Medium cybersecurity update: Windows 11 KB5120998 update released with 35 changes and fixes. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
Microsoft released the KB5120998 preview cumulative update for Windows 11 versions 25H2 and 24H2, which comes with 35 changes, including improvements to the Start menu, taskbar, and Windows search. […] Windows 11 KB5120998 update released with 35 changes and fixes Microsoft released the KB5120998 preview cumulative update for Windows 11 versions 25H2 and 24H2, which comes with 35 changes, including improvements to the Start menu, taskbar, and Windows search. KB5120998 is a preview update that lets IT administrators test Windows bug fixes, improvements, and new features before they roll out to all users during next month's Patch Tuesday release. However, unlike cumulative updates, monthly optional updates do not include security fixes and provide only quality improvements. After installing the August 2026 preview update, users can move the taskbar to the bottom, top, left, or right side of their screen in Settings > Personalization > Taskbar > Taskbar behaviors > Taskbar position, with most customization settings, like never combining taskbar icons, working in every position. With KB5120998, Microsoft has also started rolling out the administrator protection security feature that allows users to perform admin tasks using just-in-time privileges. "Administrator protection is not classified as a formal security boundary; it hardens the security against elevation-of-privilege attacks with the introduction of profile separation," Microsoft said. "This feature is turned off by default and can be enabled using OMA-URI in Microsoft Intune or through Group Policy." You can install KB5120998 by opening Windows Settings , clicking on Windows Update, and then clicking 'Check for Updates .' Since this is an optional update, you will need to click the "Download and install" link unless you already have the "Get the latest updates as soon as they're they're available" option enabled, which prompts the OS to install it automatically.
Technical Details
You can also manually download and install the KB5120998 preview update from the Microsoft Update Catalog . Once installed, this optional non-security update will upgrade Windows 11 25H2 and 24H2 devices to builds 26200.9278 and 26100.9278, respectively. The August 2026 preview update comes with many other changes, some of the more important ones highlighted below: Windows now automatically indexes your most-used folders so those files appear in subsequent search results. You can control the setting at Settings > Privacy & Security > Search > Automatically find additional relevant locations. This update improves restart behavior so PCs that were manually put to sleep return to sleep after completing an update, even when automatic sleep is set to Never. This update adds support for participating apps to coordinate their updates with Windows Update. Supported apps can benefit from improved scheduling and a more streamlined update experience. For more information, see Windows Update Orchestration Platform (UOP). This update improves resiliency and recovery from potential VPN process-related background issues that can cause processes to stop responding.
Security Impact
Organizations using the affected technology should treat the report according to its medium severity classification. Starting in August 2026, Windows 11, version 24H2 and 25H2 will no longer include the Windows Management Instrumentation Command-line (WMIC) utility. WMIC is already removed by default in new installations of Windows 11, versions 24H2 and 25H2, and will no longer be available as a Feature on Demand (FoD). On Thursday, Microsoft warned customers that their systems may reboot one more time after deploying the August 2026 optional update and updates rolling out over the next several months. "With recent and upcoming Windows updates over the next few months, a limited number of consumer and business devices might experience one additional restart during installation," Microsoft noted in a message center update. "This one‑time restart occurs after a Secure Boot certificate update is applied as part of the Secure Boot update process." Earlier this month, it also reminded customers that devices running Home and Pro editions of Windows 11 24H2 will stop receiving updates in two months. However, Windows 11 24H2 Enterprise and Education editions will remain under mainstream support until October 2027. Users are advised to upgrade to Windows 11 25H2 (also known as the Windows 11 2025 Update), which became generally available in September 2024.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: Medium
- Original source: BleepingComputer
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from BleepingComputer for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
