Deploy Microsoft ESU security update KB5073700

This official Microsoft Patch Tuesday update addresses 24 linked CVEs for Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation), Windows Server 2008 for x64-based Systems Service Pack 2, plus 1 more.

Product: Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation), Windows Server 2008 for x64-based Systems Service Pack 2, plus 1 more
Release: 6.0.6003.23717
Published: 2026-01-13
Updated: 2026-01-13
Cycle: January 2026 Patch Tuesday

Normal patch windowBlackTree recommended timinghigh confidence

24Vendor-linked CVEsComplete For Update

1Preserved revisionsCanonical history remains visible

0Known issuesVendor-documented context only

Action and evidence

Operational decision

Action type: Deploy Patch
Platform: ESU
Restart: yes
Vendor signal: Important

Why this urgency

Fix Available
Routine Review

Evidence signals kept separate

CISA KEV: Unknown
Confirmed exploitation: Not Stated
Vendor exploitability: Not stated in the reviewed source
Maximum CVSS: 8.8 (CVSS 3.1, CVE-2026-20868)
Maximum EPSS: Not loaded for this patch record

Normal patch window

BlackTree recommends the normal approved patch window. No accepted exploitation or emergency signal currently justifies an out-of-band change by itself.

BlackTree urgency is an operational review window. It does not replace vendor severity or CVSS.

Environment override questions

Is Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation), Windows Server 2008 for x64-based Systems Service Pack 2, plus 1 more exposed to untrusted networks or content?
Does this update affect an identity, management, backup or other control-plane system?
Are compensating controls tested and monitored until the selected patch window?

Deployment context

Effects and caveats

Use the vendor update channel or update catalogue entry for the applicable product release.
Plan a restart when the vendor remediation marks one as required.

Known data gaps

Confirm exact product, edition and architecture applicability in the Microsoft Security Update Guide before deployment.

Deployment plan

Guidance basis: Blacktree Generic

Prerequisites

Confirm the affected product, edition, architecture and current build before deployment.

Sequencing

Test the update in a representative deployment ring before broad release.

Downtime

A restart is required. Plan service interruption and validation.

Rollback and recovery

Capture the current version and a recoverable backup or snapshot before the change.
Use the vendor-supported uninstall or recovery path when one is available.

Workarounds

No vendor workaround is asserted unless it appears in the official advisory.

Vulnerability relationships

Vendor-linked CVEs

The complete CVE relationship set is not available in this bounded record.

Linked CVEs: 24
Confirmed exploited: 0
PoC or lab evidence: 0
Maximum CVSS: 8.8

Open linked CVE review

Provenance

Field verification

Patch_identity_and_productsmsrc-cvrf/vendor-fixVerified Automatic · Retrieved 26 Aug 2026, 11:55 UTC
Cve_relationships_and_exploit_statusmsrc-cvrf/vulnerabilityVerified Automatic · Retrieved 26 Aug 2026, 11:55 UTC

Open official vendor source

Revision history

Canonical record changes

Revision 12026-01-13
Initial Patch Tuesday publication.

Publication review

The update identity, affected product mapping, restart signal, vendor severity, exploit status and complete CVE relationships were generated from the official MSRC CVRF document and passed structural validation. The project owner approved automatic Patch Tuesday publication. Each published record passed its own official-source completeness gate. Pending sources expose readiness only and prior approved records are retained on refresh failure.