December 9, 2025 Hotpatch KB5071413 - Windows Server 2022 OS Build 20348.4467

Summary

This is a Hotpatch security and quality update for Windows Server 2022 Datacenter: Azure Edition, released on December 9, 2025, bringing the OS to build 20348.4467. It addresses internal OS security improvements and ships alongside the latest servicing stack update. See the Microsoft Support page for full details.

Improvements and fixes

• This update applies miscellaneous security improvements to internal OS functionality.

Known issues

WSUS does not display synchronization error details

Symptom: After installing KB5070892 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting.

Workaround: This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. No workaround is documented beyond acknowledging the intentional removal.

How to get this update

Before installing, note that Microsoft now combines the latest servicing stack update (SSU) with this Hotpatch update. If you are using Windows Update or WSUS, the latest SSU installs automatically alongside this update. The SSU for this release is KB5068786, version 20348.4400.

This update is available through the following channels:

• Windows Update / Microsoft Update - Downloads and installs automatically.
• Windows Update Catalog - Available for manual download.
• Windows Server Update Services (WSUS) - Syncs automatically when you configure Products as "Server 2022 Hotpatch Category" and Classifications as "Security Updates".

File information for cumulative update KB5071413 and the SSU (KB5068786) can be downloaded from the Microsoft Support page.

Announcements and messages

Secure Boot certificate expiration notice

Microsoft has flagged that Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been rolling out updated certificates to consumer and non-managed business devices over recent months. Devices that have not yet received newer certificates will continue to start and operate normally, and standard Windows updates will continue to install. Microsoft will continue deploying updated certificates through Windows Update in coming months.

IT administrators should consult the Secure Boot Playbook for Windows clients and Windows Server. Individual device status can be checked in the Windows Security app.

Frequently asked questions

What is a Hotpatch update, and how does it differ from a standard cumulative update?

A Hotpatch update applies security and quality fixes to running processes without requiring a system restart in most cases. It targets Windows Server 2022 Datacenter: Azure Edition specifically. For a full explanation of the differences between security updates, optional non-security previews, out-of-band updates, and continuous innovation releases, Microsoft recommends reviewing the Windows monthly updates explained documentation.

Does this update include its own servicing stack update?

Yes. Microsoft now bundles the latest servicing stack update with Hotpatch packages. For this release, the included SSU is KB5068786 at version 20348.4400. If you deploy through Windows Update or WSUS, the SSU installs automatically alongside KB5071413 with no separate action required.

Why is WSUS no longer showing synchronization error details after this update?

The removal of synchronization error detail reporting in WSUS is intentional. It was disabled to remediate the Remote Code Execution Vulnerability identified as CVE-2025-59287, introduced when KB5070892 or later updates are installed. Microsoft has not documented an alternative workaround at this time.

Where can administrators monitor the health and release status of this update?

Microsoft recommends checking the Windows release health dashboard or the Windows Server 2022 update history page for the latest status information related to this release. These resources reflect any post-release revisions, known issue changes, or additional guidance.