Does installing Windows build 10.0.17763 automatically include all vulnerabilities patched in build 10.0.17762?

Question

Does installing Windows build 10.0.17763 automatically include all vulnerabilities patched in build 10.0.17762?

Julian Komarek 0

I dont know where to post this question

Hello everyone,

I am currently doing some "vulnerability management" work and I'm having a hard time wrapping my head around how Windows OS versions and update rollups work. To be honest, I can be a bit dense when it comes to this specific topic, so I'm looking for a very simple, "Explain Like I'm 5" answer.

I need to prove something to a colleague so I can safely check off some boxes and continue my vulnerability management work.

Here is my exact scenario: If I install Windows version 10.0.17763, does it definitely and architecturally contain all the underlying KB patches and security fixes that were present in the older 10.0.17762 version?

(Note: Just to keep it simple, we are ignoring any brand-new KB patches that come out for 17763. I just want to know if the core baseline of 17763 fully absorbs all the fixes from 17762).

If this is true, how do I easily prove to my colleague and our security scanners that the old vulnerabilities are mitigated? Since the old KB numbers from 17762 don't show up anymore when we check the new system, what is the best way to prove we are compliant?

0 comments

2 answers

Your answer

Answer 1

Hi Julian Komarek,

Yes, your understanding is correct. Windows quality and security updates are generally cumulative, which means a newer build in the same servicing branch includes the fixes and security mitigations that were delivered in previous builds, along with any newer improvements. As a result, a system running build 10.0.17763 would be expected to contain the security fixes that were already included in 10.0.17762, unless Microsoft documents a specific exception.

For vulnerability management purposes, it is often more useful to verify the installed OS build number and the current cumulative update (KB) rather than looking for every older KB individually. Since Windows updates are cumulative, older KBs may no longer appear as separate installed updates even though their fixes are included in the newer build.

A simple way to think about it is that each cumulative update builds upon the previous one. Installing a newer build does not remove earlier security fixes - it carries them forward and adds new fixes on top.

I hope this helps clarify how Windows servicing and cumulative updates work. Thanks for your effort.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Ian-T 7,790 Reputation points Microsoft External Staff Moderator

2026-06-22T08:46:54.22+00:00

Hi

I’m following up to check on the status of this issue.

Have you had an opportunity to review the answer shared earlier?

Any update you can provide would be greatly appreciated.

Answer 2

Bulldog 2,745

Windows updates are cumulative, so they include everything applicable to your computer that it doesn't already have. This is by design, since the idea behind Windows Update is that machines should be completely up to date at all times.

0 comments