Should you update to KB5120249?
No: install KB5126657 instead. KB5120249 is a security update Microsoft released on 11 Aug 2026 for Windows PCs. It fixes 150 security flaws, 6 rated critical and 144 important by Microsoft.[1] One of them is already being used in attacks.
It has since been replaced by KB5122878, released 8 Sep 2026, which includes all of its fixes. If you’re on an older version, install that instead.
Should you update?
No: install KB5126657 instead. KB5126657 came out on 13 Oct 2026 and includes every fix in KB5120249, so there’s no reason to stop at this one. Software Update offers the newest version your device can run.
Is KB5120249 still safe?
Not any more. The 2 updates since, up to KB5126657, fix 1,474 security flaws that KB5120249 doesn’t, and each became public the day its fix shipped. Installing it is safe: get it only from Start → Settings → Windows Update, never from a link in an email, text or pop-up.
What it fixes
Microsoft lists 150 security flaws, 6 rated critical and 144 important by Microsoft.[1] The 150 critical and important ones are:
| Flaw | Severity | What Microsoft calls it |
|---|---|---|
CVE-2026-62816 | Critical | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability |
CVE-2026-62819 | Critical | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2026-62822 | Critical | Windows GDI+ Remote Code Execution Vulnerability |
CVE-2026-62889 | Critical | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2026-62890 | Critical | Windows GDI+ Elevation of Privilege Vulnerability |
CVE-2026-66799 | Critical | Windows Key Guard Elevation of Privilege Vulnerability |
CVE-2026-6726 | Important | MITRE: CVE-2026-6726 TPM 2.0 Improper Object Slot Reuse |
CVE-2026-6727 | Important | MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side-Channel Vulnerability |
CVE-2026-42976 | Important | Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability |
CVE-2026-49179 | Important | Windows Active Directory Domain Services Remote Code Execution Vulnerability |
CVE-2026-50472 | Important | Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability |
CVE-2026-54113 | Important | Remote Procedure Call Denial of Service Vulnerability |
CVE-2026-54984 | Important | Windows Imaging Component Remote Code Execution Vulnerability |
CVE-2026-56174 | Important | Windows Narrator Braille Elevation of Privilege Vulnerability |
CVE-2026-59122 | Important | Windows Telephony Service Elevation of Privilege Vulnerability |
CVE-2026-59125 | Important | Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability |
CVE-2026-59126 | Important | Windows Event Logging Service Elevation of Privilege Vulnerability |
CVE-2026-59128 | Important | Windows Encrypting File System (EFS) Information Disclosure Vulnerability |
CVE-2026-59130 | Important | AMD Zen Information Disclosure Vulnerability |
CVE-2026-59131 | Important | AMD Zen Information Disclosure Vulnerability |
CVE-2026-59132 | Important | Windows TCP/IP Denial of Service Vulnerability |
CVE-2026-59134 | Important | Remote Desktop Client Remote Code Execution Vulnerability |
CVE-2026-59135 | Important | Microsoft Windows Search Component Information Disclosure Vulnerability |
CVE-2026-59136 | Important | Microsoft COM for Windows Information Disclosure Vulnerability |
CVE-2026-59137 | Important | Windows Event Logging Service Information Disclosure Vulnerability |
CVE-2026-59138 | Important | Microsoft Remote Registry Service Denial of Service Vulnerability |
CVE-2026-61345 | Important | Microsoft Remote Registry Service Denial of Service Vulnerability |
CVE-2026-61347 | Important | Windows Event Logging Service Information Disclosure Vulnerability |
CVE-2026-61348 | Important | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
CVE-2026-61349 | Important | Windows Work Folder Service Elevation of Privilege Vulnerability |
| and 120 more | ||
Used in attacks
This fix closes a flaw that attackers were already using before the update came out, either on CISA’s list of flaws being used in attacks or in Microsoft’s own words.[2]
How to update, and how long it takes
Usually 15 to 60 minutes in all, with one or two restarts. You can keep working while it downloads.
- Save your work first.Windows restarts to finish the update, once or twice.
- Open Start → Settings → Windows Update.Select Check for updates. Windows downloads the month’s cumulative update; it includes every earlier fix.
- Restart when it asks.Select Restart now, or schedule it for tonight. Until it restarts, the fixes aren’t in place.
- Leave automatic updates on.In the same place, under Advanced options, turn on “Get me up to date” so restarts don’t wait for days.
To check it worked: Press Windows key + R, type winver and press Enter: it shows the OS build. It should say 19045.7725 or later.
Older devices
The same day, Microsoft released KB5121000 (183 security flaws), KB5121003 (182 security flaws), KB5123273 (1 security flaw) and KB5120240 (160 security flaws) for devices that stay on an older version. Each fixes the same holes where they apply.
KB5099539 vs KB5120249
KB5099539, released 14 Jul 2026, fixed 309 security flaws. KB5120249 fixes 150 security flaws and includes the fixes before it, so going straight to KB5120249 gets you both.
- Before: KB5099539, 14 Jul 2026, 309 security flaws
- After: KB5122878, 8 Sep 2026, 575 security flaws
- Windows updates, every release and the latest version
- Updates, the latest version of everything HARD tracks
References
- ^ Microsoft. “KB5120249”, 11 Aug 2026.
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”.