Skip to the content
The Update Bureau
Windows 11 26H1 Windows 11 26H1 Security update
Patch Tuesday Zero-day

KB5101649

KB5101649: Cumulative update for Windows 11, version 26H1, July 2026. Exploited Shell spoofing flaw; picture-password sign-up ends

In short

A Windows Shell spoofing flaw is already being exploited, and a BitLocker bypass flaw is public. New picture-password enrollment also ends.

Does it affect you? Applies to: Devices running Windows 11, version 26H1, including x64 and Arm64 devices. The AI component updates apply only to Copilot+ PCs.

Build
28000.2525
Security
384 fixed · 25 critical · 1 exploited
Restart
Required

What changes

Improvements 5 changes

Secure Boot

Gradual rollout Verified in package

For: Supported PCs and non-managed business devices

  • More eligible PCs can receive new Secure Boot certificates automatically. Deployment continues over the coming months.1
    Adds high-confidence device targeting data to increase coverage of devices eligible to automatically receive new Secure Boot certificates.

Input

  • Some built-in Windows features might briefly stop responding to keyboard shortcuts in rare cases. Restarting the affected app can usually fix this.2
    Changes hotkey unregister and cleanup behavior. If restarting the affected app does not resolve the issue, report it through Feedback Hub.

Networking

Verified in package

For: People using apps that rely on third-party TDI transports

  • Some apps that use certain third-party network transports might stop working.3
    Enforces TDI transport registration requirements. Apps using sockets over unregistered third-party TDI transports might stop working; registered TDI transports are not affected.

AI components

Verified in package

For: Copilot+ PC users

  • AI components are updated to version 1.2605.856.0 on Copilot+ PCs.4
    Updates Image Search, Content Extraction, Semantic Analysis, and Settings Model to version 1.2605.856.0. These components do not install on other Windows PCs or Windows Server.

Servicing stack update

  • The update installation process is more reliable.5
    Includes KB5121292, build 28000.2524.

Fixes 2 changes

Apps (Known issue)

  • Some third-party apps can launch Office and open documents again.6
    Addresses failures in certain third-party apps using OLE Automation to interact with Microsoft Office after KB5095091.

Recycle Bin (known issue)

  • The confirmation dialog shows the original file name in more cases when you permanently delete a file.7
    Addresses additional cases where the confirmation dialog might show an internal Recycle Bin file name instead of the original file name.

Removals 2 changes

Management

For: Developers and system administrators

  • AT.exe and schedcli.dll can no longer administer AT Time or ATSvc servers.8
    Microsoft recommends discontinuing ATServer. The AT Client, at.exe, is replaced by schtasks.exe, PowerShell ScheduledTasks commands, and the ITaskSchedulerService interface.

Picture password

  • You can no longer enroll a new picture password. Existing picture passwords still work unless removed or disabled.9
    If a picture password is removed, disabled, or was not previously configured, it cannot be set up again. Windows Hello PIN, facial recognition, or fingerprint recognition is recommended where available.

New feature 1 change

Remote Desktop (RDP) Security

Verified in package

For: IT administrators and Remote Desktop users

  • Trusted Remote Desktop publishers can use SHA-2 certificate thumbprints.10
    Adds SHA-2 certificate thumbprint support for trusted RDP publishers. SHA-1 support remains for backward compatibility and is planned for future removal. Administrators are advised to migrate to SHA-256 or a stronger algorithm.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-07-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5095091, KB5095051, KB5089570, KB5089548
+6 earlier KB5083806, KB5083768, KB5079489, KB5079466, KB5077239, KB5077179
Replaced by
KB5121000
VersionBuildChannel
26H1 28000.2525 General availability
26H1 28000.2525 Release Preview Channel

Security

384 vulnerabilities fixed
1 exploited 25 critical 358 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2026-32202 Exploited
Windows Shell Spoofing Vulnerability
 Important 4.3
CVE-2026-57092
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
 Critical 9.9
CVE-2026-56188
Windows Server Network driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-50380
Windows GDI+ Remote Code Execution Vulnerability
 Critical 9.6
CVE-2026-50382
DirectX Graphics Kernel Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50474
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54982
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54999
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57087
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57090
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57094
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-58608
Windows Print Spooler Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54128
Windows DHCP Client Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-54992
Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-50680
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-49164
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-50694
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-54995
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-42982
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-49796
Windows GDI+ Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50327
Windows Media Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50655
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-56189
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-58542
Windows Media Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-54127
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.4
CVE-2026-50392
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-50661
Windows BitLocker Security Feature Bypass Vulnerability
 Important 6.1

The table lists the 27 exploited, publicly disclosed or critical vulnerabilities. See all 384 vulnerabilities →

Updated components

4,690 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display47
Settings41
Remote Desktop32
Networking31
Security and sign-in30
Audio29
Hyper-V and virtualization22
File Explorer and shell20
Bluetooth19
Printing18
Search16
Secure Boot15

Verified in package: changed files confirm Secure Boot, Networking, AI components, Remote Desktop (RDP) Security.

Page history

  1. Added 7 vulnerabilities (7 important)

  2. Removed CVE-2026-40400

    Removed CVE-2026-50436

    Removed CVE-2026-57083

    Removed CVE-2026-57084

    Removed CVE-2026-57089

Sources

Updated
Cited passages from Microsoft's official notes (10)
  1. 1. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. This update changes hotkey unregister and cleanup behavior. In rare cases, some built-in Windows experiences that rely on previous hotkey lifecycle behavior might temporarily stop responding to certain keyboard shortcuts. support.microsoft.com
  3. 3. This update introduces a security hardening change that enforces TDI transport registration requirements. support.microsoft.com
  4. 4. This release updates the following AI components to version 1.2605.856.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model. support.microsoft.com
  5. 5. Includes KB5121292 (Build 28000.2524), which improves the reliability of the Windows update installation process. support.microsoft.com
  6. 6. Fixed: This update addresses an issue that affects certain third-party apps that use OLE Automation to interact with Microsoft Office. support.microsoft.com
  7. 7. Fixed: This update addresses an issue additional scenarios where the confirmation dialog might display an internal Recycle Bin file name instead of the original file name when permanently deleting a file. support.microsoft.com
  8. 8. With this update, at.exe and schedcli.dll can no longer be used to administer "AT Time" or ATSvc servers. support.microsoft.com
  9. 9. To help enhance security, picture password is no longer available for new enrollment. support.microsoft.com
  10. 10. Support for SHA-2 certificate thumbprints has been added for trusted RDP publishers, with SHA-1 support retained only for backward compatibility and planned for future removal. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Sep 24, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake