Skip to the content
The Update Bureau
Windows 11 24H2 / 25H2 Windows 11 24H2 / 25H2 Security update
Patch Tuesday Zero-day

KB5101650

KB5101650: Cumulative update for Windows 11, versions 24H2 and 25H2, July 2026. Exploited Windows Shell spoofing flaw patched; picture passwords retired

In short

An actively exploited Windows Shell spoofing flaw is patched. New picture passwords can no longer be set up, and the update addresses problems with Office apps and Recycle Bin prompts.

Does it affect you? Applies to: Devices running Windows 11, versions 25H2 or 24H2, on x64 or ARM64. The end-of-updates dates apply to 24H2 Home and Pro, and Enterprise and Education editions.

Builds
26100.8875 · 26200.8875
Security
381 fixed · 25 critical · 1 exploited
Restart
Required

What changes

Improvements 6 changes

Secure Boot

Verified in package

For: devices eligible for automatic certificate updates

  • More eligible devices can receive the new Secure Boot certificates automatically.1
    Adds high-confidence device targeting data to increase coverage of devices eligible for automatic certificate updates.

Input

  • In rare cases, some built-in Windows features might briefly stop responding to keyboard shortcuts.2
    Changes hotkey unregister and cleanup behavior. Restarting the affected app can typically resolve the issue.

Networking

Verified in package

For: devices using unregistered third-party TDI transports

  • Some apps that use certain third-party network connections might stop working after this update.3
    The security change enforces TDI transport registration requirements. Apps using sockets over unregistered third-party TDI transports might stop working; registered transports are not affected.

Security

  • The curl tool is updated and includes security improvements.4
    Updates curl to version 8.21.0.

AI components

Verified in package

For: Windows Copilot+ PCs

  • AI components are updated on Copilot+ PCs.5
    Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2605.856.0. These components apply only to Windows Copilot+ PCs.

Servicing stack update

Verified in package
  • The update installation process gets a reliability improvement.6
    Includes KB5120102, build 26100.8872, which improves the reliability of the Windows update installation process.

Fixes 2 changes

Apps (Known issue)

  • Addresses a problem that could stop some third-party apps from opening Office or documents.7
    The issue affects apps that use OLE Automation to interact with Microsoft Office after installing KB5094126.

Recycle Bin (known issue)

  • Addresses more cases where the permanent-delete prompt shows an internal Recycle Bin file name instead of the original name.8
    The issue might occur after installing KB5094126.

New feature 1 change

Remote Desktop (RDP) Security

Verified in package

For: Remote Desktop users and IT administrators

  • Trusted Remote Desktop publishers can use stronger certificate thumbprints.9
    Adds support for SHA-2 certificate thumbprints for trusted RDP publishers. SHA-1 remains supported only for backward compatibility and is planned for future removal.

Removal 1 change

Picture password

  • You can no longer set up a new picture password. Existing picture passwords still work unless removed or disabled.10
    Picture password enrollment is unavailable for new setup. Microsoft recommends Windows Hello PIN, facial, or fingerprint sign-in where available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-07-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5095093, KB5094126, KB5089573, KB5089549
+54 earlier KB5083631, KB5083769, KB5086672, KB5079391, KB5085516, KB5079473, KB5077241, KB5077181, KB5074105, KB5078127, KB5077744, KB5074109, KB5072033, KB5070311, KB5068861, KB5067036, KB5070773, KB5066835, KB5065789, KB5068221, KB5065426, KB5064081, KB5063878, KB5062660, KB5064489, KB5062553, KB5060829, KB5063060, KB5060842, KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5121767
VersionBuildChannel
24H2 26100.8875 General availability
25H2 26200.8875 General availability

Security

381 vulnerabilities fixed
1 exploited 25 critical 355 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2026-32202 Exploited
Windows Shell Spoofing Vulnerability
 Important 4.3
CVE-2026-57092
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
 Critical 9.9
CVE-2026-56188
Windows Server Network driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-50380
Windows GDI+ Remote Code Execution Vulnerability
 Critical 9.6
CVE-2026-50382
DirectX Graphics Kernel Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50474
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54982
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54999
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57087
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57090
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57094
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-58608
Windows Print Spooler Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54128
Windows DHCP Client Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-54992
Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-50680
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-49164
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-50694
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-54995
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-42982
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-49796
Windows GDI+ Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50327
Windows Media Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50655
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-56189
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-58542
Windows Media Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-54127
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.4
CVE-2026-50392
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-50661
Windows BitLocker Security Feature Bypass Vulnerability
 Important 6.1

The table lists the 27 exploited, publicly disclosed or critical vulnerabilities. See all 381 vulnerabilities →

Updated components

3,648 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display34
Networking33
Remote Desktop32
Security and sign-in32
Audio29
Settings26
Bluetooth18
File Explorer and shell16
Hyper-V and virtualization16
Printing16
Kernel14
Secure Boot14

Verified in package: changed files confirm Secure Boot, Networking, AI components, Servicing stack update, Remote Desktop (RDP) Security.

Page history

  1. Added 7 vulnerabilities (7 important)

  2. Removed CVE-2026-40400

    Removed CVE-2026-50436

    Removed CVE-2026-57083

    Removed CVE-2026-57084

    Removed CVE-2026-57089

Sources

Updated
Cited passages from Microsoft's official notes (10)
  1. 1. [Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. [Input] This update changes hotkey unregister and cleanup behavior. In rare cases, some built-in Windows experiences that rely on previous hotkey lifecycle behavior might temporarily stop responding to certain keyboard shortcuts. support.microsoft.com
  3. 3. [Networking] This update introduces a security hardening change that enforces TDI transport registration requirements. support.microsoft.com
  4. 4. [Security] This update upgrades the curl tool in Windows to version 8.21.0 and includes security improvements that help protect your device. support.microsoft.com
  5. 5. This release updates the following AI components to version 1.2605.856.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model. support.microsoft.com
  6. 6. Includes KB5120102 (Build 26100.8872), which improves the reliability of the Windows update installation process. support.microsoft.com
  7. 7. [Apps (Known issue)] Fixed: This update addresses an issue that affects certain third-party apps that use OLE Automation to interact with Microsoft Office. support.microsoft.com
  8. 8. [Recycle Bin (known issue)] Fixed: This update addresses additional scenarios where the confirmation dialog might display an internal Recycle Bin file name instead of the original file name when permanently deleting a file. support.microsoft.com
  9. 9. [Remote Desktop (RDP) Security] Support for SHA-2 certificate thumbprints has been added for trusted RDP publishers, with SHA-1 support retained only for backward compatibility and planned for future removal. support.microsoft.com
  10. 10. [Picture password] To help enhance security, picture password is no longer available for new enrollment. Users who have already configured a picture password can continue to use it to sign in to Windows. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake