KB5120233: Cumulative update for Windows Server, version 2025, August 2026. Winsock driver flaw under attack; DFS file previews improved

An actively exploited Winsock driver flaw gets a security fix. File Explorer also handles files on DFS drives better after network reconnects.

Does it affect you? Applies to: Devices running Windows Server 2025, build 26100.33296.

Review notes Additional details from the official release notes (1) Read note

In detail Devices that have not received the newer Secure Boot certificates will continue to start and operate normally, and standard Windows updates will continue to install.

The official sources are linked at the end of the page.

What changes

Improvements 4 changes

File Explorer

Previews and copied files on DFS mapped drives work as expected after the server reconnects to the network.¹
Improves File Explorer for files stored on DFS mapped drives.

Windows

For: IT administrators configuring certificate authorities

Certificate Authority setup again offers post-quantum certificate options, and enrollment with new certificate templates can succeed.²
Restores post-quantum cryptography (PQC) options during Certificate Authority configuration and enables enrollment with newly created PQC certificate templates.

Secure Boot

Gradual rollout Verified in package

For: Devices eligible for automatic certificate updates

More eligible devices can receive new Secure Boot certificates automatically.³
Adds high confidence device targeting data. Certificate deployment continues across supported PCs and non-managed business devices in the coming months.

Servicing stack

For: Devices receiving Windows updates

The component that installs Windows updates gets quality improvements.⁴
Includes servicing stack update KB5120232, build 26100.33288.

New feature 1 change

Emoji Panel

The emoji panel now supports GIPHY.⁵
The emoji panel opens with Windows key + period (.). GIPHY support follows the deprecation of Google's Tenor API.

Known issues

Open Affects: Organizations and IT administrators

Windows Server Update Services (WSUS) does not display error details

After KB5070881 or later updates, WSUS does not show synchronization error details in its error reporting.⁶

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-08-11
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5099536, KB5094125, KB5087539, KB5091157

+27 earlier
KB5082063, KB5078740, KB5075899, KB5078135, KB5077793, KB5073379, KB5072033, KB5072359, KB5068861, KB5070881, KB5070773, KB5066835, KB5068221, KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5044284, KB5043080
Replaced by: KB5122871

Version	Build	Channel
2025	26100.33296	General availability

Security

216 vulnerabilities fixed

1 exploited 19 critical 196 important 1 moderate

Vulnerability	Severity	CVSS
CVE-2026-68820 Exploited Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.0
CVE-2026-62815 Microsoft QUIC Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-62878 Windows DNS Server Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-62893 Windows Deployment Services TFTP Server Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-65791 Windows iSCSI Target Service Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-62816 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-62817 Windows DNS Server Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-62818 Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-62822 Windows GDI+ Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-62823 Windows DHCP Server Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-62819 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-62820 Windows DNS Server Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-62889 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-65679 Windows iSCSI Target Service Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-65789 Windows DNS Server Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-65796 Windows iSCSI Target Service Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-66802 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-71331 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-62890 Windows GDI+ Elevation of Privilege Vulnerability	Critical	7.8
CVE-2026-66799 Windows Key Guard Elevation of Privilege Vulnerability	Critical	7.8
CVE-2026-62832 Windows User Profile Service Elevation of Privilege Vulnerability	Important	7.8

The table lists the 21 exploited, publicly disclosed or critical vulnerabilities. See all 216 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2025

2.5 GB

windows11.0-kb5120233-x64.msu Main update · KB5120233 SHA-1: 9344a2fc…2213c1 windows11.0-kb5043080-x64.msu Prerequisite · KB5043080 SHA-1: 95344967…9c83e8

Updated components

5,685 files changed since the previous update for the same versions.

Top changed components	Files
Settings	124
Graphics and display	50
Security and sign-in	47
Networking	43
Bluetooth	38
Remote Desktop	36
Printing	35
Audio	34
Hyper-V and virtualization	30
File Explorer and shell	25
Storage and file systems	20
Search	16

Verified in package: changed files confirm Secure Boot.

Page history

Nov 11, 2026

Added 12 vulnerabilities (12 important)
Nov 9, 2026

Removed CVE-2026-61346

Removed CVE-2026-61359

Removed CVE-2026-62740

Removed CVE-2026-62752

Removed CVE-2026-62761

Removed CVE-2026-62800

Removed CVE-2026-62877

Removed CVE-2026-70344

Sources

Microsoft Support: KB5120233

Updated Nov 11, 2026

Cited passages from Microsoft's official notes (6)

1. [File Explorer] This update improves File Explorer for files stored on DFS mapped drives, helping previews and copied files work as expected after reconnecting to the network. support.microsoft.com
2. [Windows] This update improves support for post‑quantum cryptography (PQC) certificates by restoring PQC options during Certificate Authority configuration and enabling successful enrollment with newly created PQC certificate templates. support.microsoft.com
3. [Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
4. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
5. [Emoji Panel] The emoji panel (Windows key + period (.)) now supports GIPHY following the deprecation of Google's Tenor API. support.microsoft.com
6. After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake