KB5099538: Cumulative update for Windows Server, version 2019, July 2026. Exploited AD FS flaw patched; Secure Boot status reporting added

Attackers are exploiting an AD FS privilege flaw, and the update adds Secure Boot status reporting. It also fixes issues in File Explorer, OLE Automation, and the Recycle Bin.

Does it affect you? Applies to: Devices running Windows Server 2019.

Review notes Additional details from the official release notes (1) Read note

What changes Microsoft recommends that IT administrators migrate trusted RDP publishers to SHA-256 thumbprints or a stronger algorithm as soon as possible to avoid disruption.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 5 changes

Input

In rare cases, some built-in Windows features might temporarily stop responding to keyboard shortcuts.¹
Changes hotkey unregister and cleanup behavior. Restarting the affected app can typically resolve the issue.

Secure Boot

Gradual rollout Verified in package

For: supported PCs and non-managed business devices

More eligible devices can receive new Secure Boot certificates automatically.²
Adds high-confidence device targeting data. Certificate deployment continues through Windows updates for supported PCs and non-managed business devices.

Networking

Verified in package

For: devices using unregistered third-party TDI transports

Some apps that use certain third-party network connections might stop working after this update.³
Enforces TDI transport registration requirements. Applications using sockets over unregistered third-party TDI transports might stop working; registered transports are not affected.

Authentication

NTLM authentication logs provide more detail for security checks.⁴
Enhances auditing and logging for NTLM authentication.

Remote Desktop (RDP) Security

Verified in package

Trusted Remote Desktop publishers can use SHA-2 certificates. Older SHA-1 support remains for now.⁵
Adds SHA-2 certificate thumbprints for trusted RDP publishers; SHA-1 remains for backward compatibility and is planned for future removal. New Group Policy guidance covers which .rdp files users can open.

Fixes 3 changes

File Explorer

For: devices running File Explorer as an administrator

The OneDrive shortcut in File Explorer works again when File Explorer runs as an administrator.⁶

OLE Automation

Some applications that call COM methods with shared parameters work as expected again.⁷
Corrects parameter ownership in OLE Automation (oleaut32.dll) for IDispatch::Invoke calls with BYREF parameters that share underlying storage.

Recycle Bin

The confirmation dialog shows the original file name when you permanently delete a file.⁸

New features 2 changes

Secure Boot

Verified in package

Windows Security can now report Secure Boot status.⁹

Distributed Key Manager (DKM)

Verified in package

AD FS can detect insecure DKM container settings and offers an optional way to improve them.¹⁰
Adds automatic detection of insecure DKM container ACL configurations in AD FS and an opt-in remediation mechanism.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-07-14
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5094123, KB5087538, KB5091573, KB5082123

+21 earlier
KB5078752, KB5075904, KB5078131, KB5077795, KB5073723, KB5074975, KB5071544, KB5068791, KB5070883, KB5066586, KB5065428, KB5066187, KB5063877, KB5062557, KB5060531, KB5061978, KB5058392, KB5059091, KB5058922, KB5050008, KB5037425
Replaced by: KB5120238

Version	Build	Channel
2019	17763.9020	General availability

Security

313 vulnerabilities fixed

2 exploited 27 critical 286 important

Vulnerability	Severity	CVSS
CVE-2026-56155 Exploited Active Directory Federation Services Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-32202 Exploited Windows Shell Spoofing Vulnerability	Important	4.3
CVE-2026-57092 Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Critical	9.9
CVE-2026-50518 Windows DHCP Server Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-56159 DHCP Server Service Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-56188 Windows Server Network driver Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-50380 Windows GDI+ Remote Code Execution Vulnerability	Critical	9.6
CVE-2026-48564 DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-50370 DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-50382 DirectX Graphics Kernel Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-50444 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Critical	8.8
CVE-2026-50474 Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-54121 Active Directory Certificate Services Elevation of Privilege Vulnerability	Critical	8.8
CVE-2026-54982 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-54999 Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-57087 Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-57090 Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-57094 Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-58608 Windows Print Spooler Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-54128 Windows DHCP Client Remote Code Execution Vulnerability	Critical	8.4
CVE-2026-54992 Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Critical	8.4
CVE-2026-50680 Windows Hyper-V Elevation of Privilege Vulnerability	Critical	8.2
CVE-2026-49164 Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-50694 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-54995 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-42982 Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7.8
CVE-2026-49796 Windows GDI+ Remote Code Execution Vulnerability	Critical	7.8
CVE-2026-50655 Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8
CVE-2026-56189 Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8
CVE-2026-50661 Windows BitLocker Security Feature Bypass Vulnerability	Important	6.1

The table lists the 30 exploited, publicly disclosed or critical vulnerabilities. See all 313 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2019

853.0 MB

windows10.0-kb5099538-x64.msu Main update · KB5099538 SHA-1: 8ed66975…37dafb

Updated components

1,742 files changed since the previous update for the same versions.

Top changed components	Files
Remote Desktop	17
Audio	16
Networking	13
Bluetooth	12
Security and sign-in	12
Graphics and display	11
Hyper-V and virtualization	9
File Explorer and shell	8
Secure Boot	8
Settings	7
Windows Update	6
Kernel	5

Verified in package: changed files confirm Secure Boot, Networking, Remote Desktop (RDP) Security, Distributed Key Manager (DKM).

Page history

Nov 11, 2026

Added CVE-2026-40400 (Important)

Added CVE-2026-50375 (Important)

Added CVE-2026-57083 (Important)

Added CVE-2026-57084 (Important)

Added CVE-2026-57089 (Important)
Nov 9, 2026

Removed CVE-2026-40400

Removed CVE-2026-57083

Removed CVE-2026-57084

Removed CVE-2026-57089

Sources

Microsoft Support: KB5099538

Updated Nov 11, 2026

Cited passages from Microsoft's official notes (10)

1. [Input] This update changes hotkey unregister and cleanup behavior. In rare cases, some built-in Windows experiences that rely on previous hotkey lifecycle behavior might temporarily stop responding to certain keyboard shortcuts. support.microsoft.com
2. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
3. This update introduces a security hardening change that enforces TDI transport registration requirements. support.microsoft.com
4. This update improves auditing for NT LAN Manager (NTLM) authentication by enhancing logging to provide more detailed information for security monitoring and analysis. support.microsoft.com
5. Support for SHA-2 certificate thumbprints has been added for trusted RDP publishers, with SHA-1 support retained only for backward compatibility and planned for future removal. support.microsoft.com
6. [File Explorer (known issue)] Fixed: An issue where the OneDrive shortcut in File Explorer stops working when File Explorer is run with administrative mode. support.microsoft.com
7. This update corrects how parameter ownership is handled and restores expected application behavior. support.microsoft.com
8. [Recycle Bin (known issue)] Fixed: This update addresses an issue where the confirmation dialog might display an internal Recycle Bin file name instead of the original file name when permanently deleting a file. support.microsoft.com
9. This update enables dynamic status reporting for Secure Boot states in Windows Security App. support.microsoft.com
10. This update introduces automatic detection of insecure DKM container ACL configurations in AD FS and provides an opt-in remediation mechanism to help administrators strengthen DKM container permissions. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Sep 25, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake