KB5099546: Safe OS Dynamic Update for Windows Server 2025: July 14, 2026

Applies To
Windows Server 2025

Summary

This update makes improvements to the Windows recovery environment (WinRE).

The following is a summary of the issues that this update addresses when you install this update. The bold text within the brackets indicates the item or area of the change we are documenting.

  • [Input] This update changes hotkey unregister and cleanup behavior. In rare cases, some built-in Windows experiences that rely on previous hotkey lifecycle behavior might temporarily stop responding to certain keyboard shortcuts. This issue can typically be resolved by restarting the app affected. If the issue is not resolved, report it through the Feedback Hub.
  • [OLE Automation (known issue)] Fixed: Addresses a compatibility issue in OLE Automation (oleaut32.dll) that was introduced by the June 2026 security update. Some applications that use the IDispatch::Invoke method to call COM methods with BYREF parameters that share the same underlying storage might fail. These failures can include parameter marshaling errors or automation call failures. This update corrects how parameter ownership is managed and restores expected application behavior.

How to get this update

Install this update

To install this update, use one of the following release channels.


Available Next step
Available This update is available through Windows Update. It will be downloaded and installed automatically.

About this update

Information Details
Prerequisites There are no prerequisites to apply this update.
Restart information You do not have to restart your device after you apply this update.
Removal information This update cannot be removed once it is applied to a Windows image.
Update replacement information This update replaces the previously released update KB5094150.
Verify the installation of this update After installing this update, the WinRE version installed on the device should be 10.0.26100.33158. To find the WinRE version installed, see Methods to verify the WinRE version installed.
File information A list of the files that are included in this update are provided in a CSV (Comma delimited) (*.csv) file. The file can be opened in a text editor such as Notepad or in Microsoft Excel.

Note: The English (United States) version of this software update might contain files for additional languages.

Download Icon Download the file information for update KB5099546.

References

Description of the standard terminology that is used to describe Microsoft software updates

Note

  • Windows Secure Boot certificate expiration
  • Important: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices for the past months. Devices that haven’t received the newer certificates will continue to start and operate normally, and standard Windows updates will continue to install. We will continue to install the newer certificates via Windows updates in the coming months.
  • You can check your PC status on the Windows Security app. If you are an IT administrator, follow the guidance on the Secure Boot Playbook for Windows clients and Windows Server.

Query words: safeos du