KB5060526 is the cumulative update for Windows Server 2022 and Windows Server 2022 Server Core installation. It was released on 10 June, 2025 under the ‘Patch Tuesday’ release cycle.
KB5060526 is for Windows Server 2022 21H2 and 22H2 editions. For Windows Server 2022 23H2 edition, the applicable cumulative update is KB5060118.
Salient points
- KB5060526 supersedes May 2025 cumulative update KB5058385.
- KB50560526 also includes all changes that are part of the out of band security update KB5061906 released on 27 May 2025.
- KB5060526 corresponds to server build 20348.3807.
- Two Zero-day vulnerabilities affect Windows Server 2022 and Windows Server 2022 Server Core installation. Details are shared in the zero-day vulnerabilities section below.
- 41 security vulnerabilities have been reported in the June security bulletin for Windows Server 2022.
- The Servicing Stack Update corresponding to KB5060526 is KB5058531 with build number corresponding to 20348.3691. Separate installation of the SSU or Servicing Stack is not needed.
Zero-day vulnerability
There are two zero-day vulnerabilities affecting Windows Server 2022. The zero-day vulnerabilities are either publicly disclosed or have proven instances of exploitation.
| CVE | Title | Severity | CVSS | Type |
| CVE-2025-33053 | Web Distributed Authoring and Versioning (WEBDAV) | Important | 8.8 | Remote Code Execution |
| CVE-2025-33073 | Windows SMB Client | Important | 8.8 | EoP |
Critical vulnerabilities
The June security bulletin for Windows Server 2022 reports 41 security vulnerabilities. The 4 CRITICAL vulnerabilities affecting Windows Server 2022 are shared below.
| CVE | Title | CVSS | Type |
| CVE-2025-33070 | Windows Netlogon | 8.1 | EoP |
| CVE-2025-33071 | Windows KDC Proxy Service (KPSSVC) | 8.1 | RCE |
| CVE-2025-32710 | Windows Remote Desktop Services | 8.1 | RCE |
| CVE-2025-29828 | Windows Schannel | 8.1 | RCE |
Download KB5060526
You may download the offline installer file for KB5060526 from the catalog site link shared below:
The cumulative update is available for x64 deployments for Windows Server 2022 versions 21H2 and 22H2. Upon installation of KB5060526, the server would restart.
Changelog – KB5060526
The following changes or improvements are part of KB5060526 for Windows Server 2022 21H2 and 22H2 editions:
- [Graphics]
- Fixed: An issue where some characters appear wider than standard characters, and the sample paragraph in the font preview section doesn’t display correctly.
- Fixed: This update addresses an issue where some GB18030-2022 characters don’t display correctly within the extended Chinese character set.
- [Memory leak] Fixed: This update addresses an issue in the Input Service that causes increased memory usage, potentially impacting performance in multi-user, multilingual, and remote desktop environments.
- [Settings] Fixed: This update addresses an issue in the Settings app where turning on the “Prohibit Access to Control Panel and PC Settings” policy could make the system repeatedly restart and automatically enter repair mode.
- [Windows Hello] Fixed: This update addresses an issue that prevents users from signing in with self-signed certificates when using Windows Hello for Business with the Key Trust model.
Rajesh Dhawan is a technology professional who loves to write about Cyber-security events and stories, Cloud computing and Microsoft technologies. He loves to break complex problems into manageable chunks of meaningful information.