KB5075912: Cumulative update for Windows 10, versions 21H2 and 22H2, February 2026. Exploited Shell and MSHTML flaws patched

Fixes 24 security vulnerabilities, including five that attackers are exploiting, and resolves a restart-on-shutdown issue affecting some Secure Launch PCs with Virtual Secure Mode enabled.

Does it affect you? Applies to: Windows 10 version 22H2 devices enrolled in the Extended Security Updates (ESU) program, and Windows 10 Enterprise LTSC 2021 version 21H2 devices. The resulting OS builds are 19045.6937 and 19044.6937, respectively.

What changes

Fixes 3 changes

OS Security

For: some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled

Some Secure Launch-capable PCs with Virtual Secure Mode enabled can shut down or hibernate instead of restarting.¹
Resolves the issue seen after Windows security updates released on or after January 13, 2026.

Folders

Custom folder names appear as expected in File Explorer when desktop.ini files specify them.²
The LocalizedResourceName setting was ignored when renaming folders.

Graphics

For: devices with certain GPU configurations

Addresses a stability issue affecting certain graphics processing unit configurations.³

Improvements 3 changes

Fonts

Chinese fonts are updated to meet GB18030-2022A compliance.⁴

Secure Boot

Gradual rollout Verified in package

For: devices eligible for new Secure Boot certificates

Devices receive new Secure Boot certificates only after showing sufficient successful update signals, supporting a phased rollout.⁵
Windows quality updates include targeting data to identify devices and their ability to receive new Secure Boot certificates.

Servicing stack

For: Azure-hosted devices

The update process better checks whether a device is hosted on Azure.⁶
SSU KB5077456 uses an updated certificate chain to validate whether a device is Azure-hosted. Azure-hosted devices need access to the required certificate update domains to download and install certificate updates.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-02-10
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5078129, KB5077796, KB5073724, KB5074976

+31 earlier
KB5071546, KB5068781, KB5066791, KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by: KB5078885

Version	Build	Channel
21H2	19044.6937	General availability
22H2	19045.6937	General availability

Security

24 vulnerabilities fixed

5 exploited 23 important 1 moderate

Vulnerability	Severity	CVSS
CVE-2026-21510 Exploited Windows Shell Security Feature Bypass Vulnerability	Important	8.8
CVE-2026-21513 Exploited MSHTML Framework Security Feature Bypass Vulnerability	Important	8.8
CVE-2026-21519 Exploited Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-21533 Exploited Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-21525 Exploited Windows Remote Access Connection Manager Denial of Service Vulnerability	Moderate	6.2
CVE-2026-21255 Windows Hyper-V Security Feature Bypass Vulnerability	Important	8.8
CVE-2026-21231 Windows Kernel Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-21236 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-21238 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-21239 Windows Kernel Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-21240 Windows HTTP.sys Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-21246 Windows Graphics Component Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-20846 GDI+ Denial of Service Vulnerability	Important	7.5
CVE-2026-21235 Windows Graphics Component Elevation of Privilege Vulnerability	Important	7.3
CVE-2026-21244 Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3
CVE-2026-21247 Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3
CVE-2026-21248 Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3
CVE-2026-21234 Windows Connected Devices Platform Service Elevation of Privilege Vulnerability	Important	7.0
CVE-2026-21237 Windows Subsystem for Linux Elevation of Privilege Vulnerability	Important	7.0
CVE-2026-21242 Windows Subsystem for Linux Elevation of Privilege Vulnerability	Important	7.0
CVE-2026-21253 Mailslot File System Elevation of Privilege Vulnerability	Important	7.0
CVE-2026-21508 Windows Storage Elevation of Privilege Vulnerability	Important	7.0
CVE-2026-21222 Windows Kernel Information Disclosure Vulnerability	Important	5.5
CVE-2026-21249 Windows NTLM Spoofing Vulnerability	Important	3.3

Downloads (Microsoft Update Catalog)

x64 21H2 / 22H2

839.0 MB

windows10.0-kb5075912-x64.msu Main update · KB5075912 SHA-1: 861d0870…039d7d

Arm64 21H2 / 22H2

765.3 MB

windows10.0-kb5075912-arm64.msu Main update · KB5075912 SHA-1: b0d7e8b3…58dfc6

x86 21H2 / 22H2

533.3 MB

windows10.0-kb5075912-x86.msu Main update · KB5075912 SHA-1: fcf0a16e…08de6f

Updated components

1,096 files changed since the previous update for the same versions.

Top changed components	Files
Graphics and display	36
Networking	27
Remote Desktop	20
Search	15
Hyper-V and virtualization	13
File Explorer and shell	12
Security and sign-in	12
Storage and file systems	11
Emoji and input	7
Secure Boot	7
Audio	6
Bluetooth	6

Verified in package: changed files confirm Secure Boot.

Sources

Microsoft Support: KB5075912

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (6)

1. some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts. support.microsoft.com
2. The LocalizedResourceName setting was ignored, so custom folder names did not show. Now, custom folder names appear as expected. support.microsoft.com
3. A stability issue affecting certain graphics processing units (GPUs) configurations. support.microsoft.com
4. This update includes changes to Chinese fonts to meet GB18030-2022A compliance. support.microsoft.com
5. Devices will receive the new certificates only after they show sufficient successful update signals, which helps ensures a safe and phased rollout. support.microsoft.com
6. This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 25, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake