KB5120238: Cumulative update for Windows Server, version 2019, August 2026. Exploited WinSock flaw patched; SMB backups recover

An actively exploited WinSock driver flaw is patched, and scheduled File History backups to network shares work again. Secure Boot certificate coverage also expands.

Does it affect you? Applies to: Devices running Windows Server 2019.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 2 changes

Secure Boot

Gradual rollout Verified in package

For: PCs and non-managed business devices

More devices qualify to receive new Secure Boot certificates automatically. Certificate deployment continues over the coming months.¹
Adds high-confidence device targeting data for certificate deployment on supported PCs and non-managed business devices.

Servicing stack update (SSU)

For: Azure-hosted devices

The update improves checks that confirm whether a device is hosted on Azure.²
The bundled SSU uses an updated certificate chain to validate Azure hosting.

Fix 1 change

Backup

Scheduled File History backups to network shares copy files again instead of failing with an incorrect credentials error.³
Resolves failures in File History automatic backups to network shares using Server Message Block (SMB).

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-08-11
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5099538, KB5094123, KB5087538, KB5091573

+22 earlier
KB5082123, KB5078752, KB5075904, KB5078131, KB5077795, KB5073723, KB5074975, KB5071544, KB5068791, KB5070883, KB5066586, KB5065428, KB5066187, KB5063877, KB5062557, KB5060531, KB5061978, KB5058392, KB5059091, KB5058922, KB5050008, KB5037425
Replaced by: KB5122876

Version	Build	Channel
2019	17763.9121	General availability

Security

183 vulnerabilities fixed

1 exploited 18 critical 165 important

Vulnerability	Severity	CVSS
CVE-2026-68820 Exploited Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.0
CVE-2026-62878 Windows DNS Server Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-62893 Windows Deployment Services TFTP Server Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-65791 Windows iSCSI Target Service Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-62816 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-62817 Windows DNS Server Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-62818 Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-62822 Windows GDI+ Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-62823 Windows DHCP Server Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-62819 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-62820 Windows DNS Server Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-62889 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-65679 Windows iSCSI Target Service Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-65789 Windows DNS Server Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-65796 Windows iSCSI Target Service Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-66802 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-71331 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-62890 Windows GDI+ Elevation of Privilege Vulnerability	Critical	7.8
CVE-2026-66799 Windows Key Guard Elevation of Privilege Vulnerability	Critical	7.8

The table lists the 19 exploited, publicly disclosed or critical vulnerabilities. See all 183 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2019

860.4 MB

windows10.0-kb5120238-x64.msu Main update · KB5120238 SHA-1: 9260c045…488ed5

Updated components

978 files changed since the previous update for the same versions.

Top changed components	Files
Remote Desktop	15
Networking	14
Security and sign-in	14
Audio	12
Hyper-V and virtualization	12
Graphics and display	10
Bluetooth	9
Secure Boot	8
File Explorer and shell	7
Kernel	5
Search	5
Settings	5

Verified in package: changed files confirm Secure Boot.

Page history

Nov 11, 2026

Added 9 vulnerabilities (9 important)
Nov 9, 2026

Removed CVE-2026-61346

Removed CVE-2026-62740

Removed CVE-2026-62752

Removed CVE-2026-62761

Removed CVE-2026-62800

Removed CVE-2026-62877

Removed CVE-2026-70344

Sources

Microsoft Support: KB5120238

Updated Nov 11, 2026

Cited passages from Microsoft's official notes (3)

1. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
2. This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. support.microsoft.com
3. When this issue occurs, scheduled backups do not copy any files. This update resolves the issue. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake