KB5078736 — March 2026 Security Hotpatch for Windows Server 2025

Overview

KB5078736 is a critical security hotpatch update released on March 10, 2026, for Windows Server 2025 systems. This update leverages Microsoft's hotpatch technology to deliver security fixes without requiring a system restart, ensuring continuous server availability while addressing multiple high-priority vulnerabilities. The update advances the OS build number to 26100.32463 and includes fixes for remote code execution, privilege escalation, information disclosure, and denial of service vulnerabilities.

Security Vulnerabilities Addressed

This hotpatch update resolves five critical security vulnerabilities identified through Microsoft's ongoing security research and external security disclosures:

CVE-2026-0847: Windows Remote Management Remote Code Execution

A critical vulnerability in the Windows Remote Management service that allows authenticated attackers to execute arbitrary code with SYSTEM privileges. The vulnerability stems from insufficient input validation in WinRM request processing, potentially allowing attackers to gain complete control of affected servers.

CVE-2026-0848: Windows Server Core Privilege Escalation

A privilege escalation vulnerability specific to Windows Server Core installations where local users can elevate their privileges to SYSTEM level through manipulation of service control operations. This vulnerability affects the core service management infrastructure.

CVE-2026-0849: Active Directory Domain Services Information Disclosure

An information disclosure vulnerability in Active Directory Domain Services that could allow authenticated users to access directory information beyond their authorized permissions through crafted LDAP queries.

CVE-2026-0850: HTTP.sys Denial of Service

A denial of service vulnerability in the HTTP.sys kernel driver that can cause system crashes when processing specially crafted HTTP requests, affecting web servers and applications using HTTP.sys.

Affected Systems

This update applies to the following Windows Server 2025 editions:

Hotpatch Technology

This update utilizes Microsoft's hotpatch technology, which allows critical security updates to be applied to running systems without requiring a restart. Hotpatch works by:

• Modifying running code in memory without stopping services
• Applying security fixes to active processes and kernel components
• Maintaining system availability during the update process
• Providing immediate protection against security vulnerabilities

Installation Requirements

Before installing KB5078736, ensure your system meets the following requirements:

• Operating System: Windows Server 2025 (any edition)
• Hotpatch Status: Enabled (for zero-downtime installation)
• Disk Space: Minimum 100 MB available on system drive
• Network Connectivity: Required for Windows Update delivery
• Administrative Privileges: Required for installation

Deployment Methods

Automatic Deployment

Systems configured for automatic updates will receive KB5078736 automatically starting March 10, 2026. Hotpatch-enabled systems receive priority deployment to minimize exposure to security vulnerabilities.

Manual Deployment

Administrators can manually install the update using:

• Windows Update: Check for updates through Settings > Update & Security
• PowerShell: Install-WindowsUpdate -KBArticleID KB5078736
• Microsoft Update Catalog: Download and install manually

Enterprise Deployment

Enterprise environments can deploy KB5078736 through:

• WSUS: Approve for deployment to server groups
• SCCM: Create software update deployment
• Microsoft Intune: Configure update policies for managed devices

Post-Installation Verification

After installation, verify the update was applied successfully:

# Check installed updates
Get-HotFix -Id KB5078736

# Verify OS build number
(Get-ItemProperty "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuild

# Check hotpatch status
Get-WindowsUpdateLog | Select-String "KB5078736"

The OS build number should display 26100.32463 after successful installation.

Rollback Procedures

If issues occur after installing KB5078736, the update can be removed using:

# Remove hotpatch update
Remove-WindowsPackage -Online -PackageName "Package_for_KB5078736"

# Alternative method through DISM
dism /online /remove-package /packagename:Package_for_KB5078736