IRONSMITHINTEL
CRITICALCVSS9.8
|CVE-2024-38140|Auth: none|Reboot: required|Manual only

KB5041773: Windows Server 2016 Security Update (August 2024)

An attacker on your network can take SYSTEM-level control of a Windows Server without credentials by sending a single multicast packet, if PGM messaging is in use.

Published Aug 13, 2024 · Updated May 21, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

An attacker on the same network as a server with MSMQ's PGM transport in use — with no credentials and no user interaction — can send a crafted multicast packet and execute code in kernel context. From kernel context the attacker is effectively the operating system: install ransomware, disable defensive tooling, create hidden accounts, pivot anywhere the host can reach.

How the attack works

The Windows Reliable Multicast Transport Driver (RMCAST, rmcast.sys) is a kernel-mode component that implements the Pragmatic General Multicast (PGM) protocol — used by Microsoft Message Queuing (MSMQ) for reliable multicast delivery. A use-after-free bug in how RMCAST handles incoming packets lets a network attacker corrupt kernel memory and execute code. RMCAST is only listening when an application has opened a PGM socket; PGM support ships with MSMQ.

Am I affected?Quick check

Probably yes if any of these apply:

●Servers with MSMQ installed AND an application using PGM multicast
●Application servers in trading, broadcast, or multicast-messaging workflows

Affected OS versions

Windows Server 2016
Real-world incidentsWhat we've seen

A ransomware operator finds a Windows file server inside a corporate network that has MSMQ installed for a legacy line-of-business app. One unauthenticated multicast packet triggers the kernel use-after-free and the attacker is in kernel mode on the server. The narrow installation footprint of PGM means most administrators dismiss this CVE — which is precisely what makes it valuable to the attacker who scans for it.

How to patch

Manual download

For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.

↗ Microsoft Update CatalogKB5041773

Manual remediation steps

Decide if you need to patch

PGM is not on by default on a stock Windows Server. You are exposed if MSMQ is installed and an application has opened a PGM socket. Run:

Get-WindowsFeature -Name MSMQ* | Where-Object Installed
Get-NetUDPEndpoint -LocalPort 3056 -ErrorAction SilentlyContinue

If both come back empty you are not exposed today, but install the cumulative update on your standard patch schedule.

Prerequisites

    1
    Local administrator on the target server
    1
    Maintenance window with reboot capacity
    1
    Current backup or snapshot you can roll back to
    1
    Network path to Windows Update / WSUS / Microsoft Update Catalog

Estimated time

20–40 minutes per server (download + install + reboot)

Reboot required

Yes — install the cumulative update and reboot the server before the fix is active.

Steps

1. Confirm the server is missing the patch

Get-HotFix -Id KB5041773 -ErrorAction SilentlyContinue

2. Install the update — pick one channel

Windows Update / WSUS (preferred):

UsoClient ScanInstallWait
# (or use your standard WSUS / SCCM / Intune deployment for KB5041773)

Manual download (offline / air-gapped):

1
Open Microsoft Update Catalog: https://catalog.update.microsoft.com/Search.aspx?q=KB5041773
2
Download the MSU for Windows Server 2016 that matches your architecture (x64).
3
Copy the .msu file to the server and run as Administrator.

3. Reboot

Restart-Computer -Force

Verification

Get-HotFix -Id KB5041773
[System.Environment]::OSVersion.Version

If Get-HotFix returns nothing for KB5041773, the install did not take — re-run from a different channel.

Rollback

wusa.exe /uninstall /kb:5041773 /quiet /norestart
# Reboot after uninstall

Removing a cumulative update also removes every fix it delivered — prefer rolling forward.

Notes

    1
    This entry covers Windows Server 2016 specifically (KB5041773). Other Windows Server versions have their own KB for CVE-2024-38140.
    1
    Reference advisories: MSRC https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38140 and NVD https://nvd.nist.gov/vuln/detail/CVE-2024-38140.
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2024-38140↗ MSRC Advisory↗ NVD↗ KBKB5041773