Skip to the content
The Update Bureau
Windows 10 1809 Windows 10 1809 Security update
Patch Tuesday Zero-day

KB5099538

KB5099538: Cumulative update for Windows 10, version 1809, July 2026. Exploited Shell and AD FS flaws patched; Secure Boot coverage expands

In short

Patches exploited Windows Shell and Active Directory Federation Services flaws, and expands automatic Secure Boot certificate coverage. Some keyboard shortcuts might briefly stop working in rare cases.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSC 2019, version 1809.

Build
17763.9020
Security
313 fixed · 27 critical · 2 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 5 changes

Input

  • Some built-in Windows features might briefly stop responding to keyboard shortcuts in rare cases.1
    Changes hotkey unregister and cleanup behavior. Restart the affected app; if that does not resolve the issue, report it through Feedback Hub.

Secure Boot

Gradual rollout Verified in package
  • More eligible devices can receive newer Secure Boot certificates automatically.2
    Adds high-confidence device targeting data. Certificate deployment through Windows updates continues across supported PCs and non-managed business devices in the coming months.

Networking

Verified in package

For: devices using third-party TDI transports

  • Apps using some third-party network connections might stop working after this update.3
    Adds security hardening that enforces TDI transport registration requirements. Applications using sockets over unregistered third-party TDI transports might stop working; registered TDI transports are not affected.

Remote Desktop (RDP) Security

Verified in package 2 items
  • Trusted Remote Desktop publishers can use SHA-2 certificate fingerprints.4
    Adds support for SHA-2 certificate thumbprints for trusted RDP publishers. SHA-1 remains for backward compatibility and is planned for future removal. Microsoft recommends migrating to SHA-256 thumbprints or a stronger algorithm.
  • Organizations can set rules for which Remote Desktop files users can open, helping reduce phishing risks.4
    New Group Policy guidance is available for managing .rdp file security by controlling which files users can open.

Fixes 3 changes

File Explorer (known issue)

For: devices running File Explorer in administrative mode

  • The OneDrive shortcut works again in File Explorer when it runs as an administrator.5

OLE Automation (known issue)

  • Some apps that use automation calls with shared parameters work as expected again.6
    Fixes a compatibility issue introduced by the June 2026 security update in OLE Automation (oleaut32.dll). Apps using IDispatch::Invoke to call COM methods with BYREF parameters that share underlying storage might otherwise fail with parameter marshaling errors or automation call failures.

Recycle Bin (known issue)

  • The confirmation dialog shows the original file name when you permanently delete a file.7

New feature 1 change

Secure Boot

Verified in package
  • Windows Security can now report the status of Secure Boot states.2
    Enables dynamic status reporting for Secure Boot states in the Windows Security App.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-07-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5094123, KB5087538, KB5091573, KB5082123
+20 earlier KB5078752, KB5075904, KB5078131, KB5077795, KB5073723, KB5074975, KB5071544, KB5068791, KB5066586, KB5065428, KB5066187, KB5063877, KB5062557, KB5060531, KB5061978, KB5058392, KB5059091, KB5058922, KB5050008, KB5037425
Replaced by
KB5120238
VersionBuildChannel
1809 17763.9020 General availability

Security

313 vulnerabilities fixed
2 exploited 27 critical 286 important
VulnerabilitySeverityCVSS
CVE-2026-56155 Exploited
Active Directory Federation Services Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-32202 Exploited
Windows Shell Spoofing Vulnerability
 Important 4.3
CVE-2026-57092
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
 Critical 9.9
CVE-2026-50518
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-56159
DHCP Server Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-56188
Windows Server Network driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-50380
Windows GDI+ Remote Code Execution Vulnerability
 Critical 9.6
CVE-2026-48564
DHCP Server Service Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50370
DHCP Server Service Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50382
DirectX Graphics Kernel Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50444
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-50474
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54121
Active Directory Certificate Services Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-54982
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54999
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57087
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57090
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57094
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-58608
Windows Print Spooler Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54128
Windows DHCP Client Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-54992
Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-50680
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-49164
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-50694
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-54995
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-42982
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-49796
Windows GDI+ Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50655
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-56189
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50661
Windows BitLocker Security Feature Bypass Vulnerability
 Important 6.1

The table lists the 30 exploited, publicly disclosed or critical vulnerabilities. See all 313 vulnerabilities →

Updated components

3,132 files changed since the previous update for the same versions.

Top changed componentsFiles
Remote Desktop33
Audio32
Networking26
Bluetooth23
Graphics and display21
Security and sign-in20
File Explorer and shell16
Secure Boot15
Settings14
Windows Update12
Search10
Hyper-V and virtualization9

Verified in package: changed files confirm Secure Boot, Networking, Remote Desktop (RDP) Security.

Page history

  1. Added CVE-2026-40400 (Important)

    Added CVE-2026-50375 (Important)

    Added CVE-2026-57083 (Important)

    Added CVE-2026-57084 (Important)

    Added CVE-2026-57089 (Important)

  2. Removed CVE-2026-40400

    Removed CVE-2026-57083

    Removed CVE-2026-57084

    Removed CVE-2026-57089

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. In rare cases, some built-in Windows experiences that rely on previous hotkey lifecycle behavior might temporarily stop responding to certain keyboard shortcuts. support.microsoft.com
  2. 2. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  3. 3. applications that use sockets over unregistered third-party TDI transports might stop working after installing this update. support.microsoft.com
  4. 4. Support for SHA-2 certificate thumbprints has been added for trusted RDP publishers, with SHA-1 support retained only for backward compatibility and planned for future removal. support.microsoft.com
  5. 5. [File Explorer (known issue)] Fixed: An issue where the OneDrive shortcut in File Explorer stops working when File Explorer is run with administrative mode. support.microsoft.com
  6. 6. This update corrects how parameter ownership is handled and restores expected application behavior. support.microsoft.com
  7. 7. [Recycle Bin (known issue)] Fixed: This update addresses an issue where the confirmation dialog might display an internal Recycle Bin file name instead of the original file name when permanently deleting a file. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake