Skip to the content
The Update Bureau
Windows 10 1607 Windows 10 1607 Security update
Patch Tuesday Zero-day

KB5073722

KB5073722: Cumulative update for Windows 10, version 1607, January 2026. Exploited Desktop Window Manager flaw patched; modem drivers removed

In short

The update fixes 51 vulnerabilities, including an exploited Desktop Window Manager information-disclosure flaw, and removes four modem drivers, disabling hardware that depends on them.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSB 2016, version 1607, on x86 or x64.

Build
14393.8783
Security
51 fixed · 1 critical · 1 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fix 1 change

WinSqlite3.dll

For: Devices whose security software flagged WinSqlite3.dll

  • The Windows component WinSqlite3.dll is updated because some security software might have detected it as vulnerable.1
    This does not update sqlite3.dll in application-specific directories. If security software continues to flag that file, contact the app developer; for a Microsoft Store app, install its latest version from the Store.

New feature 1 change

Credentials autofill

Verified in package

For: People using remote support or automated authentication

  • Credential dialogs do not accept virtual keyboard input from remote desktop or screen-sharing tools or apps.2
    The security hardening restricts certain applications from autofilling credentials during remote support sessions or automated authentication workflows.

Removal 1 change

Drivers

For: Devices using these modem drivers

  • Modem hardware that relies on the removed drivers will no longer work in Windows.3
    Removes agrsm64.sys and smserl64.sys (x64), and agrsm.sys and smserial.sys (x86).

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-01-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5074974, KB5071543, KB5068864, KB5066836
+13 earlier KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5075999
VersionBuildChannel
1607 14393.8783 General availability

Security

51 vulnerabilities fixed
1 exploited 1 critical 49 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-20805 Exploited
Desktop Window Manager Information Disclosure Vulnerability
 Important 5.5
CVE-2026-20822
Windows Graphics Component Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2023-31096
MITRE: CVE-2023-31096 Windows Agere Soft Modem Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21265
Secure Boot Certificate Expiration Security Feature Bypass Vulnerability
 Important 6.4

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 51 vulnerabilities →

Updated components

613 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display22
Security and sign-in17
Kernel11
Search8
Secure Boot8
File Explorer and shell6
Hyper-V and virtualization6
Networking6
Settings4
Remote Desktop2
Storage and file systems2

Verified in package: changed files confirm Credentials autofill.

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. Fixed: The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. support.microsoft.com
  2. 2. With this change, credential dialogs do not respond to virtual keyboard input from remote desktop or screen sharing tools or apps. support.microsoft.com
  3. 3. This update removes the following modem drivers: agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64) and smserial.sys (x86). Modem hardware dependent on these specific drivers will no longer work in Windows. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake