The Update BureauFiltered Update Catalog
Patch Tuesday — All products
51–75 of 726 updates, newest first.
Terms & labels
Label legend
- Security
- Contains fixes for security vulnerabilities.
- Preview
- Optional update with new features and fixes, without new security patches. Its content joins the next Patch Tuesday update.
- Out-of-band
- Released outside the usual monthly schedule, usually to fix a specific problem.
- Cumulative
- Includes everything from earlier updates, so the latest one is enough.
- Zero-day
- Microsoft reports a vulnerability that was already exploited or publicly known when the fix came out.
- Windows Insider Preview
- A pre-release build for testers, not meant for everyday PCs.
- Updated
- We revised this page after publishing because Microsoft changed its notes.
-
.NET Framework · 3.5, 4.8.1
Spoofing flaw fixed alongside a security bypass
The update fixes 21 flaws: 1 Critical, 18 Important, and 2 Unrated. They include spoofing flaw CVE-2026-96222 and publicly disclosed CVE-2026-108398, a security feature bypass.
Builds 4.8.9363.0 2.0.50727.9188Security 21 CVEs 1 critical -
.NET Framework · 3.5, 4.8UpdatedKB5127683
Critical .NET spoofing flaw addressed
CVE-2026-96222 is a critical .NET Framework spoofing flaw addressed by this update. It also addresses the publicly disclosed security-feature bypass CVE-2026-108398.
Builds 4.8.4811.0 2.0.50727.9188Security 21 CVEs 1 critical -
.NET Framework · 3.5, 4.8
Remote-code and security-bypass flaws are addressed
Addresses .NET Framework security flaws, including risks that could let attackers run code or bypass a security feature. It covers Windows Server 2022 systems with .NET Framework 3.5 or 4.8 installed.
Builds 4.8.4811.0 2.0.50727.9188Security 21 CVEs 1 critical -
.NET Framework · 3.5, 4.8
Closes a critical spoofing flaw and a disclosed security bypass
Fixes 21 security flaws, including a critical spoofing flaw and a publicly disclosed .NET Framework security bypass. It applies to Windows 10 version 1809 and Windows Server 2019.
Builds 4.8.4811.0 2.0.50727.9073Security 21 CVEs 1 critical -
.NET Framework · 4.8
Critical spoofing flaw among 20 vulnerabilities fixed
Fixes 20 vulnerabilities, including one critical spoofing flaw and a publicly disclosed security-feature bypass. It applies to .NET Framework 4.8 on Windows 10, version 1607 and Windows Server 2016.
Build 4.8.4811.0Security 20 CVEs 1 critical -
.NET Framework · 3.5, 4.7.2
Publicly disclosed .NET security bypass addressed
The update addresses 21 vulnerabilities, including one critical flaw. CVE-2026-108398 could bypass a .NET Framework security protection and was publicly disclosed.
Builds 4.7.4150.0 2.0.50727.9073Security 21 CVEs 1 critical
-
Windows 11 · 26H1Windows 11 26H1 Windows 11 26H1 Security updateZero-day UpdatedKB5124012
An exploited Windows Update Stack flaw is closed
An actively exploited Windows Update Stack flaw gets a security fix, and Teams and Outlook crashes on Arm64 PCs are addressed. The update also changes Morocco time and improves remote-session audio.
-
Windows 11 · 24H2, 25H2Windows 11 24H2 / 25H2 Windows 11 24H2 / 25H2 Security updateZero-day UpdatedKB5124008
Windows Update flaw exploited; mouse and desktop display fixes
An actively exploited flaw in the Windows Update stack gets a security fix, alongside fixes for mouse settings, black desktop backgrounds, and app crashes on Arm64 PCs.
-
Windows 11 · 23H2Windows 11 23H2 Windows 11 23H2 Security updateZero-day UpdatedKB5122880
An exploited Windows Update flaw gets an access fix
An actively exploited Windows Update flaw could let attackers gain higher access. The update also addresses remote audio problems and adjusts Morocco's time zone.
-
Windows 10 · 21H2, 22H2Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security updateZero-day UpdatedKB5122878
Windows ALPC flaw under attack; remote audio issue addressed
An actively exploited Windows ALPC flaw is among the security fixes. The update also addresses Remote Desktop audio and a BitLocker recovery-key issue.
-
Windows 10 · 1809Windows 10 1809 Windows 10 1809 Security update Also for Windows ServerZero-day UpdatedKB5122876
Exploited ALPC flaw patched; remote-session audio addressed
Attackers are exploiting a Windows ALPC flaw to gain higher access. Remote-session audio also gets a fix, though some USB audio problems remain.
-
Windows 10 · 1607Windows 10 1607 Windows 10 1607 Security update Also for Windows ServerZero-day UpdatedKB5123099
Windows ALPC flaw under attack; Remote Desktop audio addressed
Attackers are exploiting a Windows ALPC privilege flaw. The update also addresses Remote Desktop audio problems and adds Secure Boot certificate targeting data.
-
Windows Server · 2025Windows Server 2025 Windows Server 2025 Security updateZero-day UpdatedKB5122871
Windows Update Stack flaw under active attack
An actively exploited Windows Update Stack flaw is among the security fixes. The update also improves networking, Remote Desktop audio, and Sysmon.
Build 26100.33438Security 690 CVEs 64 critical 1 exploitedKnown issues 1 openReplaced by KB5129235 → -
Windows Server · 2022Windows Server 2022 Windows Server 2022 Security updateZero-day UpdatedKB5122882
Exploited ALPC flaw patched; Hyper-V restart issue fixed
Patches an actively exploited flaw in Windows ALPC and fixes a Hyper-V issue that could unexpectedly restart some virtual machines.
Build 20348.5622Security 651 CVEs 61 critical 1 exploitedKnown issues 1 openReplaced by KB5129237 → -
Windows Server · 2019Windows Server 2019 Windows Server 2019 Security update Also for Windows 10Zero-day UpdatedKB5122876
An exploited ALPC flaw is patched; Remote Desktop audio is addressed
An exploited Windows ALPC flaw is patched, and Remote Desktop audio redirection is addressed for some configurations. USB Audio Class 1.0 devices can still have sound problems.
-
Windows Server · 2016Windows Server 2016 Windows Server 2016 Security update Also for Windows 10Zero-day UpdatedKB5123099
Actively exploited ALPC flaw; Remote Desktop audio addressed
An actively exploited ALPC flaw could let attackers gain higher privileges. The update also addresses remote-session audio problems, but some USB audio issues remain.
-
Exchange Server · RTMExchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
Exchange vulnerabilities addressed; published calendar feeds may fail
Security flaws are addressed, but published calendar feeds and Korean-content processing have known issues.
-
Exchange Server · CU15Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update
Published calendar feeds can fail; hybrid sent-mail copies fixed
Security vulnerabilities are addressed, and a hybrid shared-mailbox message-copy problem is fixed. Published calendar subscriptions can still return HTTP 500; a workaround is available.
-
Exchange Server · CU14Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update
Exchange security flaws addressed; hybrid mailbox wrappers fixed
Security flaws are addressed, and a hybrid shared-mailbox message issue is fixed under specific mailbox and permission settings. Published calendar subscriptions stop refreshing and return HTTP 500 errors.
-
Exchange Server · CU23Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
Eight security flaws addressed; published calendar feeds can fail
Addresses eight Important vulnerabilities and fixes wrapper messages appearing in shared mailboxes in hybrid deployments. Published calendar subscriptions can still return HTTP 500.
-
SQL Server · CU8 + GDRSQL Server 2025 CU8 + GDR SQL Server 2025 CU8 + GDR Security update
Four critical remote-code flaws fixed; MSDASQL queries may fail
Fixes 56 vulnerabilities, including four critical SQL Server remote-code execution flaws. Linked-server queries using MSDASQL with a provider string can fail, and queries during database recovery can trigger an access violation.
-
SQL Server · GDRSQL Server 2025 GDR SQL Server 2025 GDR Security update
Critical database flaws addressed; linked-server queries may fail
Addresses 56 SQL Server vulnerabilities, including four critical remote-code-execution flaws. Linked server queries using MSDASQL and a provider string can fail with error 7416.
-
SQL Server · CU26 + GDRSQL Server 2022 CU26 + GDR SQL Server 2022 CU26 + GDR Security update
Remote-code flaws patched; two issues remain open
The update fixes 52 vulnerabilities, including four critical remote-code-execution flaws. KB5126934 supersedes it, so use the newer update rather than installing this package.
-
SQL Server · GDRSQL Server 2022 GDR SQL Server 2022 GDR Security update
Four critical database code-execution flaws patched
Fixes 52 vulnerabilities, including four critical remote code execution flaws. Some linked server queries using MSDASQL can still fail with error 7416.
-
SQL Server · CU32 + GDRSQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update
52 vulnerabilities addressed; linked-server queries can fail
Addresses 52 vulnerabilities, including three Critical remote code execution flaws; none are listed as exploited. Some linked-server queries might fail with error 7416 after installation.