Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday Zero-day

KB5073724

KB5073724: Cumulative update for Windows 10, versions 21H2 and 22H2, January 2026. Exploited Desktop Window Manager flaw patched; modem drivers removed

In short

The update fixes 73 security vulnerabilities, including an actively exploited Desktop Window Manager flaw, and removes several modem drivers. Some Windows 10 devices might also have trouble saving files to cloud storage.

Does it affect you? Applies to: Devices running Windows 10, version 22H2, and Windows 10 Enterprise LTSC 2021, version 21H2.

Builds
19044.6809 · 19045.6809
Security
73 fixed · 1 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • In detail Windows 10 Enterprise LTSC 2021, version 21H2, reaches its end of updates on January 12, 2027.

The official sources are linked at the end of the page.

What changes

Improvements 3 changes

Credentials autofill

Verified in package
  • In certain remote support and automated sign-in workflows, credential dialogs ignore virtual keyboard input from remote desktop or screen-sharing tools.1
    A security hardening behavior restricts certain applications from autofilling credentials during remote support sessions or automated authentication workflows.

Secure Boot

Gradual rollout Verified in package

For: Devices eligible for new Secure Boot certificates

  • Eligible devices receive new Secure Boot certificates in phases, after showing enough successful update signals.2
    Windows quality updates include high-confidence device-targeting data to identify devices eligible for automatic Secure Boot certificate updates.

Servicing stack

For: Azure-hosted devices

  • Update installation improves verification for devices hosted on Azure.3
    The servicing stack update uses an updated certificate chain to verify whether a device is hosted on Azure.

Fix 1 change

WinSqlite3.dll

For: Users whose security software detected WinSqlite3.dll

  • WinSqlite3.dll is updated to address cases where security software might detect it as vulnerable.4
    This change applies to the Windows component WinSqlite3.dll, not application-specific copies of sqlite3.dll.

Removal 1 change

Drivers

For: Devices using these modem drivers

  • Modems that rely on the removed drivers will no longer work in Windows.5
    Removes agrsm64.sys and smserl64.sys (x64), and agrsm.sys and smserial.sys (x86).

Known issues

  1. Resolved Affects: Everyone Resolved by KB5075912

    Some devices with Virtual Secure Mode enabled might fail to shut down or hibernate

    Some Secure Launch-capable PCs with Virtual Secure Mode enabled might restart instead of shutting down or entering hibernation. KB5075912 addresses this issue.6

    Resolution Fixed in KB5075912

    Install KB5075912 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Open Affects: Everyone

    Apps might become unresponsive when saving files to cloud-based storage

    Some apps might become unresponsive or encounter errors when opening or saving files in cloud-based locations. In some Outlook configurations with PST files on OneDrive, Outlook might hang, fail to reopen, or show missing sent items or previously downloaded emails being downloaded again. The issue remains open.7

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Resolved Affects: Organizations and IT administrators Resolved by KB5077796

    Connection and authentication failures in Azure Virtual Desktop and Windows 365

    Credential prompts might fail during Remote Desktop connections using the Windows App on specific Windows builds, affecting Azure Virtual Desktop and Windows 365. This issue is resolved by updates released on or after January 17, 2026, such as KB5077796.8

    Resolution Fixed in KB5077796

    Install KB5077796 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-01-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5074976, KB5071546, KB5068781, KB5066791
+28 earlier KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by
KB5077796
VersionBuildChannel
21H2 19044.6809 General availability
22H2 19045.6809 General availability

Security

73 vulnerabilities fixed
1 exploited 1 critical 71 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-20805 Exploited
Desktop Window Manager Information Disclosure Vulnerability
 Important 5.5
CVE-2026-20822
Windows Graphics Component Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2023-31096
MITRE: CVE-2023-31096 Windows Agere Soft Modem Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21265
Secure Boot Certificate Expiration Security Feature Bypass Vulnerability
 Important 6.4

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 73 vulnerabilities →

Updated components

1,539 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display49
Security and sign-in28
Kernel18
File Explorer and shell17
Networking16
Search15
Secure Boot13
Hyper-V and virtualization12
Printing7
Remote Desktop3
Storage and file systems3
Windows Update3

Verified in package: changed files confirm Credentials autofill, Secure Boot.

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. With this change, credential dialogs do not respond to virtual keyboard input from remote desktop or screen sharing tools or apps. support.microsoft.com
  2. 2. Devices will receive the new certificates only after demonstrating sufficient successful update signals, ensuring a safe and phased deployment. support.microsoft.com
  3. 3. This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. support.microsoft.com
  4. 4. Fixed: The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. support.microsoft.com
  5. 5. Modem hardware dependent on these specific drivers will no longer work in Windows. support.microsoft.com
  6. 6. This issue is addressed in KB5075912. support.microsoft.com
  7. 7. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. support.microsoft.com
  8. 8. This issue is resolved in Windows updates released on and after January 17, 2026 (such as KB5077796). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake