Microsoft Ships KB5078766 for Windows Server 2022, Patching Critical RPC and Kerberos Flaws
The cumulative update addresses remote code execution, privilege escalation, authentication bypass and kernel memory corruption flaws affecting all Windows Server 2022 editions.
On this page
Key takeaways
- KB5078766 was released on March 10, 2026 and brings Windows Server 2022 to build 20348.4893.
- It patches an unauthenticated RPC remote code execution flaw (CVE-2026-0847) rated critical.
- It also fixes a Print Spooler privilege escalation (CVE-2026-0851) and a Kerberos authentication bypass (CVE-2026-0863).
- Kernel memory corruption vulnerabilities (CVE-2026-0871) are also addressed.
- A restart is required, and admins should test in staging before broad deployment.
What to do now
High urgency- Deploy KB5078766 to all Windows Server 2022 systems and restart
- Prioritize domain controllers due to the Kerberos bypass fix
- Verify build 20348.4893 after installation
Microsoft released KB5078766 on March 10, 2026, a critical cumulative security update for Windows Server 2022 that patches multiple high-severity vulnerabilities and raises affected systems to build 20348.4893. The update is delivered through Windows Update and is available for manual download from the Microsoft Update Catalog.
The most serious flaw, CVE-2026-0847, is an unauthenticated remote code execution vulnerability in the Windows RPC runtime that could let attackers run arbitrary code with SYSTEM privileges. Combined with a Kerberos authentication bypass, the update warrants prompt deployment across server fleets and domain controllers.
Microsoft's KB5078766 update patches critical RPC, Kerberos, Print Spooler and kernel vulnerabilities in Windows Server 2022.
Install KB5078766 to reach build 20348.4893 and close critical RPC RCE, Kerberos bypass, Print Spooler EoP and kernel memory corruption flaws in Windows Server 2022. A restart is required.
Affected & context
Microsoft released KB5078766, the March 2026 cumulative security update for Windows Server 2022, addressing critical remote code execution, privilege escalation, authentication bypass and kernel memory corruption vulnerabilities. The update brings systems to build 20348.4893.
The update patches an unauthenticated RPC remote code execution flaw and a Kerberos authentication bypass, both of which pose severe risks to server infrastructure and Active Directory environments.
All Windows Server 2022 Standard, Datacenter and Server Core installations on x64 architecture, including domain controllers.
- Vendors
- Microsoft
- Products
- Windows Server 2022 StandardWindows Server 2022 DatacenterWindows Server 2022 Server Core
- Geography
- Global
- CVEs
- CVE-2026-0847CVE-2026-0851CVE-2026-0863CVE-2026-0871
What happened
Microsoft released KB5078766 on March 10, 2026 as the monthly cumulative security update for Windows Server 2022. The update raises the operating system to build 20348.4893 and resolves multiple vulnerabilities described as critical and high severity across core server components.
The update targets flaws in the Windows kernel, authentication subsystems and network protocol implementations. According to Microsoft's documentation, without the update, Windows Server 2022 systems remain exposed to unauthorized access, code execution and denial-of-service conditions against server infrastructure.
KB5078766 is delivered automatically through Windows Update on servers configured for automatic updates and is also available for manual download from the Microsoft Update Catalog, WSUS, SCCM and Microsoft Intune. A system restart is required to complete installation.
- Released March 10, 2026
- Brings Windows Server 2022 to build 20348.4893
- Restart required to complete installation
Vulnerabilities addressed
The update resolves four named vulnerabilities alongside broader security hardening. The RPC flaw is the most severe because it can be exploited without authentication.
- CVE-2026-0847 — Critical remote code execution in the Windows RPC runtime. Unauthenticated attackers could execute arbitrary code with SYSTEM privileges via specially crafted RPC requests. The fix adds bounds checking and input validation to the RPC marshalling process.
- CVE-2026-0851 — Privilege escalation in the Windows Print Spooler service. Authenticated users could gain SYSTEM privileges through improper validation of printer driver installation requests. The fix enforces stricter access controls and validates driver signatures.
- CVE-2026-0863 — Kerberos authentication bypass allowing attackers to impersonate domain users by exploiting flaws in the ticket validation process. The fix strengthens ticket validation and adds integrity checks.
- CVE-2026-0871 — Kernel memory corruption vulnerabilities in system call handlers and memory management routines that could cause crashes or arbitrary code execution. The fix adds memory bounds checking and proper structure initialization.
Microsoft states the update also refreshes Windows Defender Application Control (WDAC) policies and improves code integrity enforcement against script-based attacks targeting server environments.
- CVE-2026-0847 is an unauthenticated RCE in the RPC runtime
- CVE-2026-0863 affects Kerberos ticket validation
Who is affected
The update applies to all Windows Server 2022 installations on x64 architecture, including both full server and Server Core deployments.
- Windows Server 2022 Standard (x64)
- Windows Server 2022 Datacenter (x64)
- Windows Server 2022 Server Core (x64)
Domain controllers
Because the update includes a Kerberos authentication bypass fix, domain controllers and domain-joined servers in Active Directory environments should be prioritized. Coordinate updates with AD administrators and be prepared to refresh Group Policy after installation.
Deployment and verification
Prerequisites
- Windows Server 2022 with the latest servicing stack update installed
- At least 2 GB of free disk space for temporary installation files
- Administrative privileges on the target system
Verify installation
After installing and restarting, confirm the patch is present and the build number matches 20348.4893.
Get-HotFix -Id KB5078766
[System.Environment]::OSVersion.VersionEnterprise deployment
Test in a non-production environment first, use WSUS or SCCM for centralized rollout and reporting, and schedule installation during maintenance windows. Ensure current backups and a rollback plan before updating critical infrastructure.
Known issues and workarounds
Microsoft's documentation notes several installation and post-installation issues that administrators may encounter.
- Error 0x80070643 — Installation may fail with insufficient disk space; ensure at least 2 GB free before retrying.
- Error 0x800f0922 — May occur on systems with corrupted Windows Update components; run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth before retrying.
- Print Spooler service may require a manual restart after installation on some systems.
- Domain controllers may need a Group Policy refresh to ensure proper Kerberos functionality.
If installation fails repeatedly, Microsoft suggests downloading the standalone package from the Microsoft Update Catalog, attempting installation in Safe Mode, or contacting Microsoft Support for persistent issues.
Timeline
KB5078766 released
Microsoft ships KB5078766 through Windows Update and the Microsoft Update Catalog as part of the March 2026 monthly security update cycle.
Source: Microsoft update documentation
Confidence: High
Impact
Unpatched Windows Server 2022 systems remain exposed to remote code execution, privilege escalation, Kerberos impersonation and denial-of-service attacks until KB5078766 is applied.
Business impact
Compromise of unpatched servers could allow unauthorized access to critical infrastructure and data.
Technical impact
Vulnerabilities affect the RPC runtime, Print Spooler, Kerberos and the Windows kernel; exploitation could yield SYSTEM-level code execution.
Security impact
Critical unauthenticated RCE and authentication bypass flaws are patched, materially improving server security posture.
Affected audience: IT administrators, MSPs, Active Directory administrators
Action required.
Technical details
- CVEs
- CVE-2026-0847, CVE-2026-0851, CVE-2026-0863, CVE-2026-0871
- Attack vector
- Network (RPC), local/authenticated (Print Spooler), network (Kerberos)
- Affected versions
- Windows Server 2022 (pre-20348.4893)
- Patched versions
- 20348.4893
Detection methods
- Verify patch presence with Get-HotFix -Id KB5078766
- Confirm OS build reports 20348.4893
Mitigations
- Install KB5078766 and restart affected systems
Workarounds
- Download the standalone package from the Microsoft Update Catalog if Windows Update installation fails
- Install in Safe Mode if standard installation fails repeatedly
Response
Customer guidance
Microsoft recommends installing KB5078766 promptly through Windows Update, WSUS, SCCM or Intune, and notes a restart is required to complete installation.
Response status: Patched
Patch available: Yes
Workaround available: Yes
FAQ
What does KB5078766 resolve?
KB5078766 resolves multiple critical vulnerabilities in Windows Server 2022, including remote code execution in the Windows RPC runtime (CVE-2026-0847), Print Spooler privilege escalation (CVE-2026-0851), a Kerberos authentication bypass (CVE-2026-0863) and kernel memory corruption issues (CVE-2026-0871).
Which systems require KB5078766?
All Windows Server 2022 systems on x64 architecture require the update, including Standard and Datacenter editions and Server Core installations.
What build does KB5078766 install?
After successful installation and a restart, Windows Server 2022 reports build 20348.4893.
How do I verify KB5078766 is installed?
Run Get-HotFix -Id KB5078766 in PowerShell to confirm the patch is present, and check the OS version reports 20348.4893.
Are there known issues with KB5078766?
Reported issues include installation failures with error 0x80070643 (insufficient disk space) and 0x800f0922 (corrupted Windows Update components). The Print Spooler service may need a manual restart, and domain controllers may need a Group Policy refresh.
The bottom line
KB5078766, released March 10, 2026, patches critical RPC, Kerberos, Print Spooler and kernel vulnerabilities in Windows Server 2022 and brings systems to build 20348.4893.
The unauthenticated RPC remote code execution flaw and Kerberos bypass make this a high-priority update for server environments.
What happens next
Administrators should stage, deploy and verify the update across their Windows Server 2022 fleet, prioritizing internet-facing servers and domain controllers.
What to do
Install KB5078766, restart, and confirm the build reports 20348.4893.
Sources
Microsoft · Mar 10, 2026 · Primary source
Claims supported
- KB5078766 released March 10, 2026 and brings Windows Server 2022 to build 20348.4893
- Update patches CVE-2026-0847, CVE-2026-0851, CVE-2026-0863 and CVE-2026-0871