KB5073723 is the cumulative update for Windows Server 2019 and Windows Server 2019 Server Core installation. It was released on 13 January, 2025 under the ‘Patch Tuesday’ release cycle.
Salient points
- KB5073723 supersedes December 2025 cumulative update KB5071544.
- KB5073723 includes all changes that are part of the OOB or out of band update KB5074975 released on 18 December 2025.
- KB5073723 corresponds to Windows server build 17763.8276.
- Three Zero-day vulnerabilities affect Windows Server 2019 and Windows Server 2019 Server Core installation as per January’s security bulletin.
- 69 security vulnerabilities have been disclosed for January 2026 by Microsoft. 3 of these are zero-day vulnerabilities and one has CRITICAL severity level.
- The Servicing Stack Update corresponding to KB5073723 is KB5074222 (17763.8260). It is in-built in the main cumulative update. Separate installation of the SSU or Servicing Stack is not needed.
- KB5005112 is the SSU that must be already deployed on Windows Server 2019. If you have not deployed this SSU, please download KB5005112 and apply on the server. This is a very old SSU released in August 2021. If you have followed the update release cycle, there is a high chance that you already have this patch on the server. SSU installation does not cause server reboot.
Important Reminders
Apart from this, it is important to note that the Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Secure Boot is a security feature in Unified Extensible Firmware Interface (UEFI) based firmware that helps ensure that only trusted software runs during a device’s boot (start) sequence.
Since Windows introduced Secure Boot support, all Windows-based devices have carried the same set of Microsoft certificates in the KEK and DB. These original certificates are nearing their expiration date, and your device is affected if it has any of the listed certificate versions. To continue running Windows and receiving regular updates for your Secure Boot configuration, you will need to update these certificates.
Download KB5074222
KB5074222 is the Servicing Stack Update for Windows Server 2019 released in January 2026 alongside the main cumulative update KB5073723.
If you intend to deploy cumulative updates through Windows Update or Windows Update for Business, no action is needed to install the Servicing Stack Update. The Servicing Stack Update is part of the security update that will be installed on Windows Server 2019.
For manual installation of KB5071544, there is no separate installation of KB5070248 as it is included in the main cumulative security update.
Download KB5073723
You may download the offline installer file for KB5073723 from the catalog site link shared below:
Upon installation of KB5073723, the server would restart. The Servicing Stack Update is already included in the main update and will be downloaded and installed as part of the installation process.
Zero-day vulnerabilities
Three zero-day vulnerability has been reported for Windows Server 2019 in January 2026.
| CVE Details | CVSS Score | Comments |
|---|---|---|
| CVE-2023-31096 | 7.8 | Elevation of Privilege Vulnerability in Windows Agere Soft Modem Driver |
| CVE-2026-21265 | 6.4 | Secure Boot Certificate Expiration Security Feature Bypass Vulnerability |
| CVE-2026-20805 | 5.5 | Desktop Window Manager Information Disclosure Vulnerability |
Critical vulnerabilities
The January security bulletin for Windows Server 2019 reports 69 security vulnerabilities. There is a single CRITICAL vulnerability affecting Windows Server 2019.
| CVE Details | CVSS Score | Comments |
|---|---|---|
| CVE-2026-20822 | 7.8 | Windows Graphics Component Elevation of Privilege Vulnerability |
Changelog – KB5073723
The following changes or improvements are part of KB5073723 for Windows Server 2019:
- The update addresses security improvements for Windows Server 2019 and Windows Server 2019 Server Core installation.
- [Internal Windows OS] This update contains miscellaneous security improvements to internal Windows OS functionality. No specific issues are documented for this release.
- [Windows Deployment Services (WDS)] This update introduces a change in behavior in which WDS will stop supporting hands-free deployment functionality by default. Admins should review guidance and follow instructions provided in Windows Deployment Services (WDS) Hands-Free Deployment Hardening Guidance.
- [Drivers] This update removes the following modem drivers: agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64) and smserial.sys (x86). Modem hardware dependent on these specific drivers will no longer work in Windows.
- [WinSqlite3.dll] Fixed: The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable.
Simplifying technology, one step at a time.