Microsoft Ships KB5087545, Fixing Five Critical Windows Server 2022 Flaws
The cumulative update addresses RDP, Print Spooler, Active Directory, SMB, and Hyper-V vulnerabilities, but ships with documented Hyper-V startup delays and AD replication lag.
On this page
Key takeaways
- KB5087545 was released May 12, 2026, for all Windows Server 2022 editions and raises the build to 20348.5139.
- It patches five critical CVEs, including an unauthenticated RDP RCE (CVE-2026-0145, CVSS 9.8).
- Other fixes cover Print Spooler privilege escalation, an Active Directory security bypass, SMB information disclosure, and a Hyper-V guest escape.
- Known issues include Hyper-V VM startup delays for VMs with 16 GB+ memory and temporary AD replication delays after restart.
- A system restart is required; admins should test in non-production and deploy via WSUS or SCCM during maintenance windows.
What to do now
High urgency- Test KB5087545 in a non-production environment, then deploy via WSUS or SCCM during a maintenance window
- Prioritize internet-facing servers with RDP enabled and Hyper-V hosts
- After installing on domain controllers, monitor AD replication with repadmin /showrepl
- Restart affected services (vmms, spooler) if known issues appear
Microsoft released KB5087545, the May 2026 cumulative security update for Windows Server 2022, on May 12, 2026. The update addresses five critical vulnerabilities spanning Remote Desktop Services, Print Spooler, Active Directory Domain Services, SMB, and Hyper-V, and raises the operating system build number to 20348.5139.
The headline fix is CVE-2026-0145, an unauthenticated remote code execution flaw in RDP with a CVSS score of 9.8 that is especially dangerous for internet-facing servers. A separate Hyper-V guest-to-host escape (CVE-2026-0149) puts virtualization hosts at risk, making prompt patching a priority for server administrators.
Microsoft's KB5087545 patches five critical Windows Server 2022 vulnerabilities, including an unauthenticated RDP RCE, and updates the build to 20348.5139.
Install KB5087545 to fix five critical Windows Server 2022 flaws. Test first: known issues affect Hyper-V startup, Print Spooler, and AD replication. A restart is required.
Affected & context
Microsoft released KB5087545, a cumulative security update for Windows Server 2022, on May 12, 2026, addressing five critical vulnerabilities and raising the OS build to 20348.5139.
The update fixes an unauthenticated remote code execution flaw in RDP (CVSS 9.8) and a Hyper-V guest-to-host escape, both high-risk for internet-facing and virtualization hosts.
All Windows Server 2022 editions (Standard, Datacenter, Server Core, Azure Edition) on x64.
- Vendors
- Microsoft
- Products
- Windows Server 2022 StandardWindows Server 2022 DatacenterWindows Server 2022 Server CoreWindows Server 2022 Azure Edition
- Geography
- Global
- CVEs
- CVE-2026-0145CVE-2026-0146CVE-2026-0147CVE-2026-0148CVE-2026-0149
What KB5087545 fixes
KB5087545 is a cumulative security update for Windows Server 2022 released on May 12, 2026. According to Microsoft's documentation, it resolves five critical vulnerabilities in core server components and raises the operating system build number to 20348.5139.
The vulnerabilities stem from improper input validation in core components, insufficient privilege checks in system services, and memory corruption issues in network protocol handlers. Because the flaws exist in the base Windows Server 2022 codebase, patching requires this cumulative update.
- Update raises build to 20348.5139
- Five critical CVEs addressed
- Released May 12, 2026
The five vulnerabilities
CVE-2026-0145 — RDP remote code execution
A critical flaw in Windows Remote Desktop Services lets an unauthenticated attacker execute arbitrary code by sending specially crafted network packets to the RDP protocol handler. It carries a CVSS score of 9.8 and poses the highest risk to internet-facing servers with RDP enabled.
CVE-2026-0146 — Print Spooler privilege escalation
A local attacker can gain SYSTEM-level privileges through the Print Spooler service on servers with the Print and Document Services role installed.
CVE-2026-0147 — Active Directory security bypass
A security feature bypass in Active Directory Domain Services could let an attacker circumvent authentication mechanisms. It particularly affects domain controllers and could lead to domain compromise if exploited.
CVE-2026-0148 — SMB information disclosure
An information disclosure flaw in the SMB protocol could allow an attacker to read sensitive data from server memory, affecting file servers.
CVE-2026-0149 — Hyper-V guest-to-host escape
A guest-to-host escape in Windows Hyper-V could let a malicious virtual machine execute code on the host, breaking VM isolation in virtualization environments.
- CVE-2026-0145 CVSS score is 9.8
- CVSS scores range from 7.8 to 9.8 per Microsoft's FAQ
Affected systems
The update applies to the following x64 Windows Server 2022 editions, all of which move from a prior 20348.x build to 20348.5139:
- Windows Server 2022 Standard
- Windows Server 2022 Datacenter
- Windows Server 2022 Server Core
- Windows Server 2022 Azure Edition
Deployment and verification
KB5087545 is delivered automatically via Windows Update and is also available through the Microsoft Update Catalog, WSUS, and SCCM. The full package is roughly 1.2 GB (about 850 MB for Server Core), and a restart is required to complete installation.
Test before broad rollout
Microsoft recommends testing the update in non-production environments before wide deployment, and staging it through WSUS or SCCM during scheduled maintenance windows.
After installation, confirm the patch and build number with PowerShell:
Get-HotFix -Id KB5087545
Get-ComputerInfo | Select-Object WindowsVersion, WindowsBuildLabEx- Prerequisites: 2 GB free disk space, prior updates installed, admin rights, restart capability
Known issues after installing
Microsoft has documented several post-installation issues admins should watch for:
- Hyper-V VM startup delays affecting VMs with 16 GB or more memory. Microsoft is investigating; workaround is to restart the vmms service (Restart-Service vmms).
- Print Spooler may require a manual restart in configurations with multiple print queues (Restart-Service spooler).
- Domain controllers may see temporary AD replication delays, typically resuming within 30 minutes of restart. Monitor with repadmin /showrepl.
Timeline
KB5087545 released
Microsoft releases the May 2026 cumulative security update for Windows Server 2022, raising the build to 20348.5139.
Source: Microsoft update documentation
Confidence: Medium
Impact
Unpatched Windows Server 2022 systems remain exposed to remote code execution, privilege escalation, authentication bypass, and information disclosure across RDP, Print Spooler, Active Directory, SMB, and Hyper-V.
Business impact
A successful RDP or Hyper-V exploit could compromise server infrastructure and, via the AD bypass, potentially an entire domain.
Technical impact
Fixes span RDP protocol handlers, the Print Spooler service, Kerberos/LDAP validation in AD DS, SMB request handling, and Hyper-V isolation mechanisms.
Security impact
Addresses an unauthenticated RDP RCE (CVSS 9.8) and a Hyper-V guest-to-host escape, among five critical flaws.
Privacy impact
The SMB flaw (CVE-2026-0148) could expose confidential data held in server memory.
Affected audience: IT admins, MSPs, Datacenter and virtualization teams
Action required.
Technical details
- CVEs
- CVE-2026-0145, CVE-2026-0146, CVE-2026-0147, CVE-2026-0148, CVE-2026-0149
- CVSS
- 9.8
- Attack vector
- Network (RDP); local (Print Spooler); guest VM (Hyper-V)
- Affected versions
- Windows Server 2022 (builds prior to 20348.5139)
- Patched versions
- 20348.5139
Detection methods
- Get-HotFix -Id KB5087545 to confirm the update is installed
Mitigations
- Install KB5087545 and restart
- Limit RDP exposure on internet-facing servers
Workarounds
- Restart-Service vmms to address Hyper-V VM startup delays
- Restart-Service spooler if the Print Spooler misbehaves after install
Response
Customer guidance
Microsoft advises testing the update in non-production before broad deployment, staging via WSUS or SCCM, and planning the required restart during a maintenance window. Verify installation with Get-HotFix and confirm build 20348.5139.
Response status: Patched
Patch available: Yes
Workaround available: Yes
FAQ
What does KB5087545 fix?
It resolves five critical Windows Server 2022 vulnerabilities: RDP remote code execution (CVE-2026-0145), Print Spooler privilege escalation (CVE-2026-0146), an Active Directory security bypass (CVE-2026-0147), SMB information disclosure (CVE-2026-0148), and a Hyper-V guest escape (CVE-2026-0149).
Which systems need KB5087545?
All x64 Windows Server 2022 editions — Standard, Datacenter, Server Core, and Azure Edition. The update raises the build number to 20348.5139.
How severe are the vulnerabilities?
Microsoft lists CVSS scores ranging from 7.8 to 9.8. The RDP remote code execution flaw (CVE-2026-0145) is rated 9.8 and can be exploited without authentication.
Are there known issues with KB5087545?
Yes. Hyper-V VMs with 16 GB or more memory may see startup delays, the Print Spooler may need a manual restart, and domain controllers may experience temporary AD replication delays after restart.
How do I verify KB5087545 is installed?
Run Get-HotFix -Id KB5087545 in PowerShell and confirm the build number is 20348.5139 using Get-ComputerInfo or winver.
The bottom line
KB5087545, released May 12, 2026, patches five critical Windows Server 2022 vulnerabilities and updates the build to 20348.5139, but ships with documented Hyper-V, Print Spooler, and AD replication issues.
Prioritize KB5087545 for internet-facing RDP servers and Hyper-V hosts, but validate it against known post-install issues first.
What happens next
Microsoft says it is investigating the Hyper-V VM startup delay and will provide a resolution in a future update.
What to do
Test and deploy KB5087545, then verify build 20348.5139 and monitor affected server roles.
Sources
Microsoft · May 12, 2026 · Primary source
Claims supported
- KB5087545 released May 12, 2026, raising the build to 20348.5139
- Five critical CVEs addressed with CVSS scores from 7.8 to 9.8
- Known issues affecting Hyper-V, Print Spooler, and AD replication