Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday Zero-day

KB5075899

KB5075899: Cumulative update for Windows Server, version 2025, February 2026. Exploited Shell and MSHTML bypasses patched

In short

Fixes security flaws already being exploited, including Windows Shell and MSHTML security-feature bypasses. It also adds DNS features, while WSUS still does not show synchronization error details.

Does it affect you? Applies to: Devices running Windows Server 2025, including x64 systems. The update produces OS build 26100.32370.

Build
26100.32370
Security
29 fixed · 5 exploited
Restart
Required

What changes

Fixes 3 changes

File Explorer

For: Windows Server users

  • The update addresses a problem with renaming folders that contain desktop.ini files, where custom folder names might not appear.1
    The LocalizedResourceName setting is ignored during folder renaming.

Graphics

  • The update addresses a system error that some GPU configurations might experience.2
    The error is related to dxgmms2.sys and results in KERNEL_SECURITY_CHECK_FAILURE.

Performance & Reliability

For: Windows Server administrators

  • Forwarded I/O is disabled by default in the NVMe stack.3

Improvements 2 changes

Fonts & Display

For: Users of Chinese fonts

  • Chinese fonts support the GB18030-2022A standard for character coverage and display.4

Servicing stack

For: Windows Server administrators

  • The update improves the component that installs Windows updates, helping devices receive and install Microsoft updates.5
    The package includes servicing stack update KB5075898, version 26100.32370.

New features 2 changes

Networking

Verified in package 2 items

For: Windows DNS Server administrators

  • Windows DNS Server adds DNS over HTTPS support in public preview for evaluating traffic between the server and its clients. The preview is for feedback only, is not supported for production use, might contain issues, and could change before general availability.6
    DoH support is available in public preview.
  • DNS Server can randomly shuffle resource records in responses, helping reduce the chance that the first-listed record becomes overloaded.7
    To enable, create the DWORD value RandomShuffle at Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters and set it to 1. Set it to 0 to disable the feature.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    After KB5070881 or later updates, WSUS does not display synchronization error details in its error reporting. This issue predates this update; the functionality was temporarily removed to address CVE-2025-59287.8

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-02-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5078135, KB5077793, KB5073379, KB5072033
+20 earlier KB5072359, KB5068861, KB5070881, KB5070773, KB5066835, KB5068221, KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5044284, KB5043080
Replaced by
KB5078740
VersionBuildChannel
2025 26100.32370 General availability

Security

29 vulnerabilities fixed
5 exploited 28 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2026-21510 Exploited
Windows Shell Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-21513 Exploited
MSHTML Framework Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-21519 Exploited
Desktop Window Manager Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21533 Exploited
Windows Remote Desktop Services Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21525 Exploited
Windows Remote Access Connection Manager Denial of Service Vulnerability
 Moderate 6.2
CVE-2026-21255
Windows Hyper-V Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-21231
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21232
Windows HTTP.sys Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21236
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21238
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21239
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21240
Windows HTTP.sys Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21245
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21246
Windows Graphics Component Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21250
Windows HTTP.sys Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21251
Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-20846
GDI+ Denial of Service Vulnerability
 Important 7.5
CVE-2026-21243
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
 Important 7.5
CVE-2026-21244
Windows Hyper-V Remote Code Execution Vulnerability
 Important 7.3
CVE-2026-21247
Windows Hyper-V Remote Code Execution Vulnerability
 Important 7.3
CVE-2026-21248
Windows Hyper-V Remote Code Execution Vulnerability
 Important 7.3
CVE-2026-21234
Windows Connected Devices Platform Service Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21237
Windows Subsystem for Linux Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21241
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21242
Windows Subsystem for Linux Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21253
Mailslot File System Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21508
Windows Storage Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21222
Windows Kernel Information Disclosure Vulnerability
 Important 5.5
CVE-2026-21249
Windows NTLM Spoofing Vulnerability
 Important 3.3

Updated components

1,920 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display12
Networking11
Audio9
Hyper-V and virtualization9
Storage and file systems6
File Explorer and shell4
Secure Boot4
Security and sign-in4
Kernel3
Remote Desktop3
Settings3
Bluetooth1

Verified in package: changed files confirm Networking.

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. [File Explorer] Fixed: This update addresses an issue where folder renaming with desktop.ini files in File Explorer isn't work correctly. The LocalizedResourceName setting is ignored, so custom folder names don't appear. support.microsoft.com
  2. 2. [Graphics] Fixed: This update addresses an issue where certain GPU configurations might recently have experienced a system error related to dxgmms2.sys, resulting in the KERNEL_SECURITY_CHECK_FAILURE error. support.microsoft.com
  3. 3. [Performance & Reliability] Fixed: This update disables the forwarded I/O feature in the NVMe stack by default. support.microsoft.com
  4. 4. [Fonts & Display] Updates the Chinese fonts to support the GB18030‑2022A standard for character coverage and display. support.microsoft.com
  5. 5. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  6. 6. New! DNS over HTTPS (DoH) support for Windows DNS Server is now available in public preview. This preview enables evaluation of DoH for traffic between the server and its clients. This is intended for feedback only. support.microsoft.com
  7. 7. New! Windows Server now supports random shuffling of resource records in DNS Server responses. This helps reduce scenarios where a single resource record becomes overloaded because it appears first in the returned list. support.microsoft.com
  8. 8. After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake