The Update BureauKB5120418: Cumulative update for Windows Server, version 2016, August 2026. Exploited WinSock flaw; File History backup failures fixed
An actively exploited WinSock driver flaw gets a security fix, and scheduled File History backups to SMB shares work again after failing with invalid credentials.
Does it affect you? Applies to: Devices running Windows Server 2016.
Microsoft publishes separate notes for this KB for Windows 10.
What changes
Fix 1 change
Backup
For: Devices using File History backups to network shares
-
Scheduled File History backups to shared folders work again instead of failing with an “invalid credentials” error.1
Resolves failures in File History automatic backups to network shares using Server Message Block (SMB), where scheduled backups did not copy files.
Improvement 1 change
Secure Boot
For: Eligible devices
-
More devices can qualify to receive new Secure Boot certificates automatically.2
Adds high confidence device targeting data to increase coverage of devices eligible to automatically receive new Secure Boot certificates. Certificate deployment continues across supported PCs and non-managed business devices in the coming months.
Known issues
-
CompatTelRunner.exe might close unexpectedly
Some Windows Server 2016 devices might log recurring CompatTelRunner.exe errors. These errors do not affect device functions, and KB5123099 resolves the issue.3
How to apply the workaround WorkaroundDismiss the related event log warnings temporarily until the resolving update is installed.3
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-08-11
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5099535, KB5094122, KB5087537, KB5091572
- Replaced by
- KB5123099
| Version | Build | Channel |
|---|---|---|
| 2016 | 14393.9418 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2026-68820
Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Windows DNS Server Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows iSCSI Target Service Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows GDI+ Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows DHCP Server Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows DNS Server Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows iSCSI Target Service Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows DNS Server Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows iSCSI Target Service Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows GDI+ Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Key Guard Elevation of Privilege Vulnerability
|
Critical | 7.8 |
The table lists the 17 exploited, publicly disclosed or critical vulnerabilities. See all 165 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
581 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| WPF | 14 |
| Networking | 11 |
| Hyper-V and virtualization | 8 |
| Remote Desktop | 8 |
| Graphics and display | 7 |
| Secure Boot | 7 |
| Security and sign-in | 7 |
| ASP.NET | 6 |
| Kernel | 4 |
| Search | 4 |
| File Explorer and shell | 3 |
| .NET runtime (CLR) | 2 |
Verified in package: changed files confirm Secure Boot.
Page history
-
Added 8 vulnerabilities (8 important)
-
Removed CVE-2026-62740
Removed CVE-2026-62752
Removed CVE-2026-62761
Removed CVE-2026-62800
Removed CVE-2026-62877
Removed CVE-2026-70344
Sources
Cited passages from Microsoft's official notes (3)
-
1.
File History automatic backups to network shares using Server Message Block (SMB) might fail with an incorrect "invalid credentials" error. When this issue occurs, scheduled backups do not copy any files. This update resolves the issue.
support.microsoft.com -
2.
increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Certificate deployment via Windows updates continues across supported PCs and non-managed business devices in the coming months.
support.microsoft.com -
3.
Although recurring CompatTelRunner.exe failures might generate Application event log entries, they do not affect device functionality. The associated event log warnings can be safely dismissed temporarily until a resolution is released in an upcoming update.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake