KB5126646: CVEs fixed (Windows update (KB))

KB5126646 fixes 5 tracked CVEs. Affected systems and fixed versions.

CVE-2026-69673 HIGH 7.8 UPGRADE UPGRADE Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker
CVE-2026-69718 HIGH 7.8 UPGRADE UPGRADE Improper neutralization of special elements used in a command ('command injection') in Windows Update allows a
CVE-2026-69733 HIGH 7.8 UPGRADE UPGRADE Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
CVE-2026-85790 MEDIUM 5.9 UPGRADE UPGRADE Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-96912 HIGH 7.8 UPGRADE UPGRADE Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.

Applies to