KB5082063: Windows Server 2019 Security Update (April 2026)

Download KB5082063

Get the official update for KB5082063. The download and file size for each supported product are on the Microsoft Update Catalog page.

Update summary

Senserva AI Opinion for KB5082063

KB5082063 is a large Windows 10 1809 and Server 2019 rollup fixing 125 CVEs, topped by a Critical issue at CVSS 9.8 with a 64% EPSS score, meaning exploitation is statistically likely rather than theoretical. One of the included CVEs is already listed in the CISA KEV catalog, so it is being exploited in the wild even though none are tied to ransomware campaigns yet. Server 2019 domain controllers and legacy 1809 endpoints still in production are the exposed population here.

Do this: Prioritize this rollup on Server 2019 and any remaining Windows 10 1809 machines this cycle, deploying to the KEV-exposed and internet-facing systems first.

AI-generated from public data, 2026-07-21. Verify against the vendor advisory before acting.

Senserva AI Opinion and rich prompt for KB5082063

Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.

Full tracking and change history for KB5082063

Senserva began recording day-to-day change history on 2026-07-07, and refreshes it several times a day. Release dates are historical where Microsoft publishes them; revision history is tracked from that date forward, so it does not include changes made before then.

Exploitation and severity

Fixes 125 CVEs. At least one is actively exploited (CISA KEV). Most severe CVSS 9.8 (Critical). EPSS exploit probability up to 64%.

Among the top 25% of tracked Microsoft updates by EPSS exploit probability.

What to do

Treat as urgent: it is being exploited in the wild (CISA KEV), so patch ahead of items that are not. Senserva flags whether KB5082063 is missing on your devices.

Check if KB5082063 is installed

Copy-paste PowerShell: one machine, or your whole fleet in one pass. No output means the update is not installed.

Get-HotFix covers Windows updates. Office, SharePoint, and Exchange server updates show under installed updates in Programs and Features, or check the Update Catalog history.

Known issues, from Microsoft

Quoted from Microsoft's support article for KB5082063 (checked 2026-07-21). Verify against the article before acting.

Installation of this update might fail with error 0x800F0983 or 0x80073712

Symptom

A small number of devices might fail to install this update with one of the following error messages:

"Install error - 0x800F0983"

"Some update files are missing or have problems. We'll try to download the update again later. Error code: (0x80073712)"

Resolution

This issue is addressed in out-of-band update KB5091157 .

Note

Hotpatch‑enrolled Windows Server 2025 devices affected by this issue can install out‑of‑band update KB5091157 to receive the same protections as the April security update ( KB5082063 ). However, installing KB5091157 requires a restart and pauses hotpatching. Hotpatch updates will resume after the July 2026 baseline update.

Domain controllers might restart repeatedly after installing this update

Symptom

After installing this update and restarting, domain controllers (DCs) in environments with multiple domains in the forest that use Privileged Access Management (PAM), might experience LSASS crashes during startup. As a result, affected domain controllers might restart repeatedly, preventing authentication and directory services from functioning, and potentially rendering the domain unavailable.

Resolution

This issue is addressed in out-of-band update KB5091157 .

Note

If your Windows Server 2025 device is enrolled in hotpatching, you should instead install the OOB hotpatch ...

Writing about KB5082063? Cite this page

Copy-paste for a blog post, forum answer, or internal doc. The link always carries the current risk data.

CVEs fixed by this update

Sorted exploited-first, then by CVSS. Every CVE links to its Senserva page with the full risk facts, references, and a ready-to-paste AI prompt.

Affected products

• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows Server 2019

Also released in April 2026

The highest-risk updates from the same release:

The full month, summarized: Microsoft Patch Tuesday.

How to install KB5082063

Any of these paths delivers KB5082063; most organizations already have one of the first three running:

• Intune update rings (Windows Update for Business): the update flows on each ring's deferral schedule. For this update, consider an expedite policy: it bypasses deferrals for exactly this fix-now case.
• Windows Autopatch: rings, rollout, and pause or rollback are managed for you; exploited updates can be expedited.
• WSUS / Configuration Manager: approve KB5082063 for your device groups and set a deadline (deadline, not just approval, for an exploited fix).
• Manual: download from the Update Catalog above and install; fine for a handful of machines, unmanageable at any real scale.

After the rollout, verify rather than assume: update compliance reporting in Intune or Autopatch shows which devices actually installed it, and Siemserva reads Intune, Defender, Autopatch, and Azure Update Manager together to show the devices still missing KB5082063, ranked by exploitation.

Common questions about KB5082063

Does KB5082063 have known issues?

Yes. Microsoft's support article documents known issues for KB5082063 (checked 2026-07-21). The Known issues section on this page quotes it; verify against the article before acting.

Is KB5082063 urgent?

Yes. KB5082063 fixes at least one vulnerability in the CISA Known Exploited Vulnerabilities catalog, meaning attackers are using it in the wild. Deploy it first.

How do I download KB5082063?

From the Microsoft Update Catalog (linked on this page), or let Intune, Windows Update for Business, Windows Autopatch, or WSUS deliver it. The catalog page lists the download for each supported product.

How do I deploy KB5082063 with Intune?

Assign a Windows Update ring (quality update policy) to the device groups and the update flows on the ring's deferral schedule. Because KB5082063 fixes an actively exploited CVE, an Intune expedite policy is the right tool: it bypasses configured deferrals and pushes the update as soon as devices check in. Verify the rollout with update compliance reporting rather than assuming delivery.

Can I ask my own AI about KB5082063?

Yes. This page includes a free, ready-to-paste AI prompt containing KB5082063's key facts: severity, CVE count, exploitation status, and the download link. Copy it into Claude, ChatGPT, or Copilot for a rollout plan; the data is refreshed three times a day (5 AM, 12:30 PM, and 7 PM US Central).

Authoritative references