# KB5099414: July 2026 cumulative update for Windows 11 22H2

KB5099414, released July 14, 2026, fixes 19 CVEs across 2 products. One of them is being exploited (CVE-2026-32202); 1 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/microsoft/kb5099414
- Platform: Microsoft
- Released: Jul 14, 2026
- Priority: Patch now (Closes CVE-2026-32202, exploited (CISA KEV))
- CVEs: 19, exploited: 1, on CISA KEV: 1
- Vendor advisory: https://support.microsoft.com/help/5099414

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Windows 11 Version 23H2 for ARM64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-11-version-23h2-for-arm64-based-systems.md) |  | 22631.7376 |
| [Windows 11 Version 23H2 for x64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-11-version-23h2-for-x64-based-systems.md) |  | 22631.7376 |

## CVEs this fix closes

| CVE | Priority | Component | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-32202](https://patchblox.com/security/data/cve/CVE-2026-32202.md) | Patch now | Windows Shell | 4.3 | 0.7090 | CISA KEV |
| [CVE-2026-42982](https://patchblox.com/security/data/cve/CVE-2026-42982.md) | Urgent | Windows Secure Kernel Mode | 7.8 | 0.0033 |  |
| [CVE-2026-40378](https://patchblox.com/security/data/cve/CVE-2026-40378.md) | High | Windows Local Security Authority Subsystem Service (LSASS) | 7.5 | 0.0117 |  |
| [CVE-2026-50696](https://patchblox.com/security/data/cve/CVE-2026-50696.md) | High | Windows Internet Key Exchange (IKE) Protocol | 7.5 | 0.0117 |  |
| [CVE-2026-42990](https://patchblox.com/security/data/cve/CVE-2026-42990.md) | High | SQL Server ODBC driver | 9.8 | 0.0097 |  |
| [CVE-2026-49172](https://patchblox.com/security/data/cve/CVE-2026-49172.md) | High | Windows FTP Service | 9.8 | 0.0097 |  |
| [CVE-2026-50471](https://patchblox.com/security/data/cve/CVE-2026-50471.md) | High | Windows NTFS | 7.8 | 0.0047 |  |
| [CVE-2026-58640](https://patchblox.com/security/data/cve/CVE-2026-58640.md) | High | Windows NTFS | 7.3 | 0.0036 |  |
| [CVE-2026-58601](https://patchblox.com/security/data/cve/CVE-2026-58601.md) | High | Virtual Hard Disk (VHD) Miniport Driver | 7.8 | 0.0033 |  |
| [CVE-2026-48571](https://patchblox.com/security/data/cve/CVE-2026-48571.md) | High | Windows App Installer | 7.0 | 0.0026 |  |
| [CVE-2026-56173](https://patchblox.com/security/data/cve/CVE-2026-56173.md) | High | Windows WebView | 7.0 | 0.0026 |  |
| [CVE-2026-58629](https://patchblox.com/security/data/cve/CVE-2026-58629.md) | High | Windows DirectX | 7.0 | 0.0026 |  |
| [CVE-2026-44800](https://patchblox.com/security/data/cve/CVE-2026-44800.md) | High | Windows Push Notifications | 7.8 | 0.0020 |  |
| [CVE-2026-48572](https://patchblox.com/security/data/cve/CVE-2026-48572.md) | High | Windows App Installer | 7.0 | 0.0020 |  |
| [CVE-2026-34348](https://patchblox.com/security/data/cve/CVE-2026-34348.md) | Routine | Windows Event Logging Service | 6.5 | 0.0100 |  |
| [CVE-2026-33842](https://patchblox.com/security/data/cve/CVE-2026-33842.md) | Routine | Windows File Explorer | 5.5 | 0.0048 |  |
| [CVE-2026-34328](https://patchblox.com/security/data/cve/CVE-2026-34328.md) | Routine | Windows Audio Service | 5.5 | 0.0048 |  |
| [CVE-2026-59116](https://patchblox.com/security/data/cve/CVE-2026-59116.md) | Routine | Windows Remote Desktop | 6.8 | 0.0040 |  |
| [CVE-2026-34346](https://patchblox.com/security/data/cve/CVE-2026-34346.md) | Routine | Windows Ancillary Function Driver for WinSock | 5.5 | 0.0027 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo