Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5120242

KB5120242: Cumulative update for Windows Server, version 2022, August 2026. WinSock driver flaw under active attack

In short

An actively exploited elevation-of-privilege flaw affects the Ancillary Function Driver for WinSock. The update also improves Secure Boot certificate targeting.

Does it affect you? Applies to: Devices running Windows Server 2022, x64.

Build
20348.5499
Security
195 fixed · 19 critical · 1 exploited
Restart
Required

What changes

Improvements 2 changes

Secure Boot

Gradual rollout Verified in package

For: Eligible devices

  • More devices are eligible to receive new Secure Boot certificates automatically.1
    Adds high-confidence device targeting data. Certificate deployment continues over the coming months on supported PCs and non-managed business devices.

Servicing stack

For: Windows Server administrators

  • The component that installs Windows updates gets quality improvements.2
    Includes servicing stack update KB5120241, build 20348.5480.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not show synchronization error details after KB5070884 or later.3

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-08-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5099540, KB5094128, KB5087545, KB5091575
+39 earlier KB5082142, KB5078766, KB5082314, KB5075906, KB5078136, KB5077800, KB5073457, KB5071547, KB5068787, KB5070884, KB5066782, KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5122882
VersionBuildChannel
2022 20348.5499 General availability

Security

195 vulnerabilities fixed
1 exploited 19 critical 176 important
VulnerabilitySeverityCVSS
CVE-2026-68820 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-62815
Microsoft QUIC Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-62878
Windows DNS Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-62893
Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-65791
Windows iSCSI Target Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-62816
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-62817
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-62818
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-62822
Windows GDI+ Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-62823
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-62819
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-62820
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-62889
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-65679
Windows iSCSI Target Service Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-65789
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-65796
Windows iSCSI Target Service Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-66802
Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-71331
Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-62890
Windows GDI+ Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-66799
Windows Key Guard Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-62832
Windows User Profile Service Elevation of Privilege Vulnerability
 Important 7.8

The table lists the 21 exploited, publicly disclosed or critical vulnerabilities. See all 195 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
580.1 MB
windows10.0-kb5120242-x64.msu Main update · KB5120242 SHA-1: e300a688…6eb0ee

Updated components

838 files changed since the previous update for the same versions.

Top changed componentsFiles
Remote Desktop17
Graphics and display12
Networking11
Security and sign-in11
Hyper-V and virtualization9
Kernel8
Secure Boot8
File Explorer and shell6
Search5
Magnifier2
Printing2
Settings2

Verified in package: changed files confirm Secure Boot.

Page history

  1. Added 11 vulnerabilities (11 important)

  2. Removed CVE-2026-61346

    Removed CVE-2026-61359

    Removed CVE-2026-62740

    Removed CVE-2026-62752

    Removed CVE-2026-62761

    Removed CVE-2026-62800

    Removed CVE-2026-62877

    Removed CVE-2026-70344

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake