How to find the Windows KB update for a CVE and check it is installed

Microsoft ships security fixes as cumulative updates identified by a KB number, for example KB5044284. These steps connect a CVE to its KB and confirm you are patched.

1. Find the KB for a CVE

Open the CVE in the Microsoft Security Update Guide and choose your Windows version.
Note the KB article and the fixed build number. Our patch pages list both for the CVEs we track.

2. Check what you have

# build number [System.Environment]::OSVersion.Version # is a specific update installed? Get-HotFix -Id KB5044284 # the ten most recent updates Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

If your build number is equal to or higher than the fixed build, the CVE is fixed even if you cannot see that exact KB, because cumulative updates include earlier fixes.

3. Install the update

Settings, Windows Update, Check for updates.
For servers, use WSUS, Intune or Windows Update for Business so you can stage and test.
Reboot when asked, then repeat the check.

Common problems

Update not offered: a prerequisite servicing stack update may be missing.
Update installed but still flagged: the system may need a reboot to finish.

FAQ

How do I check if a KB update is installed?

Run Get-HotFix -Id KB followed by the number in PowerShell. A returned row means it is installed. You can also compare your Windows build number with the fixed build.

Do I need the exact KB if I have a newer cumulative update?

No. Cumulative updates include the fixes from earlier ones, so a build at or above the fixed build number is patched.

← All guides