KB5123099 Fails With Error 0x8007000D on Windows Server 2016 Essentials

Because the MSU cannot be extracted and its digital signature reports HashMismatch on multiple machines, this points strongly to a damaged or incorrectly published package rather than a problem with Windows Update or the server's component store. A valid MSU should pass signature verification and extract successfully. Re-download it from the official catalog using a different network or source, compare the file hash if Microsoft provides one, and avoid installing the current copy. If the same result occurs everywhere, the package itself likely needs to be republished.

The longer-term concern is the year of unreliable patching. Even if this KB is faulty, make sure there is a migration or replacement plan for the Essentials server before its support deadline. It is probably not worth spending weeks repairing one update path if the system is already scheduled to be retired.

0x8007000D can also come from component-store corruption, so on the affected server it is still worth confirming that the latest SSU is installed and running DISM /Online /Cleanup-Image /RestoreHealth followed by sfc /scannow. Checking CBS.log and DISM.log may reveal missing manifests or catalog files. However, those checks are secondary here because the same MSU fails signature validation and extraction on clean, unrelated systems.