Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday Zero-day

KB5099539

KB5099539: Cumulative update for Windows 10, versions 21H2 and 22H2, July 2026. Shell spoofing flaw exploited; Secure Boot and RDP protections updated

In short

A Windows Shell spoofing flaw is already being exploited, and the update adds Secure Boot status reporting and SHA-2 support for trusted RDP publishers. Some keyboard shortcuts might stop responding in rare cases.

Does it affect you? Applies to: Windows 10, version 22H2 devices enrolled in ESU, and Windows 10 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 devices. The update provides builds 19045.7548 and 19044.7548.

Builds
19044.7548 · 19045.7548
Security
315 fixed · 21 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues Microsoft recommends auditing BitLocker policies before installing the update. If Event ID 1032 appears, it strongly recommends removing the Group Policy configuration before installing updates.

The official sources are linked at the end of the page.

What changes

Improvements 4 changes

Input

  • Hotkey cleanup behavior changes. In rare cases, some built-in Windows experiences might temporarily stop responding to keyboard shortcuts.1
    Changes hotkey unregister and cleanup behavior. Restarting the affected app can typically resolve the issue; if it persists, report it through Feedback Hub.

Secure Boot

Verified in package 2 items
  • Windows Security can now report Secure Boot status changes.2
    Enables dynamic status reporting for Secure Boot states in Windows Security App.
  • More eligible devices can receive new Secure Boot certificates automatically.3
    Adds high-confidence device targeting data. Certificate deployment continues through Windows updates on supported PCs and non-managed business devices in the coming months.

Networking

Verified in package

For: devices using unregistered third-party TDI transports

  • Some apps using unregistered third-party network transports might stop working. Registered transports are not affected.4
    Enforces TDI transport registration requirements for applications using sockets over third-party TDI transports.

Fixes 3 changes

OLE Automation (known issue)

For: devices running apps that use OLE Automation

  • Some apps that use automation calls might stop working; this update restores their expected behavior.5
    Corrects parameter ownership for IDispatch::Invoke calls to COM methods with BYREF parameters that share the same underlying storage.

File Explorer (known issue)

For: people running File Explorer in administrative mode

  • The OneDrive shortcut works again when File Explorer runs as an administrator.6

Recycle Bin (known issue)

  • The confirmation dialog shows the original file name, not an internal Recycle Bin file name, when you permanently delete a file.7

New feature 1 change

Remote Desktop (RDP) Security

Verified in package

For: organizations using trusted RDP publishers

  • Trusted Remote Desktop publishers can use SHA-2 certificates. Administrators also get guidance for controlling which Remote Desktop files users can open.4
    Adds SHA-2 certificate thumbprint support for trusted RDP publishers. SHA-1 remains for backward compatibility and is planned for future removal; Microsoft recommends migrating to SHA-256 or a stronger algorithm.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5122878

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    Some devices might ask for the BitLocker recovery key on the first restart after installing this update. The issue affects devices with a specific BitLocker and PCR7 configuration and is addressed by KB5122878.8

    How to apply the workaround Group Policy

    Removing the policy lets BitLocker use the Windows-selected default PCR profile.8

    Step-by-step instructions, command & download kit
    3 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. In Group Policy Editor or Group Policy Management Console, set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    2. Run gpupdate /force to apply the policy change.
    3. If BitLocker is enabled on the C: drive, suspend it and then resume it to update the bindings.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-07-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5094127, KB5087544, KB5082200, KB5078885
+36 earlier KB5075912, KB5078129, KB5077796, KB5073724, KB5074976, KB5071546, KB5068781, KB5066791, KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by
KB5120249
VersionBuildChannel
21H2 19044.7548 General availability
22H2 19045.7548 General availability

Security

315 vulnerabilities fixed
1 exploited 21 critical 294 important
VulnerabilitySeverityCVSS
CVE-2026-32202 Exploited
Windows Shell Spoofing Vulnerability
 Important 4.3
CVE-2026-57092
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
 Critical 9.9
CVE-2026-56188
Windows Server Network driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-50380
Windows GDI+ Remote Code Execution Vulnerability
 Critical 9.6
CVE-2026-50382
DirectX Graphics Kernel Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50474
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54982
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54999
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57087
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57090
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57094
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-58608
Windows Print Spooler Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54128
Windows DHCP Client Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-54992
Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-50680
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-49164
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-50694
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-54995
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-42982
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-49796
Windows GDI+ Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50655
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-56189
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50661
Windows BitLocker Security Feature Bypass Vulnerability
 Important 6.1

The table lists the 23 exploited, publicly disclosed or critical vulnerabilities. See all 315 vulnerabilities →

Updated components

6,157 files changed since the previous update for the same versions.

Top changed componentsFiles
Remote Desktop66
Graphics and display55
Networking49
Security and sign-in46
Audio43
Settings39
Bluetooth37
File Explorer and shell32
Printing32
Search32
Windows Update29
Hyper-V and virtualization21

Verified in package: changed files confirm Secure Boot, Networking, Remote Desktop (RDP) Security.

Page history

  1. Added CVE-2026-40400 (Important)

    Added CVE-2026-50375 (Important)

    Added CVE-2026-57083 (Important)

    Added CVE-2026-57084 (Important)

    Added CVE-2026-57089 (Important)

  2. Removed CVE-2026-40400

    Removed CVE-2026-57083

    Removed CVE-2026-57084

    Removed CVE-2026-57089

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. This update changes hotkey unregister and cleanup behavior. In rare cases, some built-in Windows experiences that rely on previous hotkey lifecycle behavior might temporarily stop responding to certain keyboard shortcuts. support.microsoft.com
  2. 2. This update enables dynamic status reporting for Secure Boot states in Windows Security App. support.microsoft.com
  3. 3. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  4. 4. Support for SHA-2 certificate thumbprints has been added for trusted RDP publishers, with SHA-1 support retained only for backward compatibility and planned for future removal. support.microsoft.com
  5. 5. Fixed: Addresses a compatibility issue in OLE Automation (oleaut32.dll) that was introduced by the June 2026 security update. support.microsoft.com
  6. 6. Fixed: An issue where the OneDrive shortcut in File Explorer stops working when File Explorer is run with administrative mode. support.microsoft.com
  7. 7. This update addresses an issue where the confirmation dialog might display an internal Recycle Bin file name instead of the original file name when permanently deleting a file. support.microsoft.com
  8. 8. This issue is addressed in update KB5122878. After installing update KB5122878, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Sep 24, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake