Skip to the content
The Update Bureau
Windows 11 26H1 Windows 11 26H1 Security update
Patch Tuesday Zero-day

KB5077179

KB5077179: Cumulative update for Windows 11, version 26H1, February 2026. Exploited Shell and MSHTML bypasses patched; startup failure fixed

In short

The update addresses five actively exploited vulnerabilities, including security-feature bypasses in Windows Shell and MSHTML. It also addresses a problem that could prevent Windows from starting.

Does it affect you? Applies to: Devices running Windows 11, version 26H1. The included AI component updates apply only to Copilot+ PCs.

Build
28000.1575
Security
26 fixed · 1 critical · 5 exploited
Restart
Required

What changes

Fixes 4 changes

Graphics

  • An issue that could cause a system error on certain GPU configurations is addressed.1
    The issue involves dxgmms2.sys and the KERNEL_SECURITY_CHECK_FAILURE error.

Networking

  • The issue that prevented some devices from connecting to certain WPA3-Personal Wi-Fi networks is addressed.2

OS Reliability

2 items
  • BitLocker HLK tests that were missing from the WHCP playlist now appear as expected.3
    Applies to BitLocker Hardware Lab Kit tests in the Windows Hardware Compatibility Program playlist.
  • An issue that could make TrustedInstaller stop responding and prevent Windows from starting is addressed.4

Improvements 2 changes

AI components

  • Four AI components receive updates on Copilot+ PCs.5
    Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2511.1224.0.

Servicing stack

  • The component that installs Windows updates receives quality improvements.6
    The combined package includes servicing stack update KB5077868, build 28000.1575.

Removal 1 change

.NET Framework 3.5

For: Devices running Windows 11, version 26H1

  • .NET Framework 3.5 is no longer available as a Feature on Demand optional component; install it using the standalone installer.7
    This change applies starting with Windows 11, version 26H1.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-02-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaced by
KB5079466
VersionBuildChannel
26H1 28000.1575 General availability
26H1 28000.1575 Release Preview Channel

Security

26 vulnerabilities fixed
5 exploited 1 critical 24 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2026-21510 Exploited
Windows Shell Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-21513 Exploited
MSHTML Framework Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-21519 Exploited
Desktop Window Manager Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21533 Exploited
Windows Remote Desktop Services Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21525 Exploited
Windows Remote Access Connection Manager Denial of Service Vulnerability
 Moderate 6.2
CVE-2025-2884
Cert CC: CVE-2025-2884 Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation
 Critical 5.3
CVE-2026-21255
Windows Hyper-V Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-21231
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21232
Windows HTTP.sys Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21236
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21238
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21240
Windows HTTP.sys Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21245
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21250
Windows HTTP.sys Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-20846
GDI+ Denial of Service Vulnerability
 Important 7.5
CVE-2026-21235
Windows Graphics Component Elevation of Privilege Vulnerability
 Important 7.3
CVE-2026-21244
Windows Hyper-V Remote Code Execution Vulnerability
 Important 7.3
CVE-2026-21247
Windows Hyper-V Remote Code Execution Vulnerability
 Important 7.3
CVE-2026-21248
Windows Hyper-V Remote Code Execution Vulnerability
 Important 7.3
CVE-2026-21234
Windows Connected Devices Platform Service Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21237
Windows Subsystem for Linux Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21241
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21242
Windows Subsystem for Linux Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21253
Mailslot File System Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21508
Windows Storage Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-21249
Windows NTLM Spoofing Vulnerability
 Important 3.3

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. [Graphics] Fixed: This update addresses an issue where certain GPU configurations might recently have experienced a system error related to dxgmms2.sys, resulting in the KERNEL_SECURITY_CHECK_FAILURE error. support.microsoft.com
  2. 2. [Networking] Fixed: This update addresses an issue that prevented some devices from connecting to certain WPA3‑Personal Wi‑Fi networks. support.microsoft.com
  3. 3. Fixed: This update addresses an issue where BitLocker Hardware Lab Kit (HLK) tests in the Windows Hardware Compatibility Program (WHCP) playlist were missing. The tests now appear as expected. support.microsoft.com
  4. 4. Fixed: This update addresses an issue that could cause TrustedInstaller to stop responding and prevent Windows from starting. support.microsoft.com
  5. 5. | Image Search | 1.2511.1224.0 | | Content Extraction | 1.2511.1224.0 | | Semantic Analysis | 1.2511.1224.0 | | Settings Model | 1.2511.1224.0 | support.microsoft.com
  6. 6. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  7. 7. Starting with Windows 11 version 26H1, .NET Framework 3.5 is no longer a Windows Feature on Demand optional component. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake