects Containers. They do not move past the “ContainerCreating” status.

fixThis update addresses an issue that affects Windows Defender Application Control (WDAC). It prevents a stop error that occurs when you apply more than 32 policies.

fixThis update addresses an issue that might stop your system from resuming from hibernate. This occurs after you turn on BitLocker.

fixThis update addresses an issue that affects Windows Defender Application Control (WDAC). The issue copies unsigned WDAC policies to the Extensible Firmware Interface (EFI) disk partition. It is reserved for signed policies.

fixThis update addresses an issue that affects Enhanced Fast Reconnect. It fails. This occurs when you use it with third-party remote desktop protocol (RDP) providers.

fixThis update addresses an issue that affects the Remote Desktop Session Host (RD Session Host). A deadlock occurs when a large number of users sign in.

fixThis update addresses an issue that affects dsamain.exe. It stops responding. This occurs when the Knowledge Consistency Checker (KCC) runs evaluations.

securityThis update addresses an issue that affects lsass.exe. It leaks memory. This occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call.

fixThis update addresses an issue that affects the kernel stack. It might overflow. Because of this, VMs might shut down prematurely.

featureStarting in this update, File Explorer adds the Mark of the Web (MoTW) tag to files and folders that come from untrusted locations. When MapUrlToZone classifies a file as “Internet,” that file also gets this tag. Because of this change, the “LastWriteTime” time stamp is updated. This might affect…

20348.2461 May 14, 2024 Release notes ↗

securitySecurity update: includes the May 2024 Security Updates

otherThis update addresses a known issue that might affect domain controllers (DC). NTLM authentication traffic might increase.

fixThis update addresses an issue that affects IE mode. A webpage stops working as expected when there is an open modal dialog.

fixThis update addresses an issue in that affects IE mode. It stops responding. This occurs if you press the left arrow key when an empty text box has focus and caret browsing is on.

fixThis update addresses an issue that affects Wi-Fi Protected Access 3 (WPA3) in the Group Policy editor. HTML preview rendering fails.

fixThis update addresses an issue that affects a server after you remove it from a domain. The Get-LocalGroupMember cmdlet returns an exception. This occurs if the local groups contain domain members.

otherThis update affects next secure record 3 (NSEC3) validation in a recursive resolver. Its limit is now 1,000 computations. One computation is equal to the validation of one label with one iteration. DNS Server Administrators can change the default number of computations. To do this, use the…

fixThis update addresses an issue that affects a network. An error occurs when credentials expire.

fixThis update addresses an issue that occurs when you use LoadImage() to load a top-down bitmap. If the bitmap has a negative height, the image does not load, and the function returns NULL.

securityThis update includes quarterly changes to the Windows Kernel Vulnerable Driver Blocklist file, DriverSiPolicy.p7b. It adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

fixThis update addresses an issue that affects a workstation that is not in a domain. When you connect from it to a share and use an IPV6 address, you get the error, “ERROR_BAD_NET_NAME.”

otherThis update addresses a known issue that might cause your VPN connection to fail. This occurs after you install the update dated April 9, 2024, or later.

fixThis update addresses an issue that might affect Virtual Secure Mode (VSM) scenarios. They might fail. These scenarios include VPN, Windows Hello, Credential Guard, and Key Guard.

securityThis update addresses an issue that affects Group Policy Folder Redirection in a multi-forest deployment. The issue stops you from choosing a group account from the target domain. Because of this, you cannot apply advanced folder redirection settings to that domain. This issue occurs when the…

fixThis update affects Windows Defender Application Control (WDAC). The update addresses an issue that might cause some apps to fail when you apply WDAC Application ID policies.

20348.2402 Apr 9, 2024 Release notes ↗

securitySecurity update: includes the April 2024 Security Updates

featureNew! This update affects Windows Hello for Business. IT admins can now use mobile device management (MDM) to turn off the prompt that appears when users sign in to an Entra-joined machine. To do this, they can turn on the “DisablePostLogonProvisioning” policy setting. After a user signs in,…

otherThis update supports daylight saving time (DST) changes in Palestine. To learn more, see Interim guidance for DST changes announced by Palestinian Authority for 2024, 2025.

otherThis update supports DST changes in Kazakhstan. To learn more, see Interim guidance for Kazakhstan time zone changes 2024.

otherThis update supports DST changes in Samoa. To learn more, see Interim guidance for Samoa DST changes 2021.

fixThis update addresses an issue that causes high CPU usage. This occurs after you open the Snipping Tool.

fixThis update addresses an issue that affects a network resource. You cannot access it from a Remote Desktop session. This occurs when you turn on the Remote Credential Guard feature and the client is Windows 11, version 22H2 or higher.

fixThis update addresses an issue that affects Microsoft Edge IE mode. When you open many tabs, it stops responding.

fixThis update addresses an issue that affects DNS servers. They receive Event 4016 for a timeout of the Lightweight Directory Access Protocol (LDAP). This occurs when they perform DNS registrations. Name registrations fail with Active Directory Domain Services (AD DS). The issue remains until you…

fixThis update addresses an issue that affects workload virtual machines (VM). They lose their connection to the network in production environments.

fixThis update addresses an issue that affects mouse cursor movements. They lag in some screen capture scenarios, especially when you use the Remote Desktop Protocol (RDP).

fixThis update addresses an issue that affects the Group Policy service. It fails after you use LGPO.exe to apply an audit policy to the system.

fixThis update addresses an issue that affects the display of a smart card icon. It does not appear when you sign in. This occurs when there are multiple certificates on the smart card.

fixThis update addresses an issue that causes your device to shut down after 60 seconds. This occurs when you use a smart card to authenticate on a remote system.

fixThis update addresses an issue that affects temporary group membership. Users whose memberships have expired appear when you search for them in LDAP. This occurs even though Active Directory has removed them.

fixThis update addresses an issue that affects a root directory. When you open an alternate data stream and delete something, you get an error.

fixThis update addresses an issue that affects the Resilient File System (ReFS). A stop error prevents the OS from starting up correctly.

fixThis update addresses an issue that occurs when you create a file that spans more than one directory. When you rename the original directory, you get an error.

fixThis update addresses an issue that affects fastfat.sys. It stops responding. This occurs because of a race condition.

fixThis update addresses an issue that affects Name Service Provider Interface (NSPI) queries. They might fail. If they do, lsass.exe stops responding on a domain controller.

20348.2342 Mar 22, 2024 Release notes ↗

securityThis update addresses a known issue that affects the Local Security Authority Subsystem Service (LSASS). It might leak memory on domain controllers (DCs). This issue occurs after you install KB5035857 (March 12, 2024). The leak occurs when on-premises and cloud-based Active Directory DCs process…

20348.2340 Mar 12, 2024 Release notes ↗

securitySecurity update: includes the March 2024 Security Updates

securityThe update affects Active Directory domains that host mobile device management (MDM) providers. They can transition from “Compatibility mode” to the strong certificate mapping “Enforcement mode.” To do this, they can allow an Active Directory Key Distribution Center (KDC) to read user security…

otherKB5014754: Certificate-based authentication changes on Windows domain controllers

otherPreview of SAN URI for Certificate Strong Mapping for KB5014754

fixThis update addresses an issue that affects the touch keyboard. It might not show during out-of-box experience (OOBE).

fixThis update addresses an issue that makes the troubleshooting process fail. This occurs when you use the Get Help app.

fixThis update addresses an issue that affects Remote Desktop Web Authentication. You might not be able to connect to sovereign cloud endpoints.

otherThis update affects HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders. Your device can now set and maintain the correct default permissions.

otherThis update addresses a memory allocation issue in the Host Network Service (HNS). It causes high memory usage. It also affects service and pod deployment.

20348.2322 Feb 13, 2024 Release notes ↗

securitySecurity update: includes the February 2024 Security Updates

fixThis update addresses an issue that affects remote direct memory access (RDMA) performance counters. They do not return networking data on VMs in the right way.

fixThis update addresses an issue that affects fontdrvhost.exe. It stops responding when you use Compact Font Format version 2 (CFF2) fonts.

otherThis update addresses a memory leak in ctfmon.exe.

otherThis update addresses a memory leak in TextInputHost.exe.

fixThis update addresses an issue that affects protected content. It stops cross-process windows from being created. Because of this update, you can keep using out-of-process hosting for things like WebView2 under protected, top-level windows.

fixThis update addresses an issue that affects touchscreens. They do not work properly when you use more than one monitor.

fixThis update addresses an issue that affects Windows Defender Application Control (WDAC). Its “allow” policies might block some binaries from running.

featureThis update affects Unified Extensible Firmware Interface (UEFI) Secure Boot systems. It adds a renewed signing certificate to the Secure Boot DB variable. You can now opt for this change. For more details, see KB5036210.

fixThis update addresses an issue that affects the download of device metadata. Downloads from the Windows Metadata and Internet Services (WMIS) over HTTPS are now more secure.

securityThis update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). It might stop working. This occurs when you access the Active Directory database.

fixThis update addresses an issue that affects the Certificate Authority snap-in. You cannot select the "Delta CRL" option. This stops you from using the GUI to publish Delta CRLs.

fixThis update addresses an issue that affects a local account. You cannot sign in to an account that Windows LAPS manages. This occurs if you set the "Require Smart Card for Interactive Logon" policy.

fixThis update addresses an issue that affects Server Message Block (SMB) connections. They disconnect when all of the following are true:

otherYou change the client and server encryption cipher list from the default values.

otherThe client and server do not have any ciphers in common.

otherSMB encryption is not in use.

otherA multi-channel configuration, such as RDMA, is in place.

fixThe update addresses an issue that affects SMB over a Quick UDP Internet Connection (QUIC). It stops responding if port 445 is blocked.

otherThis update changes a setting in Active Directory Users & Computers. By default, the snap-in now uses a strong certificate mapping of X509IssuerSerialNumber. It does not use the weak mapping of x509IssuerSubject.

otherThis update addresses a known issue that affects chromium-based internet browsers, such as Microsoft Edge. They might not open correctly. They might also show a white screen and stop responding when you open them. Devices that have browser-specific Image File Execution Options (IFEO) might also…

20348.2227 Jan 9, 2024 Release notes ↗

securitySecurity update: includes the January 2024 Security Updates

fixThis update addresses an issue that affects Microsoft Intune. One of its new features does not work properly.

fixThis update addresses an issue that affects account lockout event 4625. The format of the event is wrong in the ForwardedEvents log. This occurs when an account name is in the user principal name (UPN) format.

fixThis update addresses an issue that affects hybrid joined devices. You cannot sign in to them if they are not connected to the internet. This occurs when you use a Windows Hello for Business PIN or biometric credentials. This issue applies to a cloud trust deployment.

fixThis update addresses an issue that affects the Trusted Sites Zone logon policy. You cannot manage it using mobile device management (MDM).

fixThis update addresses an issue that affects Microsoft Excel. It stops responding when you try to share a file as a PDF in Outlook.

fixThis update addresses an issue that affects the Server Manager pop-up text. It removes the words “Azure Automanage.”

fixThis update addresses an issue that affects XPath queries on FileHash and other binary fields. It stops them from matching values in event records.

fixThis update addresses an issue that affects certain network functions on VMs. Deployment of them fails.

fixThis update addresses an issue that affects the Network Controller. The issue makes you create more rules for outbound traffic so that return traffic is not blocked.

fixThis update addresses an issue that affects a WS_EX_LAYERED window. The window might render with the wrong dimensions or at the wrong position. This occurs when you scale the display screen.

fixThis update addresses an issue that affects printing to PDF metadata. It extracts the username that you sign in with and puts it into the author name metadata box. Instead, print to PDF should place your display name in that box.

fixThis update addresses an issue that affects disk partitions. Your system might stop responding. This occurs if you add space from a deleted partition to an existing BitLocker partition.

fixThis update addresses an issue that affects Windows Defender Application Control (WDAC). AppID Tagging policies might greatly increase how long it takes your device to start up.

fixThis update addresses an issue that causes your device to shut down after 60 seconds. This occurs when you use a smart card to authenticate on a remote system.

fixThis update addresses an issue that affects the display of a smart card icon. The icon does not appear when you sign in. This occurs when there are multiple certificates on the smart card.

fixThis update addresses an issue that affects Active Directory domain controllers. They report DS_BUSY errors when you create new users. This only occurs on primary domain controller emulators (PDCe).

fixThis update addresses an issue that affects the Windows Local Administrator Password Solution (Windows LAPS). The LAPS account does not work. This occurs if the password is older than the age that the maximum age device policy allows.

fixThis update addresses an issue that affects the Kerberos Key Distribution Center (KDC). It returns a KDC_ERR_S_PRINCIPAL_UNKNOWN error during trust referrals, which is wrong.

fixThis update addresses an issue that affects the msDS-KeyCredentialLink attribute. In some cases, it is updated when it should not be.

fixThis update addresses an issue that causes lsass.exe to stop responding. Because of this, a restart loop occurs.

fixThis update addresses an issue that affects the Key Distribution Service (KDS). It does not start in the time required if LDAP referrals are needed.

20348.2159 Dec 12, 2023 Release notes ↗

securitySecurity update: includes the December 2023 Security Updates

featureThis update affects the Netherlands time zone. It adds the recent man-made landmass outside of Rotterdam to the shape files.

otherThis update affects Microsoft Defender for Endpoint (MDE). It enables Conditional Access (CA) scenarios.