Microsoft has released cumulative update KB5099414 for Windows 11 version 23H2 (2023 Update) as part of the July 2026 Patch Tuesday. The build number is 22631.7376. The main goal of the release is to address 570 security issues, including three zero-day vulnerabilities, along with several internal OS feature improvements. If you have previous updates installed, only the new components of this package will be downloaded and installed.
- Security. The built-in Windows curl tool has been updated to version 8.21.0. The update also includes various security improvements for internal OS functions for July 2026 and helps protect your device. In total, during the July 2026 Patch Tuesday, Microsoft fixed 570 security issues, including three zero-day vulnerabilities.
- Secure Boot. The list of devices that can automatically obtain new Secure Boot certificates has been expanded. Their deployment via Windows Update will continue in the coming months on supported PCs and unmanaged corporate devices.
- Third-party applications. Fixed an issue introduced after installing the June security update KB5093998. Some applications using OLE Automation to interact with Microsoft Office were unable to launch Office or open documents.
- File Explorer. Fixed an issue where the OneDrive shortcut did not work when launching File Explorer as an administrator.
- Country and operator settings. Updated profiles for some mobile operators.
- Hotkeys. Changed behavior when unregistering and clearing key combinations. In rare cases, some built-in Windows functions may temporarily stop responding to certain combinations. Usually, restarting the application helps.
- Network. Strengthened security requirements for TDI transport registration. Applications using sockets through unregistered third-party TDI transports may stop working after installing the update. Registered transports are not affected by this change.
- Recycle Bin. Fixed an error where the permanent deletion confirmation dialog displayed the internal file name from the Recycle Bin instead of the original name.
- RDP Security. Added support for SHA-2 certificate fingerprints for trusted RDP publishers. SHA-1 is still retained for compatibility, but will be removed in the future. Microsoft recommends migrating to SHA-256 or a stronger algorithm as soon as possible.
No known issues have been recorded at this time. To install update KB5099414, open Settings, go to Windows Update, and click Check for updates. The package installs automatically. What did not fit into the main text: this cumulative update is mandatory and is downloaded through the standard Windows servicing mechanism; for Home and Pro editions, deployment may follow the standard schedule, while Enterprise and Education editions have immediate availability.
| Feature / Change | Performance Increase or Decrease | Optimization | PC Speed Impact | Gaming Optimization |
|---|---|---|---|---|
| curl tool update to version 8.21.0 | 🟢 Minor increase (faster network operations) | 🟢 Improved networking stack efficiency | ⚪ Negligible (tool-specific improvement) | ⚪ No direct impact |
| Fix for 570 security issues (incl. 3 zero-days) | ⚪ No measurable change | 🟢 Critical security hardening | ⚪ No impact (defensive patches) | 🟢 Reduced exploit risk during online gaming |
| Secure Boot certificate auto-deployment expansion | ⚪ No performance change | 🟢 Boot integrity optimization | 🟡 Minimal (slightly longer first boot) | 🟢 Better anti-cheat compatibility |
| OLE Automation / Office launch fix | 🟢 Restored performance (bug regression fixed) | 🟢 COM/OLE interop stability restored | 🟢 Fix for noticeable slowdown in affected apps | ⚪ No direct gaming relevance |
| OneDrive shortcut fix in admin File Explorer | ⚪ No performance change | 🟡 Shell namespace optimization | ⚪ No speed impact | ⚪ Not applicable |
| Mobile operator profile updates | 🟡 Minor improvement (cellular connectivity) | 🟢 Network selection logic refined | 🟡 Faster carrier reconnection possible | 🟡 Marginal latency reduction on cellular |
| Hotkey unregistration behavior change | 🟡 Slight decrease in rare edge cases | 🟡 Input stack hardening (temporary hangs possible) | 🔴 Temporary unresponsiveness for some shortcuts | 🟡 Minor disruption if hotkeys clash during gameplay |
| TDI transport registration security hardening | 🔴 Potential breakage for unregistered 3rd-party transports | 🟢 Network driver security enforced | 🔴 Apps using unregistered TDI may stop working | 🟡 Some game overlays/VPNs may be affected |
| Recycle Bin deletion dialog display fix | ⚪ No performance change | 🟡 UI correctness improvement | ⚪ No speed impact | ⚪ Not applicable |
| RDP SHA-2 certificate fingerprint support | ⚪ No performance change | 🟢 Cryptographic agility for RDP | ⚪ No local speed impact | 🟡 Better remote gaming stream security |
Find and Change Settings
| Setting | Where to find | How to change |
|---|---|---|
| Windows curl version | Command Prompt or PowerShell (run curl --version) | The built-in Windows curl tool is automatically updated to version 8.21.0 via Windows Update. No manual configuration is required. To verify the version, open Command Prompt or PowerShell and run curl --version. |
| Secure Boot certificate updates | Settings > Windows Update > Advanced options > Optional updates | The list of devices eligible for automatic Secure Boot certificate updates has been expanded. These are deployed via Windows Update automatically on supported PCs and unmanaged corporate devices. You can check for available updates under Settings > Windows Update > Advanced options > Optional updates. No manual action is required for the automatic deployment. |
| OLE Automation fix for third-party applications | Installed automatically via Windows Update (KB after June KB5093998) | This fix is applied automatically by installing the July 2026 cumulative update. It resolves the issue where applications using OLE Automation could not launch Microsoft Office or open documents. No additional configuration is needed after installing the update. |
| File Explorer OneDrive shortcut as administrator | File Explorer (run as administrator) | The fix is included in the update and applied automatically. Previously, the OneDrive shortcut did not work when launching File Explorer as an administrator. After installing the update, the shortcut functions correctly without any manual settings changes. |
| Country and operator settings (COSA) | Settings > Network & internet > Cellular > Mobile operator settings | Updated profiles for some mobile operators are applied automatically via Windows Update. To check or manually adjust operator settings, go to Settings > Network & internet > Cellular, select your connection, and view Mobile operator settings. |
| Hotkey unregistration behavior | Affected application (restart if unresponsive) | The change modifies how key combinations are unregistered and cleared. In rare cases, some built-in Windows functions may temporarily stop responding to certain hotkeys. If this occurs, restart the affected application. No permanent settings change is available. |
| TDI transport registration requirement | Registry and driver configuration (administrator required) | Security requirements for TDI transport registration have been strengthened. Applications using sockets through unregistered third-party TDI transports may stop working. To resolve this, contact the application vendor to obtain a registered TDI transport version. Registered transports are not affected. |
| Recycle Bin deletion dialog file name | Desktop > Recycle Bin (right-click file > Delete permanently) | The fix is applied automatically with the update. Previously, the permanent deletion confirmation dialog displayed an internal Recycle Bin file name instead of the original name. After installing the update, the dialog correctly shows the original file name. |
| RDP SHA-2 certificate fingerprints | Local Group Policy Editor > Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client | Support for SHA-2 certificate fingerprints for trusted RDP publishers has been added. To configure, open Local Group Policy Editor, navigate to the Remote Desktop Connection Client policy, and specify SHA-256 certificates for trusted publishers. SHA-1 is still retained for compatibility but will be removed in the future. Microsoft recommends migrating to SHA-256 or stronger. |
Official announcement on the Microsoft website.
The last 10 Windows updates:
| Update | Build | Version | Windows | Channel | Date |
|---|---|---|---|---|---|
| KB5121157 | 28020.2818 | 26H1 | Windows 11 | Beta | 2026-08-31 |
| KB5121158 | 28120.2824 | 26H1 | Windows 11 | Experimental | 2026-08-31 |
| KB5121794 | 26300.9278 | 26H2 | Windows 11 | Preview | 2026-08-27 |
| KB5121132 | 28120.2760 | 26H1 | Windows 11 | Experimental | 2026-08-21 |
| KB5124040 | 26220.9223 | 25H2 | Windows 11 | Beta | 2026-08-21 |
| KB5124042 | 26340.9233 | 26H2 | Windows 11 | Experimental | 2026-08-21 |
| KB5121106 | 28020.2731 | 26H1 | Windows 11 | Beta | 2026-08-17 |
| KB5121109 | 28120.2738 | 26H1 | Windows 11 | Experimental | 2026-08-17 |
| KB5124036 | 26220.9202 | 25H2 | Windows 11 | Beta | 2026-08-17 |
| KB5124038 | 26340.9212 | 26H2 | Windows 11 | Experimental | 2026-08-17 |