KB5061906 (OS Build 20348.3695) Out-of-Band Update for Windows Server 2022 - May 23, 2025

Summary

This is a non-security, out-of-band quality update for Windows Server 2022, bringing the OS to build 20348.3695. Released on May 23, 2025, it addresses a single Hyper-V stability problem affecting confidential virtual machines. It also bundles servicing stack update KB5058531 (version 20348.3691). See the Microsoft Support page for full details.

Improvements and fixes

• Hyper-V Platform - confidential VM stability: Resolves a bug in the direct send path for a guest physical address (GPA) that could cause confidential virtual machines running on Hyper-V with Windows Server 2022 to intermittently stop responding or restart without warning. The problem required manual intervention to recover and primarily affected Azure confidential VMs.

Known issues

Microsoft lists no known issues for this update at the time of writing.

How to get this update

Microsoft has combined the latest servicing stack update (SSU) for Windows Server 2022 with this cumulative update (LCU) into a single package. The bundled SSU is KB5058531 at version 20348.3691.

Prerequisite for offline OS image servicing: Before applying this update to an offline image, confirm that the image already includes KB5030216 (released 09/12/2023) or a later LCU. That LCU sets the SSU version to 20348.1960, which is the minimum required to avoid error 0x800f0823 (CBS_E_NEW_SERVICING_STACK_REQUIRED).

The update is available through the following channels:

• Windows Update - available now for eligible devices.
• Windows Update for Business - available now.
• Windows Server Update Services (WSUS) - available now.
• Microsoft Update Catalog - download the standalone package directly from the Catalog if needed.

Removing the LCU: If you need to uninstall the LCU after installing the combined package, use the DISM /Remove-Package command with the LCU package name as the argument. You can locate the package name by running DISM /online /get-packages. Note that running wusa.exe /uninstall against the combined package will not work because the package includes the SSU, and the SSU cannot be removed after installation.

Frequently asked questions

Who needs this update?

Any organization running Windows Server 2022 hosts that support confidential virtual machines under Hyper-V should treat this as a priority deployment. The fix specifically targets Azure confidential VMs, but any on-premises Hyper-V environment with a similar configuration may also benefit from the corrected direct send path behavior.

Is this update security-related?

No. Microsoft classifies KB5061906 as a non-security, out-of-band quality update. It was released outside the normal monthly Patch Tuesday cycle to address the Hyper-V confidential VM crash issue promptly, but it carries no security fixes of its own.

Does the combined SSU and LCU package change how I uninstall updates?

Yes. Because the SSU is bundled with the LCU, you cannot use wusa.exe /uninstall to remove the LCU. Use DISM /Remove-Package with the specific LCU package name instead. The SSU component itself cannot be removed from the system once installed.

What prerequisite applies when servicing an offline image?

Before installing KB5061906 on an offline OS image, the image must already contain KB5030216 (09/12/2023) or a later LCU. That update raises the SSU version to 20348.1960, which is the minimum level required to prevent the CBS_E_NEW_SERVICING_STACK_REQUIRED error (0x800f0823) during installation.