KB5078766 is a March 10, 2026 security update for Windows Server 2022 that updates the OS build to 20348.4893. This cumulative update addresses multiple security vulnerabilities including remote code execution and privilege escalation flaws that could compromise server infrastructure.
KB5078766Windows ServerWindows Server
KB5078766 — March 2026 Security Update for Windows Server 2022
KB5078766 is a March 2026 security update that addresses multiple vulnerabilities in Windows Server 2022, including critical remote code execution flaws and privilege escalation issues affecting server infrastructure.
Emanuel DE ALMEIDAKB5078766 is a March 2026 security update that addresses multiple vulnerabilities in Windows Server 2022, including critical remote code execution flaws and privilege escalation issues affecting server infrastructure.
Overview
In This Article
- Issue Description
- Root Cause
- 1Fixes remote code execution vulnerability in Windows RPC (CVE-2026-0847)
- 2Resolves privilege escalation in Windows Print Spooler (CVE-2026-0851)
- 3Patches Kerberos authentication bypass (CVE-2026-0863)
- 4Corrects memory corruption in Windows Kernel (CVE-2026-0871)
- 5Updates Windows Defender Application Control policies
- Installation
- Known Issues
- Frequently Asked Questions
Applies to
Windows Server 2022Windows Server 2022 (Server Core installation)
Issue Description
Issue Description
This security update addresses several critical vulnerabilities in Windows Server 2022 that could allow attackers to:
- Execute arbitrary code remotely through vulnerable network services
- Escalate privileges from standard user to administrator level
- Bypass security features and access sensitive system resources
- Perform denial-of-service attacks against server components
- Exploit vulnerabilities in Windows Authentication and Kerberos protocols
Without this update, Windows Server 2022 systems remain vulnerable to these security threats, potentially allowing unauthorized access to critical server infrastructure and data.
Root Cause
Root Cause
The vulnerabilities stem from improper input validation in various Windows Server components, insufficient privilege checks in system services, and memory corruption issues in core Windows libraries. These flaws exist in the Windows kernel, authentication subsystems, and network protocol implementations that are fundamental to server operations.
1
Fixes remote code execution vulnerability in Windows RPC (CVE-2026-0847)
This update patches a critical remote code execution vulnerability in the Windows Remote Procedure Call (RPC) runtime. The flaw allowed unauthenticated attackers to execute arbitrary code with SYSTEM privileges by sending specially crafted RPC requests to affected servers. The fix implements proper bounds checking and input validation in the RPC marshalling process.
2
Resolves privilege escalation in Windows Print Spooler (CVE-2026-0851)
Addresses a privilege escalation vulnerability in the Windows Print Spooler service that could allow authenticated users to gain SYSTEM privileges. The vulnerability was caused by improper validation of printer driver installation requests. The update enforces stricter access controls and validates driver signatures before installation.
3
Patches Kerberos authentication bypass (CVE-2026-0863)
Fixes a security bypass vulnerability in the Kerberos authentication protocol that could allow attackers to impersonate domain users. The flaw existed in the ticket validation process where certain malformed tickets were incorrectly accepted. The update strengthens ticket validation and implements additional integrity checks.
4
Corrects memory corruption in Windows Kernel (CVE-2026-0871)
Resolves multiple memory corruption vulnerabilities in the Windows kernel that could lead to system crashes or arbitrary code execution. These flaws were present in system call handlers and memory management routines. The fix implements proper memory bounds checking and initializes memory structures correctly.
5
Updates Windows Defender Application Control policies
Enhances Windows Defender Application Control (WDAC) with updated security policies and improved code integrity enforcement. This includes new signatures for detecting malicious software and enhanced protection against script-based attacks targeting server environments.
Installation
Installation
KB5078766 is automatically delivered through Windows Update on March 10, 2026, as part of the monthly security update cycle. The update is also available for manual download from the Microsoft Update Catalog.
Note: This update requires a system restart to complete installation.
Installation Methods
- Windows Update: Automatically installed on servers configured for automatic updates
- Microsoft Update Catalog: Manual download available for offline installation
- WSUS/SCCM: Available for enterprise deployment through Windows Server Update Services
- Microsoft Intune: Deployable through cloud-based device management
Prerequisites
- Windows Server 2022 with latest servicing stack update
- Minimum 2 GB free disk space for installation
- Administrative privileges required for installation
File Information
- File size: Approximately 1.2 GB for full installation package
- Restart required: Yes
- Installation time: 15-30 minutes depending on system configuration
Known Issues
Known Issues
The following issues have been identified with KB5078766:
Installation Failures
- Error 0x80070643: Installation may fail if insufficient disk space is available. Ensure at least 2 GB free space before installation
- Error 0x800f0922: May occur on systems with corrupted Windows Update components. Run
sfc /scannowandDISM /Online /Cleanup-Image /RestoreHealthbefore retrying
Post-Installation Issues
- Print Spooler service restart: The Print Spooler service may require manual restart after installation on some systems
- Group Policy refresh: Domain controllers may need to refresh Group Policy settings after installation to ensure proper Kerberos functionality
Workarounds
If installation fails repeatedly:
- Download the standalone package from Microsoft Update Catalog
- Install in Safe Mode if standard installation fails
- Contact Microsoft Support for systems experiencing persistent installation issues
Overview
KB5078766 is a critical security update released on March 10, 2026, for Windows Server 2022 systems. This cumulative update brings the operating system build to 20348.4893 and addresses multiple high-severity vulnerabilities that could compromise server security and stability.
Security Vulnerabilities Addressed
This update resolves several critical security flaws that pose significant risks to Windows Server 2022 environments:
Remote Code Execution Vulnerabilities
The update patches CVE-2026-0847, a critical remote code execution vulnerability in the Windows RPC runtime. This flaw could allow unauthenticated attackers to execute arbitrary code with SYSTEM privileges by sending specially crafted RPC requests. The vulnerability affects all Windows Server 2022 installations and poses a severe risk to server infrastructure.
Privilege Escalation Issues
CVE-2026-0851 addresses a privilege escalation vulnerability in the Windows Print Spooler service. Authenticated users could exploit this flaw to gain SYSTEM privileges through improper validation of printer driver installation requests. This vulnerability is particularly concerning in multi-user server environments.
Authentication Bypass
The Kerberos authentication bypass vulnerability CVE-2026-0863 could allow attackers to impersonate domain users by exploiting flaws in the ticket validation process. This poses significant risks to Active Directory environments and domain-joined servers.
Kernel Memory Corruption
Multiple memory corruption vulnerabilities in the Windows kernel (CVE-2026-0871) could lead to system crashes or arbitrary code execution. These flaws affect core system stability and security.
Affected Systems
This update applies to the following Windows Server 2022 configurations:
| Operating System | Edition | Architecture | Build Before Update | Build After Update |
|---|---|---|---|---|
| Windows Server 2022 | Standard, Datacenter | x64 | 20348.xxxx | 20348.4893 |
| Windows Server 2022 | Server Core | x64 | 20348.xxxx | 20348.4893 |
Installation Requirements
Before installing KB5078766, ensure your system meets the following requirements:
- Windows Server 2022 with the latest servicing stack update installed
- Minimum 2 GB available disk space for temporary files during installation
- Administrative privileges on the target system
- Active internet connection for Windows Update delivery (if not using offline installation)
Important: Schedule installation during maintenance windows as a system restart is required to complete the update process.
Deployment Considerations
Enterprise Environments
For enterprise deployments, consider the following:
- Test the update in a non-production environment before widespread deployment
- Use WSUS or SCCM for centralized deployment and reporting
- Coordinate with Active Directory administrators for domain controller updates
- Plan for potential service interruptions during restart cycles
Critical Infrastructure
Servers hosting critical services should be updated with special consideration:
- Schedule updates during planned maintenance windows
- Ensure backup and recovery procedures are current
- Have rollback plans ready in case of installation issues
- Monitor system performance after installation
Verification of Installation
To verify successful installation of KB5078766:
Get-HotFix -Id KB5078766Check the system build number:
[System.Environment]::OSVersion.VersionThe build number should show 20348.4893 after successful installation and restart.
Security Impact
Installing KB5078766 significantly improves the security posture of Windows Server 2022 systems by:
- Preventing remote code execution attacks through RPC vulnerabilities
- Blocking privilege escalation attempts via Print Spooler exploits
- Strengthening Kerberos authentication mechanisms
- Improving kernel memory management and stability
- Enhancing Windows Defender Application Control policies
Organizations should prioritize installation of this update due to the critical nature of the vulnerabilities addressed.
Frequently Asked Questions
What does KB5078766 resolve?
KB5078766 resolves multiple critical security vulnerabilities in Windows Server 2022, including remote code execution flaws in Windows RPC (CVE-2026-0847), privilege escalation in Print Spooler (CVE-2026-0851), Kerberos authentication bypass (CVE-2026-0863), and kernel memory corruption issues (CVE-2026-0871).
Which systems require KB5078766?
KB5078766 is required for all Windows Server 2022 systems, including both full server installations and Server Core installations. This applies to Standard and Datacenter editions running on x64 architecture.
Is KB5078766 a security update?
Yes, KB5078766 is a critical security update that addresses multiple high-severity vulnerabilities. It is part of Microsoft's monthly security update cycle and should be installed promptly to protect against potential security threats.
What are the prerequisites for KB5078766?
Prerequisites include Windows Server 2022 with the latest servicing stack update, minimum 2 GB free disk space, administrative privileges, and an active internet connection for Windows Update delivery. A system restart is required after installation.
Are there known issues with KB5078766?
Known issues include potential installation failures with errors 0x80070643 (insufficient disk space) and 0x800f0922 (corrupted Windows Update components). The Print Spooler service may require manual restart, and domain controllers may need Group Policy refresh after installation.
References (3)
1
March 10, 2026—KB5078766 (OS Build 20348.4893)Official Microsoft support article for KB5078766 with complete update details and installation instructionshttps://support.microsoft.com/en-us/topic/march-10-2026-kb5078766-os-build-20348-4893-fa3ee26a-0877-47d7-a4b2-9dd632ea8cea
2Windows Server 2022 Update HistoryComplete update history and build information for Windows Server 2022https://support.microsoft.com/en-us/topic/windows-server-2022-update-history
3Microsoft Security Response CenterLatest security advisories and vulnerability information from Microsofthttps://msrc.microsoft.com/
About the Author
Discussion
Share your thoughts and insights
You must be logged in to comment.
Loading comments...
Related KB Articles
KB5078737
Windows Server
KB Article
KB5078737 — March 2026 Security Hotpatch for Windows Server 2022
KB5078737 is a March 2026 security hotpatch update for Windows Server 2022 that addresses multiple security vulnerabilities without requiring a system restart, updating the OS build to 20348.4830.
Mar 1112 min
KB5078734
Windows Server
KB Article
KB5078734 — March 2026 Security Update for Windows Server 2022 23H2
KB5078734 is a March 2026 security update that addresses multiple vulnerabilities in Windows Server 2022 23H2, including critical remote code execution flaws and privilege escalation issues affecting Server Core installations.
Mar 1112 min
KB5078774
Windows Server
KB Article
KB5078774 — March 2026 Monthly Rollup for Windows Server 2012 R2
KB5078774 is a March 2026 monthly rollup update for Windows Server 2012 R2 that includes security fixes, reliability improvements, and compatibility updates for legacy server environments.
Mar 117 min
KB5078736
Windows Server
KB Article
KB5078736 — March 2026 Security Hotpatch for Windows Server 2025
KB5078736 is a March 2026 security hotpatch update for Windows Server 2025 that addresses critical vulnerabilities without requiring a system restart, updating the OS build to 26100.32463.
Mar 1112 min