Skip to the content
The Update Bureau
Windows 11 26H1 Windows 11 26H1 Security update
Patch Tuesday Zero-day

KB5121000

KB5121000: Cumulative update for Windows 11, version 26H1, August 2026. Exploited WinSock flaw patched; Drop Tray removed

In short

An actively exploited flaw in the WinSock driver is patched, and Drop Tray and its Settings control are removed.

Does it affect you? Applies to: Devices running Windows 11, version 26H1.

Build
28000.2704
Security
196 fixed · 8 critical · 1 exploited
Restart
Required

What changes

Improvements 4 changes

Device

  • TPM maintenance reports the status of EK certificates more accurately.1
    Improves TPM maintenance reporting by ensuring that EK certificate status is reported accurately.

Secure Boot

Gradual rollout Verified in package

For: Supported PCs and non-managed business devices

  • More devices qualify to receive new Secure Boot certificates automatically.2
    Adds high-confidence device targeting data. Certificate deployment continues across supported PCs and non-managed business devices in the coming months.

AI components

Verified in package

For: Copilot+ PCs

  • Four AI components are updated to version 1.2605.856.0.3
    Updates Image Search, Content Extraction, Semantic Analysis, and Settings Model. These components apply only to Copilot+ PCs; they do not install on other Windows PCs or Windows Server.

Servicing stack update

  • The included servicing stack update improves the reliability of Windows update installation.4
    Includes KB5121292 (Build 28000.2602).

Removal 1 change

Sharing

For: Devices where Drop Tray was available

  • Drop Tray and its setting under System > Multitasking are removed from devices where they were available.5
    The removed experience was previously named Drag Tray. Microsoft says it is evaluating the experience and exploring future enhancements.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5124012

    Microsoft Teams and Outlook might fail to launch on ARM-based devices

    On ARM-based PCs, Teams and the new Outlook might fail to start or close unexpectedly, especially on new PCs without Store updates. Windows updates from September 8, 2026, such as KB5124012, resolve this.6

    How to apply the workaround Workaround

    Install version 1.0.19.0 or later of the Auto Super Resolution Package from Microsoft Store. This is a workaround; Windows updates from September 8, 2026, such as KB5124012, resolve the issue.6

    Step-by-step workaround instructions
    3 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Open Microsoft Store.
    2. Select Downloads > Check for updates.
    3. Install the latest update for the Auto Super Resolution Package, version 1.0.19.0 or later.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-08-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5101681, KB5101649, KB5095091, KB5095051
+8 earlier KB5089570, KB5089548, KB5083806, KB5083768, KB5079489, KB5079466, KB5077239, KB5077179
Replaced by
KB5124012
VersionBuildChannel
26H1 28000.2704 General availability
26H1 28000.2704 Release Preview Channel

Security

196 vulnerabilities fixed
1 exploited 8 critical 187 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2026-68820 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-62815
Microsoft QUIC Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-62816
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-62822
Windows GDI+ Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-62819
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-62889
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-66802
Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-62890
Windows GDI+ Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-66799
Windows Key Guard Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-62832
Windows User Profile Service Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-72971
Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability
 Important 5.5

The table lists the 11 exploited, publicly disclosed or critical vulnerabilities. See all 196 vulnerabilities →

Updated components

2,622 files changed since the previous update for the same versions.

Top changed componentsFiles
Remote Desktop34
Security and sign-in31
Graphics and display30
Networking21
File Explorer and shell13
Search13
Hyper-V and virtualization10
Kernel9
Settings9
Secure Boot7
Storage and file systems6
Printing5

Verified in package: changed files confirm Secure Boot, AI components.

Page history

  1. Added 13 vulnerabilities (13 important)

  2. Removed CVE-2026-61346

    Removed CVE-2026-61359

    Removed CVE-2026-62688

    Removed CVE-2026-62740

    Removed CVE-2026-62752

    Removed CVE-2026-62800

    Removed CVE-2026-62877

    Removed CVE-2026-66804

    Removed CVE-2026-70344

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This update improves TPM maintenance reporting by ensuring that EK certificate status is reported accurately. support.microsoft.com
  2. 2. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive [new Secure Boot certificates]. support.microsoft.com
  3. 3. This release updates the following AI components to version 1.2605.856.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model. support.microsoft.com
  4. 4. Includes KB5121292 (Build 28000.2602), which improves the reliability of the Windows update installation process. support.microsoft.com
  5. 5. This update removes the Drop Tray experience (previously named Drag Tray) for devices where it was available. It also removes the associated setting under Settings > System > Multitasking. support.microsoft.com
  6. 6. Install the latest update for the Auto Super Resolution Package (version 1.0.19.0 or later). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake