Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5075906

KB5075906: Cumulative update for Windows Server, version 2022, February 2026. Exploited Shell and MSHTML bypasses patched; folder names fixed

In short

Fixes 27 security vulnerabilities, including five that are being exploited, and addresses several Windows Server issues. It also adds optional DNS response record shuffling.

Does it affect you? Applies to: Devices running Windows Server 2022. The update package is for x64 systems.

Build
20348.4773
Security
27 fixed · 5 exploited
Restart
Required

What changes

Fixes 3 changes

File Explorer

  • Addresses a folder-renaming issue that can prevent custom folder names from appearing.1
    The LocalizedResourceName setting in desktop.ini files is ignored when renaming folders.

Graphics

  • Addresses a system error that might occur with certain GPU configurations.2
    The error is related to dxgmms2.sys and can result in KERNEL_SECURITY_CHECK_FAILURE.

OS Security

For: some PCs running Virtual Secure Mode

  • Fixes an issue that could make some PCs restart instead of shutting down or entering hibernation.3
    The issue affects some PCs running Virtual Secure Mode (VSM) after installing a Windows security update released on or after January 13, 2026.

Improvements 2 changes

Fonts & Display

  • Chinese fonts are updated to support the GB18030-2022A character coverage and display standard.4

Servicing stack

  • Includes quality improvements to the component that installs Windows updates.5
    The combined package includes servicing stack update KB5075905, build 20348.4763.

New feature 1 change

Networking

Verified in package
  • DNS Server can now shuffle the order of resource records in its responses, helping reduce the chance that one record becomes overloaded.6
    To enable, create the RandomShuffle DWORD value at Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters and set its data to 1. Set it to 0 to disable or erase the key.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    After installing KB5070884 or later, Windows Server Update Services (WSUS) does not display synchronization error details. The reporting functionality is temporarily removed to address CVE-2025-59287.7

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-02-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5078136, KB5077800, KB5073457, KB5071547
+31 earlier KB5068787, KB5070884, KB5066782, KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5082314
VersionBuildChannel
2022 20348.4773 General availability

Security

27 vulnerabilities fixed
5 exploited 26 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2026-21510 Exploited
Windows Shell Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-21513 Exploited
MSHTML Framework Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-21519 Exploited
Desktop Window Manager Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21533 Exploited
Windows Remote Desktop Services Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21525 Exploited
Windows Remote Access Connection Manager Denial of Service Vulnerability
 Moderate 6.2
CVE-2026-21255
Windows Hyper-V Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-21231
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21236
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21238
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21239
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21240
Windows HTTP.sys Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21246
Windows Graphics Component Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21251
Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-20846
GDI+ Denial of Service Vulnerability
 Important 7.5
CVE-2026-21243
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
 Important 7.5
CVE-2026-21235
Windows Graphics Component Elevation of Privilege Vulnerability
 Important 7.3
CVE-2026-21244
Windows Hyper-V Remote Code Execution Vulnerability
 Important 7.3
CVE-2026-21247
Windows Hyper-V Remote Code Execution Vulnerability
 Important 7.3
CVE-2026-21248
Windows Hyper-V Remote Code Execution Vulnerability
 Important 7.3
CVE-2026-21234
Windows Connected Devices Platform Service Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21237
Windows Subsystem for Linux Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21241
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21242
Windows Subsystem for Linux Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21253
Mailslot File System Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21508
Windows Storage Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21222
Windows Kernel Information Disclosure Vulnerability
 Important 5.5
CVE-2026-21249
Windows NTLM Spoofing Vulnerability
 Important 3.3

Downloads (Microsoft Update Catalog)

x64 2022
412.4 MB
windows10.0-kb5075906-x64.msu Main update · KB5075906 SHA-1: 96e7590a…f54654

Updated components

564 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display10
Networking9
Hyper-V and virtualization7
Storage and file systems7
Secure Boot6
Remote Desktop5
Search5
Kernel4
Bluetooth3
File Explorer and shell3
Security and sign-in3
Audio1

Verified in package: changed files confirm Networking.

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. [File Explorer] Fixed: This update addresses an issue where folder renaming with desktop.ini files in File Explorer isn't work correctly. The LocalizedResourceName setting is ignored, so custom folder names don't appear. support.microsoft.com
  2. 2. [Graphics] Fixed: This update addresses an issue where certain GPU configurations might recently have experienced a system error related to dxgmms2.sys, resulting in the KERNEL_SECURITY_CHECK_FAILURE error. support.microsoft.com
  3. 3. [OS Security (known issue)] Fixed: After installing the Windows security update released on or after January 13, 2026, some PCs which run Virtual Secure Mode (VSM) are unable to shut down or enter hibernation. Instead, the device restarts. support.microsoft.com
  4. 4. [Fonts & Display] Updates the Chinese fonts to support the GB18030‑2022A standard for character coverage and display. support.microsoft.com
  5. 5. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  6. 6. [Networking] New! Windows Server now supports random shuffling of resource records in DNS Server responses. This helps reduce scenarios where a single resource record becomes overloaded because it appears first in the returned list. support.microsoft.com
  7. 7. After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake