KB5126868: CVEs fixed (Windows update (KB))

KB5126868 fixes 5 tracked CVEs. Affected systems and fixed versions.

CVE-2026-108132 HIGH 7.0 UPGRADE UPGRADE Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
CVE-2026-108136 HIGH 7.8 UPGRADE UPGRADE Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges local
CVE-2026-96960 HIGH 7.5 UPGRADE DOWNGRADE Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a
CVE-2026-96959 HIGH 7.5 UPGRADE DOWNGRADE Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service o
CVE-2026-96951 HIGH 8.8 EXPLOITED MITIGATE UPGRADE Microsoft Windows Command Injection Vulnerability

Applies to

Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607 · fixed in 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 · fixed in 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
Windows 10 Version 1607 for 32-bit Systems · fixed in 10.0.14393.9612
Windows 10 Version 1607 for x64-based Systems · fixed in 10.0.14393.9612
Windows Server 2016 · fixed in 10.0.14393.9612
Windows Server 2016 (Server Core installation) · fixed in 10.0.14393.9612