Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5099535

KB5099535: Cumulative update for Windows Server, version 2016, July 2026. Exploited AD FS flaw prompts new key-container checks

In short

An actively exploited AD FS privilege flaw gets new key-container checks, alongside fixes for OLE Automation, File Explorer, and Recycle Bin problems.

Does it affect you? Applies to: This update applies to Windows Server 2016.

Build
14393.9339
Security
250 fixed · 25 critical · 2 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Fixes 3 changes

OLE Automation (known issue)

  • Some applications that use certain COM calls might fail. This update restores their expected behavior.1
    Corrects parameter ownership when IDispatch::Invoke calls COM methods with BYREF parameters that share the same underlying storage.

File Explorer (known issue)

For: Devices running File Explorer in administrative mode

  • The OneDrive shortcut in File Explorer works again when File Explorer runs as an administrator.2

Recycle Bin (known issue)

  • The confirmation dialog shows the original file name when you permanently delete a file.3

Improvements 2 changes

Secure Boot

Verified in package
  • More eligible devices can receive newer Secure Boot certificates automatically through Windows updates.4
    Adds high-confidence device targeting data for automatic deployment of new Secure Boot certificates.

Networking

Verified in package

For: Devices using unregistered third-party TDI transports

  • Some apps that use unregistered third-party network transports might stop working after the security change. Registered transports are not affected.5
    Enforces TDI transport registration requirements. Applications using sockets over unregistered third-party TDI transports might stop working.

New features 2 changes

Distributed Key Manager (DKM)

For: AD FS administrators

  • AD FS can detect insecure key-container permissions and gives administrators an optional way to strengthen them.6
    Adds automatic detection of insecure DKM container ACL configurations in AD FS and an opt-in remediation mechanism.

Remote Desktop (RDP) Security

Verified in package

For: IT administrators managing Remote Desktop files

  • Trusted Remote Desktop publishers can use SHA-2 certificate thumbprints. SHA-1 remains for older setups, but Microsoft plans to remove it.6
    Adds SHA-2 thumbprint support for trusted RDP publishers while retaining SHA-1 for backward compatibility. New Group Policy guidance covers which .rdp files users can open.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-07-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5094122, KB5087537, KB5091572, KB5082198
+21 earlier KB5078938, KB5075999, KB5073722, KB5074974, KB5071543, KB5068864, KB5070882, KB5066836, KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5120418
VersionBuildChannel
2016 14393.9339 General availability

Security

250 vulnerabilities fixed
2 exploited 25 critical 225 important
VulnerabilitySeverityCVSS
CVE-2026-56155 Exploited
Active Directory Federation Services Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-32202 Exploited
Windows Shell Spoofing Vulnerability
 Important 4.3
CVE-2026-57092
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
 Critical 9.9
CVE-2026-50518
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-56159
DHCP Server Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-56188
Windows Server Network driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-50380
Windows GDI+ Remote Code Execution Vulnerability
 Critical 9.6
CVE-2026-48564
DHCP Server Service Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50370
DHCP Server Service Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-50444
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-50474
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54121
Active Directory Certificate Services Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-54982
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54999
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57087
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57090
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-57094
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-58608
Windows Print Spooler Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-54128
Windows DHCP Client Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-54992
Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-49164
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-50694
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-54995
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-42982
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-49796
Windows GDI+ Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50655
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-56189
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-50661
Windows BitLocker Security Feature Bypass Vulnerability
 Important 6.1

The table lists the 28 exploited, publicly disclosed or critical vulnerabilities. See all 250 vulnerabilities →

Updated components

1,039 files changed since the previous update for the same versions.

Top changed componentsFiles
WPF14
Graphics and display11
Remote Desktop11
Audio9
Networking9
Security and sign-in8
Hyper-V and virtualization7
Secure Boot7
WCF7
Bluetooth6
.NET networking5
Kernel5

Verified in package: changed files confirm Secure Boot, Networking, Remote Desktop (RDP) Security.

Page history

  1. Added CVE-2026-40400 (Important)

    Added CVE-2026-57083 (Important)

    Added CVE-2026-57084 (Important)

    Added CVE-2026-57089 (Important)

  2. Removed CVE-2026-40400

    Removed CVE-2026-57083

    Removed CVE-2026-57084

    Removed CVE-2026-57089

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This update corrects how parameter ownership is managed and restores expected application behavior. support.microsoft.com
  2. 2. Fixed: An issue where the OneDrive shortcut in File Explorer stops working when File Explorer is run with administrative mode. support.microsoft.com
  3. 3. This update addresses an issue where the confirmation dialog might display an internal Recycle Bin file name instead of the original file name when permanently deleting a file. support.microsoft.com
  4. 4. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  5. 5. As a result, applications that use sockets over unregistered third-party TDI transports might stop working after installing this update. Registered TDI transports are not affected. support.microsoft.com
  6. 6. This update introduces automatic detection of insecure DKM container ACL configurations in AD FS and provides an opt-in remediation mechanism to help administrators strengthen DKM container permissions. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake