KB5068864: Windows 10 Version 1607 / Windows Server 2016 Secur

KB5068864 is the November 11, 2025 cumulative security update for Windows 10 version 1607 and Windows Server 2016, moving affected systems to OS Build 14393.8594. Hosts below that build are missing a bundle of fixes, including a Critical Microsoft Graphics Component RCE (CVE-2025-60724), a High RRAS RCE (CVE-2025-64678), and a long tail of local elevation-of-privilege bugs. In plain English: this is not one flaw, it is a monthly rollup covering several different attack surfaces with very different real-world reachability.

The severity confusion is real: Tenable plugin 274780 itself is rated High, published November 11, 2025 and updated April 3, 2026; the apparent 'Critical' comes from an embedded legacy CVSS v2 10.0 line sourced from CVE-2025-60724, not from the plugin's own severity. For fleet prioritization, the vendor's worst-case score overstates reality because the most dangerous paths require either a specific exposed role like RRAS or an application path that actually feeds untrusted content into the vulnerable parser. That keeps this out of true wormable-Internet-fire territory for most enterprises, but still firmly in HIGH because exposed RRAS and high-value Server 2016 systems are common enough to matter.

Why this verdict

• Downward pressure: plugin-level reachability is overstated — this is a cumulative update check, not one universally reachable service bug across every host.
• Downward pressure: RRAS is a separate role — the cleanest remote path requires Remote Access / RRAS exposure, which implies a much smaller exposed population than the full set of missing hosts.
• Downward pressure: no KEV / no strong exploitation evidence — I found no CISA KEV listing or vendor-confirmed active exploitation for the representative RCEs.
• Upward pressure: there is still real remote-code-exec content here — CVE-2025-60724 is scored 9.8 by Microsoft and the bundle also includes CVE-2025-64678, so exposed edge cases deserve front-of-queue handling.
• Upward pressure: post-compromise value is high — even where remote reach is narrow, the included EoP set makes these excellent attacker follow-on bugs once any foothold exists.

Why not higher?

I am not calling this CRITICAL because the attack chain is not broadly Internet-wormable across the full vulnerable population. The strongest remote path depends on specific role exposure or content-processing conditions, and I found no active exploitation signal that would justify an emergency-everything response.

Why not lower?

I am not dropping this to MEDIUM because the bundle contains bona fide RCE material, including a Microsoft-scored 9.8 bug and an RRAS RCE relevant to real enterprise server roles. If you have even a small number of externally reachable RRAS or content-ingesting Server 2016 systems, the downside is too large for backlog treatment.

1. Restrict RRAS exposure — Block or tightly allowlist TCP 1723 and related VPN exposure paths on Server 2016 systems that do not absolutely need them. For a HIGH verdict, deploy this compensating control within 30 days; do it first on Internet-facing and partner-facing systems.
2. Disable unused Remote Access roles — Remove or disable RRAS / Remote Access where the service is not actively required. This shrinks the only clearly documented network-facing attack surface in the bundle and should be completed within 30 days on nonessential systems.
3. Prioritize parser-facing servers — Move servers that ingest untrusted files, images, Office content, or application uploads to the top of the queue because the Graphics Component RCE is only dangerous where untrusted content actually reaches the parser. Apply access restrictions or workflow isolation within 30 days while patching proceeds.
4. Lean on EDR preventions — Ensure exploit protection, memory protection, PowerShell logging, and service-creation detections are enforced on these hosts. This does not remove the bug, but it materially raises attacker failure rates in the post-execution stage and should be verified within 30 days.

Run this on the target Windows host or via your remote management tool. Invoke it with powershell.exe -ExecutionPolicy Bypass -File .\check-kb5068864.ps1; local admin is helpful for consistent hotfix enumeration, but standard read access is usually enough because the script falls back to registry build checks.

# check-kb5068864.ps1

# Verifies whether a Windows 10 1607 / Windows Server 2016 host is patched for KB5068864

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Write-Result {
    param(
        [string]$Status,
        [string]$Message,
        [int]$Code
    )
    Write-Output "$Status - $Message"
    exit $Code
}

try {
    $cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $productName = [string]$cv.ProductName
    $releaseId = [string]$cv.ReleaseId
    $displayVersion = [string]$cv.DisplayVersion
    $currentBuild = [int]$cv.CurrentBuildNumber
    $ubr = [int]$cv.UBR
    $buildString = "$currentBuild.$ubr"

    $isServer2016 = $productName -match 'Windows Server 2016'
    $isWin10_1607 = ($productName -match 'Windows 10') -and (($releaseId -eq '1607') -or ($displayVersion -eq '1607') -or ($currentBuild -eq 14393))

    if (-not ($isServer2016 -or $isWin10_1607)) {
        Write-Result 'UNKNOWN' "Host is '$productName' build $buildString, not Windows 10 1607 / Windows Server 2016." 2
    }

    # Preferred check: installed hotfix

    $kbInstalled = $false
    try {
        $hotfix = Get-HotFix -Id 'KB5068864' -ErrorAction Stop
        if ($hotfix) { $kbInstalled = $true }
    } catch {
        $kbInstalled = $false
    }

    # Fallback check: cumulative build number

    $buildPatched = $false
    if ($currentBuild -gt 14393) {
        $buildPatched = $true
    } elseif ($currentBuild -eq 14393 -and $ubr -ge 8594) {
        $buildPatched = $true
    }

    if ($kbInstalled -or $buildPatched) {
        $why = if ($kbInstalled) { 'KB5068864 is installed.' } else { 'OS build is at or above 14393.8594.' }
        Write-Result 'PATCHED' "$productName build $buildString. $why" 0
    } else {
        Write-Result 'VULNERABLE' "$productName build $buildString is below 14393.8594 and KB5068864 was not found." 1
    }
}
catch {
    Write-Result 'UNKNOWN' ("Verification failed: " + $_.Exception.Message) 2
}

Sources

1. Tenable Plugin 274780
2. Microsoft Support - KB5068864
3. NVD - CVE-2025-60724
4. NVD - CVE-2025-64678
5. Microsoft Learn - Remote Access role
6. Microsoft Learn - Network port requirements
7. CISA Known Exploited Vulnerabilities Catalog
8. GitHub Advisory - CVE-2025-60724