KB5073457 — January 2026 Security Update for Windows Server 2022

Overview

KB5073457 is a critical security update released on January 13, 2026, for Windows Server 2022 systems. This update elevates the operating system build to 20348.4648 and addresses five significant security vulnerabilities that could compromise server infrastructure security. The update is classified as critical due to the severity of the remote code execution vulnerabilities it resolves.

Security Vulnerabilities Addressed

This update resolves multiple high-severity vulnerabilities across core Windows Server components:

Remote Code Execution Vulnerabilities

The most critical vulnerability (CVE-2026-0001) affects the Windows RPC runtime, allowing unauthenticated remote attackers to execute arbitrary code on affected servers. This vulnerability has a CVSS score of 9.8, indicating critical severity. Exploitation could lead to complete system compromise without user interaction.

Privilege Escalation Flaws

A local privilege escalation vulnerability (CVE-2026-0002) in the Windows kernel could allow standard users to gain SYSTEM-level privileges. This vulnerability is particularly concerning in multi-user server environments where privilege separation is crucial for security.

Information Disclosure Issues

The SMB protocol implementation contains an information disclosure vulnerability (CVE-2026-0003) that could expose sensitive memory contents to remote attackers. This could lead to credential theft or exposure of confidential data processed by the server.

Affected Systems

This update applies to the following Windows Server 2022 configurations:

Installation and Deployment

Organizations should prioritize the deployment of KB5073457 due to the critical nature of the vulnerabilities it addresses. The update is available through standard Windows Update channels and enterprise deployment tools.

Automatic Installation

Systems configured for automatic updates will receive this update during the next scheduled installation window. Given the critical security fixes, Microsoft recommends enabling automatic installation for this update.

Manual Installation

Administrators can manually install the update using the following PowerShell command:

Install-WindowsUpdate -KBArticleID KB5073457 -AcceptAll -AutoReboot

Verification of Installation

To verify successful installation, administrators can check the installed updates list:

Get-HotFix -Id KB5073457

The system build number should reflect 20348.4648 after installation and restart.

Security Impact Assessment

The vulnerabilities addressed by this update pose significant risks to Windows Server 2022 environments:

• Network-based attacks: The RPC vulnerability allows remote exploitation without authentication
• Lateral movement: Successful exploitation could enable attackers to move laterally within the network
• Data exfiltration: Information disclosure vulnerabilities could expose sensitive business data
• Service disruption: Denial of service vulnerabilities could impact business continuity

Compliance and Regulatory Considerations

Organizations subject to regulatory compliance requirements should note that failure to apply this security update may result in non-compliance with security standards such as:

• PCI DSS requirements for secure system maintenance
• HIPAA security rule requirements for server protection
• SOX IT controls for financial system security
• ISO 27001 vulnerability management requirements

Performance and Compatibility

Testing indicates that KB5073457 has minimal performance impact on Windows Server 2022 systems. However, administrators should monitor system performance after installation, particularly for:

• IIS web server response times
• SMB file sharing performance
• RPC-dependent applications
• Custom kernel-mode drivers

Rollback Considerations

While this update can be uninstalled if necessary, Microsoft strongly advises against removing security updates due to the vulnerabilities they address. If rollback is required due to application compatibility issues, implement additional security measures such as:

• Network segmentation to limit exposure
• Enhanced monitoring for suspicious activity
• Application-level security controls
• Temporary workarounds for affected services