March 10, 2026 - KB5078938 (OS Build 14393.8957) Security Update

Summary

KB5078938 is a security update for Windows Server 2016, Windows 10 Enterprise LTSB 2016, and Windows 10 IoT Enterprise 2016 LTSB, bringing the OS to build 14393.8957. Released on March 10, 2026, it is a monthly cumulative security update that builds on the February 10, 2026 update (KB5075999). Full details are at Microsoft Support.

Highlights

• A warning dialog has been added to Windows System Image Manager to help users confirm that a selected catalog file comes from a trusted source.
• Windows quality updates now include additional high-confidence device targeting data to expand coverage of devices eligible to automatically receive new Secure Boot certificates.

Improvements and fixes

• Windows System Image Manager: A new warning dialog prompts users to verify that the catalog file they have selected originates from a trusted source before proceeding.
• Secure Boot certificate rollout: Quality updates now carry additional high-confidence device targeting data. This increases the number of devices eligible to receive updated Secure Boot certificates automatically. Targeting relies primarily on client device diagnostic data. Because server diagnostic data is more limited, servers are unlikely to qualify for automatic certificate delivery, though they are not explicitly excluded. Certificates are delivered only after a device demonstrates sufficient successful update signals, keeping the rollout controlled and phased.

Known issues

Microsoft lists no known issues for this update at the time of writing.

How to get this update

Prerequisite - Servicing Stack Update

Before installing KB5078938, Microsoft recommends that the latest Servicing Stack Update (SSU) KB5075902 be installed on the target device or offline image. This requirement applies to any update released on or after January 14, 2025. Until the SSU is present, this update may not be offered to the device. To reduce security risk, install the SSU as soon as possible.

Delivery channels

• Windows Update: KB5078938 downloads and installs automatically. The required SSU (KB5075902) is offered automatically alongside it.
• Windows Update for Business: The update and SSU are delivered automatically in accordance with configured policies.
• Microsoft Update Catalog: Download the standalone package directly from the Update Catalog website. Microsoft recommends also downloading and installing SSU KB5075902 manually from the Catalog if it is not already present.
• Windows Server Update Services (WSUS): Administrators must approve both SSU KB5075902 and KB5078938. Configure Products and Classifications as follows - Product: Windows Server 2016, Windows 10, and Windows 10 LTSB; Classification: Security Updates.

Frequently asked questions

Does this update affect all editions of Windows Server 2016 and Windows 10 LTSB 2016?

Yes. KB5078938 applies to Windows Server 2016 (all editions), Windows 10 Enterprise LTSB 2016, and Windows 10 IoT Enterprise LTSB 2016. The same OS build number, 14393.8957, is the resulting version across all three product variants covered by this update.

What is the Secure Boot certificate change and does it affect servers automatically?

This update expands the pool of devices eligible to receive new Secure Boot certificates by including additional high-confidence targeting data in quality updates. The targeting relies on client device diagnostic data. Because servers generate limited diagnostic data, they are unlikely to qualify for automatic delivery of new certificates, though they are not explicitly excluded from receiving them.

Is the Servicing Stack Update mandatory before installing KB5078938?

Microsoft strongly recommends installing SSU KB5075902 first. Without it, the update may not be offered to the device at all. On Windows Update and Windows Update for Business, the SSU is offered automatically. WSUS administrators must approve it separately alongside KB5078938.

When do these products reach end of support?

Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB reach end of support on October 13, 2026. Windows Server 2016 reaches end of support on January 12, 2027. After those dates, Microsoft will no longer provide free updates, technical assistance, or security fixes from Windows Update.