Microsoft Ships KB5082198 for Windows Server 2016 and Windows 10 1607, Fixing Four Critical Flaws

KB5082198 is a cumulative security update released on April 14, 2026 for Windows 10 Version 1607 and Windows Server 2016. It updates the operating system to build 14393.9060 and forms part of Microsoft's monthly Patch Tuesday cycle.

The package resolves multiple vulnerability classes: remote code execution, privilege escalation, information disclosure and denial of service, alongside a security bypass in Windows Defender Application Control. Microsoft classifies the update as Important for delivery, but several of the underlying flaws are rated critical.

According to the update documentation, the following CVEs are patched:

• CVE-2026-0847 — Windows kernel remote code execution in memory management routines, potentially allowing arbitrary code execution with SYSTEM privileges.
• CVE-2026-0848 — Privilege escalation in Windows authentication, affecting the Local Security Authority (LSA) and access token validation, allowing a local attacker to reach SYSTEM.
• CVE-2026-0849 — Information disclosure in the Windows networking stack that could expose sensitive memory contents through network protocol handlers.
• CVE-2026-0850 — Denial of service in file system drivers (including NTFS) triggered by malformed file operations, potentially crashing the system.

The update additionally strengthens policy enforcement in Windows Defender Application Control (WDAC), closing a bypass that could allow unauthorized code execution despite code integrity restrictions.

The update applies to the following platforms, all moving to build 14393.9060:

• Windows 10 Version 1607 (32-bit)
• Windows 10 Version 1607 (x64)
• Windows Server 2016 (x64)
• Windows Server 2016 Server Core (x64)

For most systems, KB5082198 is delivered automatically through Windows Update. Administrators can also obtain standalone packages from the Microsoft Update Catalog (Windows10.0-KB5082198-x64.msu, approximately 1.2 GB, and Windows10.0-KB5082198-x86.msu, approximately 950 MB) for offline or controlled deployment via WSUS, SCCM or Microsoft Intune.

Microsoft notes a minimum of 2 GB free disk space on the system drive and administrator privileges are required. The update requires a restart to complete, so plan maintenance windows for production servers.

To confirm installation, check the OS build reported by winver (should read 14393.9060) or query the hotfix directly:

Get-HotFix -Id KB5082198

Microsoft has documented several known issues with this update:

• Installation may fail with error 0x80070070 on systems with less than 2 GB of free disk space; free up space before retrying.
• Some systems may see brief network connectivity interruptions during installation, restored automatically after restart.
• Certain third-party antivirus products may temporarily flag system files during the update; this is expected and resolves after completion.

If installation fails, Microsoft suggests running the Windows Update Troubleshooter or manually installing the standalone package from the Microsoft Update Catalog. The update can be uninstalled via Settings > Update & Security > Windows Update > View update history > Uninstall updates.