Skip to the content
The Update Bureau
Windows 10 1607 Windows 10 1607 Security update
Patch Tuesday Zero-day

KB5099535

KB5099535: Cumulative update for Windows 10, version 1607, July 2026. Exploited AD FS flaw patched; unregistered TDI apps may stop working

In short

Attackers are exploiting an AD FS privilege flaw. This release also tightens TDI transport rules, which might stop apps using unregistered third-party transports.

Does it affect you? Applies to: This update applies to Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB, version 1607.

Build
14393.9339
Security
250 fixed · 25 critical · 2 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fixes 3 changes

OLE Automation

  • Some apps that use shared parameters in automation calls might fail. This update restores expected behavior.1
    Addresses a compatibility issue introduced by the June 2026 security update. Apps calling COM methods through IDispatch::Invoke with BYREF parameters sharing the same underlying storage might encounter parameter marshaling errors or automation call failures.

File Explorer

  • The OneDrive shortcut works again when File Explorer runs as an administrator.2

Recycle Bin

  • The confirmation dialog shows the original file name when you permanently delete a file.3

Improvements 2 changes

Secure Boot

Gradual rollout Verified in package

For: devices eligible for automatic certificate updates

  • More devices qualify for automatic Secure Boot certificate updates. Certificates began expiring in June 2026, but devices without replacements still start and receive standard Windows updates.4
    Additional high-confidence device targeting data increases coverage of devices eligible to receive newer certificates automatically. Certificate deployment continues through Windows updates in the coming months.

Networking

Verified in package

For: devices using third-party TDI transports

  • Some apps using unregistered third-party network transports might stop working.5
    Enforces TDI transport registration requirements. Applications using sockets over unregistered third-party TDI transports might stop working; registered TDI transports are not affected.

New feature 1 change

Remote Desktop (RDP) Security

Verified in package
  • Trusted Remote Desktop publishers can use SHA-2 certificate thumbprints. SHA-1 remains for compatibility but is planned for removal.6
    New Group Policy guidance helps organizations control which .rdp files users can open. Administrators are advised to migrate to SHA-256 thumbprints or a stronger algorithm.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-07-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5094122, KB5087537, KB5091572, KB5082198
+20 earlier KB5078938, KB5075999, KB5073722, KB5074974, KB5071543, KB5068864, KB5066836, KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5120418
VersionBuildChannel
1607 14393.9339 General availability

Security

250 vulnerabilities fixed
2 exploited 25 critical 225 important
VulnerabilitySeverityCVSS
CVE-2026-56155 Exploited
Active Directory Federation Services Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-32202 Exploited
Windows Shell Spoofing Vulnerability
 Important 4.3
CVE-2026-57092
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
 Critical 9.9
CVE-2026-50518
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-56159
DHCP Server Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-56188
Windows Server Network driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-50380
Windows GDI+ Remote Code Execution Vulnerability
 Critical 9.6
CVE-2026-48564
DHCP Server Service Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50370
DHCP Server Service Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50444
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-50474
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54121
Active Directory Certificate Services Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-54982
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54999
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57087
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57090
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57094
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-58608
Windows Print Spooler Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54128
Windows DHCP Client Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-54992
Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-49164
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-50694
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-54995
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-42982
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-49796
Windows GDI+ Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50655
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-56189
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50661
Windows BitLocker Security Feature Bypass Vulnerability
 Important 6.1

The table lists the 28 exploited, publicly disclosed or critical vulnerabilities. See all 250 vulnerabilities →

Updated components

1,873 files changed since the previous update for the same versions.

Top changed componentsFiles
WPF28
Graphics and display21
Remote Desktop21
Audio18
Networking17
Security and sign-in15
Secure Boot14
WCF14
Bluetooth12
.NET networking10
Settings10
Windows Update10

Verified in package: changed files confirm Secure Boot, Networking, Remote Desktop (RDP) Security.

Page history

  1. Added CVE-2026-40400 (Important)

    Added CVE-2026-57083 (Important)

    Added CVE-2026-57084 (Important)

    Added CVE-2026-57089 (Important)

  2. Removed CVE-2026-40400

    Removed CVE-2026-57083

    Removed CVE-2026-57084

    Removed CVE-2026-57089

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. Fixed: Addresses a compatibility issue in OLE Automation (oleaut32.dll) that was introduced by the June 2026 security update. support.microsoft.com
  2. 2. Fixed: An issue where the OneDrive shortcut in File Explorer stops working when File Explorer is run with administrative mode. support.microsoft.com
  3. 3. Fixed: This update addresses an issue where the confirmation dialog might display an internal Recycle Bin file name instead of the original file name when permanently deleting a file. support.microsoft.com
  4. 4. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  5. 5. This update introduces a security hardening change that enforces TDI transport registration requirements. support.microsoft.com
  6. 6. Support for SHA-2 certificate thumbprints has been added for trusted RDP publishers, with SHA-1 support retained only for backward compatibility and planned for future removal. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake