The Update BureauKB5120240: Cumulative update for Windows 11, version 23H2, August 2026. WinSock driver flaw patched; File History backups improve
In short
A flaw in the WinSock support driver listed as exploited is addressed, and File History backups to network shares become more reliable.
Does it affect you? Applies to: Devices running Windows 11, version 23H2, on x64 or Arm64. The end-of-updates date applies to Enterprise and Education editions.
What changes
Improvements 4 changes
Connectivity
Verified in package
For: SolNet-Mobile users
-
Mobile settings for SolNet-Mobile are refreshed to support the operator's latest settings.1
Refreshes the COSA profile for
SolNet-Mobile.
Device Management
For: MDM-managed devices
-
The update helps managed devices keep working normally when an MDM certificate expires.2
Improves reliability for devices managed through mobile device management (MDM) when an MDM certificate expires.
File History
For: People backing up to network shares
-
Scheduled File History backups to network folders are more reliable and can copy files as expected.3
Improves File History backups to SMB network shares so scheduled backups can access network locations and copy files as expected.
Secure Boot
Verified in package
For: Eligible supported PCs and non-managed business devices
-
More eligible devices can automatically receive new Secure Boot certificates.4
Adds high-confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Deployment continues across supported PCs and non-managed business devices in the coming months.
New feature 1 change
Emoji Panel
-
The emoji panel now supports GIPHY after Google's Tenor API was deprecated.5
The emoji panel opens with Windows key + period (.).
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-08-11
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5099414, KB5093998, KB5087420, KB5082052
+54 earlier
KB5078883, KB5075941, KB5078132, KB5077797, KB5073455, KB5071417, KB5070312, KB5068865, KB5067112, KB5066793, KB5065790, KB5065431, KB5064080, KB5066189, KB5063875, KB5062663, KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123 - Replaced by
- KB5122880
| Version | Build | Channel |
|---|---|---|
| 23H2 | 22631.7517 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2026-68820
Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Microsoft QUIC Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows GDI+ Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows GDI+ Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Key Guard Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows User Profile Service Elevation of Privilege Vulnerability
|
Important | 7.8 |
The table lists the 9 exploited, publicly disclosed or critical vulnerabilities. See all 170 vulnerabilities →
Downloads (Microsoft Update Catalog)
x64
23H2
1.1 GB
Arm64
23H2
1.3 GB
Updated components
2,018 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Remote Desktop | 34 |
| Security and sign-in | 32 |
| Graphics and display | 30 |
| Networking | 21 |
| File Explorer and shell | 13 |
| Search | 13 |
| Secure Boot | 12 |
| Kernel | 11 |
| Settings | 11 |
| Hyper-V and virtualization | 10 |
| Storage and file systems | 6 |
| Magnifier | 4 |
Verified in package: changed files confirm Connectivity, Secure Boot.
Page history
-
Added 10 vulnerabilities (10 important)
-
Removed CVE-2026-61346
Removed CVE-2026-61359
Removed CVE-2026-62740
Removed CVE-2026-62752
Removed CVE-2026-62800
Removed CVE-2026-62877
Removed CVE-2026-70344
Sources
Updated
Cited passages from Microsoft's official notes (5)
-
1.
[Connectivity] This update refreshes the COSA profile for SolNet-Mobile to support the latest mobile operator settings.
support.microsoft.com -
2.
[Device Management] This update improves reliability for devices managed through mobile device management (MDM) by helping devices continue to perform normally when an MDM certificate expires.
support.microsoft.com -
3.
[File History] This update improves the reliability of File History backups to SMB network shares, helping scheduled backups access network locations and copy files as expected.
support.microsoft.com -
4.
[Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates.
support.microsoft.com -
5.
[Emoji Panel] The emoji panel (Windows key + period (.)) now supports GIPHY following the deprecation of Google's Tenor API.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Nov 6, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake