KB5034441: Windows Server 2022 Cumulative Update (January 2024)
The January 2024 cumulative update for Windows Server 2022 patches CVE-2024-20666, a BitLocker security feature bypass that allows an attacker with physical access to read encrypted drive contents. Critical for servers with sensitive data using BitLocker encryption.
An attacker with physical access to a server room — or a malicious insider — can use this vulnerability to extract BitLocker-protected data without knowing the encryption key. For servers storing sensitive data (databases, file servers, backup servers), this represents a significant data breach risk if physical security is imperfect.
CVE-2024-20666 allows an attacker with physical access to a BitLocker-encrypted server to bypass the encryption protection and read the protected data. The flaw exists in the Windows Recovery Environment (WinRE) boot process. January 2024's update patches both the main OS and WinRE to close this attack path.
Probably yes if any of these apply:
Affected OS versions
A datacenter physical security incident at a co-location facility allows an unknown party access to a server cabinet. The servers use BitLocker for data protection, but CVE-2024-20666 allows the attacker to mount the encrypted volume using the WinRE bypass. Without January 2024's patch, BitLocker does not provide the intended protection against this access scenario.
Manual download
For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.
↗ Microsoft Update CatalogKB5034441Manual remediation steps
⏱ 45–90 minutes including reboot and WinRE updateCheck if KB5034441 is Installed
Get-HotFix -Id KB5034441
Check BitLocker Status
# Confirm BitLocker is active on all drives
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus, EncryptionMethod
Apply the Patch
# Note: This update also patches WinRE — additional steps required
# Step 1: Apply KB5034441 via Windows Update or catalog
# Download from https://catalog.update.microsoft.com/search.aspx?q=KB5034441
# Step 2: Update WinRE partition (run after reboot)
ReAgentc /info
# If WinRE is enabled, Microsoft's KB5028997 guidance includes WinRE update script
Verify
Get-HotFix -Id KB5034441
ReAgentc /info # Confirm WinRE version is updated
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
| Patch ID | CVE ID | Vulnerability Name / Type | CVSS | Reference |
|---|---|---|---|---|
| KB5034441 | CVE-2024-20666 | Windows BitLocker Encryption — Windows Server 2022 | 6.8 | NVD ↗ |