KB5099536: Cumulative update for Windows Server, version 2025, July 2026. Actively exploited AD FS and Shell flaws addressed

• More eligible devices can receive updated Secure Boot certificates automatically.¹
  Adds high-confidence device targeting data. Certificate deployment continues through Windows updates across supported PCs and non-managed business devices.

For: Windows Server container administrators

• Hyper-V-isolated Windows Server containers start faster.²
  Updated Windows Server 2025 nanoserver, servercore, and windowsservercore base images are available through the Microsoft Container Registry. Pull the latest image tag to get this improvement.

For: Event collector server administrators

• The Windows Event Log service is more reliable on event collector servers that forward events to custom log channels.³
  Applies to custom log channels configured with a manifest.

• Windows changes how it handles keyboard shortcuts. In rare cases, some built-in experiences might temporarily stop responding to certain shortcuts.⁴
  Changes hotkey unregister and cleanup behavior. Restarting the affected app can typically resolve the issue; if it persists, the page says to report it through Feedback Hub.

• Apps and Windows features connect more reliably to shared network resources, including some connections without authentication.⁵
  Improves connections used by apps and system features such as the NetUseAdd function, including unauthenticated (null session) connections.
• A new security rule might stop apps that use certain unregistered third-party network transports from working.⁶
  Enforces TDI transport registration requirements. Applications using sockets over unregistered third-party TDI transports might stop working; registered TDI transports are not affected.

• Trusted Remote Desktop publishers can use SHA-2 certificate thumbprints. Administrators should move to SHA-256 or stronger to avoid disruption.⁷
  Adds SHA-2 thumbprint support for trusted RDP publishers. SHA-1 remains supported only for backward compatibility and is planned for future removal. New Group Policy guidance is available for controlling which .rdp files users can open.

For: Windows Server 2025 administrators

• The component that installs Windows updates gets quality improvements.⁸
  Includes servicing stack update KB5101372, build 26100.33150.

• A problem that could stop some third-party apps from opening Office or documents is addressed.⁹
  The issue affected third-party apps that use OLE Automation to interact with Microsoft Office after KB5094125.

For: Devices running File Explorer in administrative mode

• The OneDrive shortcut in File Explorer works again when File Explorer runs as an administrator.¹⁰
  Addresses an issue that might occur after installing KB5094125.

• The delete confirmation dialog shows the original file name when permanently deleting a file.¹¹
  Addresses an issue where the dialog might show an internal Recycle Bin file name instead of the original file name. It might occur after KB5094125.

• Windows is less likely to stop responding in certain situations.¹²
  Improves system reliability by addressing an issue that could cause Windows to stop responding.
• Virtual machines running graphics-intensive apps use less memory and keep sign-in access more consistent.¹³
  Resolves a memory leak in the graphics kernel driver and reduces excessive memory usage.

• TLS 1.3 can use hybrid post-quantum key exchange to help protect secure network connections.¹⁴
  Adds support for hybrid post-quantum cryptography (PQC) key exchange in Transport Layer Security (TLS) 1.3.
• Cryptographic signatures and keys can combine traditional and post-quantum algorithms.¹⁵
  Adds support for composite cryptographic formats that combine traditional and post-quantum algorithms in a single signature or key.

For: AD FS administrators

• AD FS can detect insecure DKM container permissions and offers an optional way to improve them.¹⁶
  Introduces automatic detection of insecure DKM container ACL configurations in AD FS and an opt-in remediation mechanism.