Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday Zero-day

KB5120249

KB5120249: Cumulative update for Windows 10, versions 21H2 and 22H2, August 2026. Exploited Winsock driver flaw patched; File History backups fixed

In short

Attackers are exploiting a flaw in the Winsock Ancillary Function Driver that can let them gain higher access. Scheduled File History backups to network shares also work again.

Does it affect you? Applies to: Windows 10, version 22H2, for devices enrolled in ESU; and version 21H2 on Enterprise LTSC 2021 and IoT Enterprise LTSC 2021. The update applies to x86, x64, and Arm64 devices.

Builds
19044.7663 · 19045.7663
Security
160 fixed · 6 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • What changes The page gives no gradual rollout schedule for KB5120249. Its “coming months” statement is about Secure Boot certificate delivery.
  • What to do Include boot.stl when deploying dynamic updates to an existing Windows image. The page gives separate SSU prerequisites for offline-image servicing and WSUS or Catalog deployments.

The official sources are linked at the end of the page.

What changes

Fix 1 change

Backup

  • File History scheduled backups to network shares no longer fail with an “invalid credentials” error.1
    Resolves failures in File History automatic backups to network shares using Server Message Block (SMB).

Improvement 1 change

Secure Boot

Gradual rollout Verified in package

For: supported PCs and non-managed business devices

  • More eligible PCs can automatically receive new Secure Boot certificates. Delivery continues over the coming months.2
    Adds high-confidence device-targeting data to increase coverage of devices eligible to automatically receive new Secure Boot certificates.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5122878

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    On a limited number of systems with BitLocker and a specific policy, the first restart might ask for the recovery key. KB5122878 resolves this issue.3

    How to apply the workaround Group Policy

    This updates the BitLocker bindings to use the Windows-selected default PCR profile.3

    Step-by-step instructions, command & download kit
    5 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Open Group Policy Editor or the Group Policy Management Console.
    2. Go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
    3. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    4. Run gpupdate /force on affected devices.
    5. If BitLocker is enabled on the C: drive, run the disable command, then the enable command.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-08-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5099539, KB5094127, KB5087544, KB5082200
+37 earlier KB5078885, KB5075912, KB5078129, KB5077796, KB5073724, KB5074976, KB5071546, KB5068781, KB5066791, KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by
KB5122878
VersionBuildChannel
21H2 19044.7663 General availability
22H2 19045.7663 General availability

Security

160 vulnerabilities fixed
1 exploited 6 critical 154 important
VulnerabilitySeverityCVSS
CVE-2026-68820 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-62816
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-62822
Windows GDI+ Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-62819
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-62889
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-62890
Windows GDI+ Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-66799
Windows Key Guard Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-62832
Windows User Profile Service Elevation of Privilege Vulnerability
 Important 7.8

The table lists the 8 exploited, publicly disclosed or critical vulnerabilities. See all 160 vulnerabilities →

Updated components

4,156 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings64
Graphics and display58
Remote Desktop58
Security and sign-in54
Networking45
Audio37
Bluetooth37
File Explorer and shell37
Search30
Hyper-V and virtualization22
Printing22
Secure Boot21

Verified in package: changed files confirm Secure Boot.

Page history

  1. Added 10 vulnerabilities (10 important)

  2. Removed CVE-2026-61346

    Removed CVE-2026-62740

    Removed CVE-2026-62752

    Removed CVE-2026-62800

    Removed CVE-2026-62877

    Removed CVE-2026-66804

    Removed CVE-2026-70344

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. When this issue occurs, scheduled backups do not copy any files. This update resolves the issue. support.microsoft.com
  2. 2. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  3. 3. This issue is addressed in update KB5122878. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake