Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5099540

KB5099540: Cumulative update for Windows Server, version 2022, July 2026. Exploited AD FS flaw patched; BitLocker recovery prompt remains possible

In short

An actively exploited AD FS elevation flaw and a Windows Shell spoofing flaw get security fixes. Check BitLocker settings before installing on affected managed servers.

Does it affect you? Applies to: This update is for Windows Server 2022 devices, x64. The BitLocker recovery-key issue affects only a limited set of managed systems that meet the listed configuration conditions.

Build
20348.5386
Security
327 fixed · 28 critical · 2 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What changes Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Devices without the newer certificates will continue to start and receive standard Windows updates.

The official sources are linked at the end of the page.

What changes

Improvements 7 changes

Secure Boot

Gradual rollout Verified in package

For: supported PCs and non-managed business devices

  • More eligible devices can receive the updated Secure Boot certificates automatically.1
    Adds high-confidence device targeting data. Certificate deployment continues across supported PCs and non-managed business devices in the coming months.

Authentication

  • Identity auditing records more sign-ins that use NTLM, helping administrators spot identity threats.2
    Improves Microsoft Defender for Identity (MDI) unified sensor auditing for NT LAN Manager (NTLM) authentication.

Input

  • Some built-in Windows features might briefly stop responding to keyboard shortcuts. Restarting the affected app can usually resolve this.3
    Changes hotkey unregister and cleanup behavior; experiences that rely on the previous hotkey lifecycle behavior might be affected.

Networking

Verified in package 2 items
  • Cluster virtual IP settings are configured more reliably, improving DNS records and network connections.4
    Improves reliability in Windows Failover Cluster environments by correctly configuring the SkipAsSource setting for cluster IPs.
  • Some apps that use unregistered third-party network transports might stop working. Apps using registered transports are not affected.5
    Enforces TDI transport registration requirements; applications using sockets over unregistered third-party TDI transports might stop working.

Remote Desktop (RDP) Security

Verified in package

For: IT administrators managing RDP file security

  • Trusted remote desktop publishers can use SHA-2 certificate fingerprints. Administrators should move to SHA-256 or stronger to reduce phishing risks and avoid disruption.6
    Adds SHA-2 certificate thumbprint support for trusted RDP publishers. SHA-1 remains for backward compatibility and is planned for future removal. Group Policy guidance is available to control which .rdp files users can open.

Servicing stack

  • The component that installs Windows updates gets quality improvements.7
    Includes servicing stack update KB5120210, build 20348.5384.

Fixes 3 changes

Apps (Known issue)

  • Some third-party apps that use OLE Automation to work with Office can launch Office and open documents again.8
    Addresses an issue that might affect these apps after KB5094128.

File Explorer (known issue)

For: devices running File Explorer in administrative mode

  • The OneDrive shortcut works again when File Explorer runs as an administrator.9
    Addresses an issue that might occur after KB5094128.

Recycle Bin (known issue)

  • When you permanently delete a file, the confirmation dialog shows its original name instead of an internal name.10
    Addresses an issue that might occur after KB5094128.

New feature 1 change

Distributed Key Manager (DKM)

For: AD FS administrators

  • A new check can spot insecure AD FS key-container permissions, with an optional way for administrators to improve them.11
    Introduces automatic detection of insecure DKM container ACL configurations in AD FS and an opt-in remediation mechanism.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    After KB5070884 or a later update, WSUS does not show synchronization error details. Microsoft temporarily removed this function to address CVE-2025-59287.12

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    A limited set of managed devices might ask for the BitLocker recovery key on the first restart after installation. This can happen when BitLocker is on the OS drive, PCR7 is included in the configured profile or equivalent registry setting, System Information reports PCR7 binding as “Not Possible,” the Windows UEFI CA 2023 certificate is in the Secure Boot DB, and the device does not yet use the 2023-signed Windows Boot Manager.13

    How to apply the workaround Group Policy

    Removing the explicit PCR7 setting lets Windows use its selected default PCR profile. Suspending and resuming BitLocker updates its bindings.13

    Step-by-step instructions, command & download kit
    4 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Before installing the update, open Group Policy Editor or the Group Policy Management Console.
    2. Go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives and set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    3. Run gpupdate /force on affected devices.
    4. Where BitLocker is enabled on the C: drive, run the suspend command, then the resume command.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-07-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5094128, KB5087545, KB5091575, KB5082142
+38 earlier KB5078766, KB5082314, KB5075906, KB5078136, KB5077800, KB5073457, KB5071547, KB5068787, KB5070884, KB5066782, KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5120242
VersionBuildChannel
2022 20348.5386 General availability

Security

327 vulnerabilities fixed
2 exploited 28 critical 299 important
VulnerabilitySeverityCVSS
CVE-2026-56155 Exploited
Active Directory Federation Services Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-32202 Exploited
Windows Shell Spoofing Vulnerability
 Important 4.3
CVE-2026-57092
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
 Critical 9.9
CVE-2026-50518
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-56159
DHCP Server Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-56188
Windows Server Network driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-50380
Windows GDI+ Remote Code Execution Vulnerability
 Critical 9.6
CVE-2026-48564
DHCP Server Service Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50370
DHCP Server Service Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50382
DirectX Graphics Kernel Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50444
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-50474
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54121
Active Directory Certificate Services Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-54982
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54999
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57087
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57090
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57094
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-58608
Windows Print Spooler Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54128
Windows DHCP Client Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-54992
Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-50680
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-49164
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-50694
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-54995
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-42982
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-49796
Windows GDI+ Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50655
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-56189
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-54127
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.4
CVE-2026-50661
Windows BitLocker Security Feature Bypass Vulnerability
 Important 6.1

The table lists the 31 exploited, publicly disclosed or critical vulnerabilities. See all 327 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
573.2 MB
windows10.0-kb5099540-x64.msu Main update · KB5099540 SHA-1: 9238518d…d2ae66

Updated components

1,762 files changed since the previous update for the same versions.

Top changed componentsFiles
Remote Desktop19
Security and sign-in15
Audio13
Graphics and display12
Networking10
Secure Boot10
Windows Update9
Bluetooth8
File Explorer and shell8
Hyper-V and virtualization8
Kernel8
Printing5

Verified in package: changed files confirm Secure Boot, Networking, Remote Desktop (RDP) Security.

Page history

  1. Added CVE-2026-40400 (Important)

    Added CVE-2026-50375 (Important)

    Added CVE-2026-57083 (Important)

    Added CVE-2026-57084 (Important)

    Added CVE-2026-57089 (Important)

  2. Removed CVE-2026-40400

    Removed CVE-2026-57083

    Removed CVE-2026-57084

    Removed CVE-2026-57089

Sources

Updated
Cited passages from Microsoft's official notes (13)
  1. 1. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. It captures more NTLM-based authentication events, helping you better detect identity-related threats. support.microsoft.com
  3. 3. In rare cases, some built-in Windows experiences that rely on previous hotkey lifecycle behavior might temporarily stop responding to certain keyboard shortcuts. support.microsoft.com
  4. 4. It ensures the SkipAsSource setting for cluster IPs is configured correctly, which improves DNS record accuracy and network communication connectivity. support.microsoft.com
  5. 5. As a result, applications that use sockets over unregistered third-party TDI transports might stop working after installing this update. support.microsoft.com
  6. 6. Support for SHA-2 certificate thumbprints has been added for trusted RDP publishers, with SHA-1 support retained only for backward compatibility and planned for future removal. support.microsoft.com
  7. 7. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  8. 8. After installing the June 2026 security update (KB5094128), these apps might fail to launch Office or open documents. support.microsoft.com
  9. 9. Fixed: An issue where the OneDrive shortcut in File Explorer stops working when File Explorer is run with administrative mode. support.microsoft.com
  10. 10. This update addresses an issue where the confirmation dialog might display an internal Recycle Bin file name instead of the original file name when permanently deleting a file. support.microsoft.com
  11. 11. This update introduces automatic detection of insecure DKM container ACL configurations in AD FS and provides an opt-in remediation mechanism to help administrators strengthen DKM container permissions. support.microsoft.com
  12. 12. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
  13. 13. Remove the Group Policy configuration before installing the update (Recommended) support.microsoft.com
Checked automatically: 8 of 8 checks passed, 13 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake