KB5073722: Windows 10 Version 1607 / Windows Server 2016 Secur

Tenable plugin 283466 is not one bug; it is a missing cumulative update for Windows 10 Version 1607 and Windows Server 2016. Systems below OS build 10.0.14393.8783 are missing KB5073722 and remain exposed to a bundle of issues, including a KEV-listed local DWM information disclosure (CVE-2026-20805), a remote RRAS RCE (CVE-2026-20868), multiple EoP bugs, and two older modem-driver issues that are useful for BYOVD-style privilege escalation.

The scary part is the bundle, not the vendor labels in isolation. Tenable's plugin is High, and that is closer to reality than a blanket Critical call: the most important in-the-wild issue in this set requires local authenticated access, while the most severe network bug requires RRAS exposure plus user interaction. That is dangerous across a large Windows fleet, but it is not the same as a wormable internet-entry bug on every Server 2016 host.

Why this verdict

• Start from Tenable High: the plugin already lands at High, not Critical, and that baseline is sensible for a monthly Windows rollup on a widely deployed legacy platform.
• Downward adjustment: the live KEV bug is post-initial-access. CVE-2026-20805 needs local low privileges. That implies the attacker already beat your email gateway, VPN, RMM hygiene, or endpoint controls before this CVE matters.
• Downward adjustment: the network RCE is narrower than it looks. CVE-2026-20868 is RRAS-specific and carries UI:R. Real fleets have far fewer exposed RRAS servers than total Server 2016 hosts, and user interaction cuts wormability sharply.
• Upward adjustment: chain value is real. Public exploit material for included driver bugs and a KEV-listed DWM primitive make this rollup useful for turning a basic foothold into SYSTEM.
• Upward adjustment: blast radius across a 10k-host fleet is large. Even if each single CVE has friction, legacy Windows estate tends to be broad, privileged, and operationally sticky.

Why not higher?

I am not calling this CRITICAL because the cleanest evidence of exploitation in this package is not an unauthenticated remote code execution path. The remote RRAS issue is serious, but the combination of specific role exposure and user interaction keeps it out of the same class as an internet-wide zero-click service bug.

Why not lower?

I am not dropping this to MEDIUM because active exploitation is already on record via KEV, and the update contains multiple privilege-escalation routes that materially improve attacker outcomes after foothold. In a large enterprise, post-compromise privilege escalation on a common Windows platform is still an operations problem, not mere backlog hygiene.

1. Prioritize exposed RRAS servers first — Identify Server 2016 hosts running the RRAS role and any system reachable from untrusted networks, then isolate, restrict, or patch them immediately, within hours because this rollup contains active exploitation evidence and a remote RRAS path.
2. Block known vulnerable drivers — Enforce the Microsoft vulnerable driver blocklist, WDAC, and HVCI/Memory Integrity where supported to blunt BYOVD-style abuse from included driver issues; deploy or verify these controls immediately, within hours on high-value admin and server tiers.
3. Constrain low-privilege execution — Reduce local attacker maneuver room with application control, restricted admin rights, and tighter interactive logon policy, especially on jump hosts and terminal servers; apply these guardrails immediately, within hours while patch rollout catches up.
4. Hunt for exploit-chain behavior — Tune EDR detections for dwm.exe abuse, unusual ALPC/handle enumeration, signed vulnerable driver loads, service creation, LSASS access, and security-tool tampering; activate those detections immediately, within hours because prevention is imperfect.
5. Remove unused RRAS roles — If RRAS/VPN routing is not business-critical, disable the role or block inbound reachability to shrink the only meaningful remote path in this bundle; complete this reduction immediately, within hours on internet-facing systems.

Run this on the target Windows 10 1607 / Server 2016 host from an elevated or standard PowerShell session; admin is not required for the registry reads it uses. Invoke it as powershell -ExecutionPolicy Bypass -File .\check-kb5073722.ps1. It outputs VULNERABLE, PATCHED, or UNKNOWN and uses exit codes 1, 0, and 2 respectively.

# check-kb5073722.ps1

# Verifies whether a host is patched for KB5073722 or any later cumulative update

# targeting Windows 10 Version 1607 / Windows Server 2016 (build 14393.8783+)

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Exit-WithResult {
    param(
        [string]$Status,
        [string]$Message,
        [int]$Code
    )
    Write-Output "$Status - $Message"
    exit $Code
}

try {
    $cvKey = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $cv = Get-ItemProperty -Path $cvKey

    $productName = [string]$cv.ProductName
    $currentBuild = [int]$cv.CurrentBuildNumber
    $ubr = if ($null -ne $cv.UBR) { [int]$cv.UBR } else { $null }

    if ($currentBuild -ne 14393) {
        Exit-WithResult -Status 'UNKNOWN' -Message "Host build is $currentBuild ($productName); plugin 283466 applies to build 14393 platforms only." -Code 2
    }

    if ($null -eq $ubr) {
        Exit-WithResult -Status 'UNKNOWN' -Message "Unable to read UBR for build 14393 ($productName)." -Code 2
    }

    $fullVersion = "10.0.$currentBuild.$ubr"

    # KB5073722 brings Windows 10 1607 / Server 2016 to 10.0.14393.8783.

    # Any later cumulative update on the same branch is also sufficient.

    if ($ubr -ge 8783) {
        Exit-WithResult -Status 'PATCHED' -Message "$productName is at $fullVersion (>= 10.0.14393.8783). KB5073722 or a later cumulative update is installed." -Code 0
    }
    else {
        Exit-WithResult -Status 'VULNERABLE' -Message "$productName is at $fullVersion (< 10.0.14393.8783). KB5073722 or later cumulative update is missing." -Code 1
    }
}
catch {
    Exit-WithResult -Status 'UNKNOWN' -Message $_.Exception.Message -Code 2
}

Sources

1. Tenable Nessus Plugin 283466
2. Microsoft KB5073722 support article
3. NVD CVE-2026-20805
4. NVD CVE-2026-20868
5. CVE.org record for CVE-2026-20805
6. CISA Known Exploited Vulnerabilities Catalog
7. Rapid7 Patch Tuesday January 2026 analysis
8. Tenable CVE page for CVE-2026-20805