KB5091573 — Out-of-band Security Update for Windows 10 Version 1809

Overview

KB5091573 is a critical out-of-band security update released by Microsoft on April 19, 2026, specifically targeting Windows 10 Version 1809 (October 2018 Update). This update addresses multiple high-severity vulnerabilities that have been actively exploited in targeted attacks, prompting Microsoft to release the update outside the regular monthly Patch Tuesday schedule.

The update elevates the OS build number to 17763.8647 and includes comprehensive security fixes across multiple Windows components, including the kernel, network stack, and application control mechanisms. Due to the critical nature of the addressed vulnerabilities, Microsoft strongly recommends immediate deployment across all affected systems.

Security Vulnerabilities Addressed

This cumulative update resolves five critical security vulnerabilities that pose significant risks to system security:

CVE-2026-28301: Windows Kernel Privilege Escalation

A critical vulnerability in the Windows kernel allows local attackers to escalate privileges from standard user to SYSTEM level. The flaw exists in memory allocation routines where improper bounds checking enables buffer overflow conditions. Successful exploitation grants attackers complete control over the affected system.

CVE-2026-28302: Windows Defender Application Control Bypass

This vulnerability allows attackers to circumvent Windows Defender Application Control (WDAC) policies through specially crafted executable files. The bypass technique exploits weaknesses in code integrity verification, potentially allowing unauthorized applications to execute on protected systems.

CVE-2026-28303: Remote Code Execution in TCP/IP Stack

A critical remote code execution vulnerability in the Windows TCP/IP implementation can be exploited through malicious network packets. No user interaction is required for exploitation, making this vulnerability particularly dangerous for internet-facing systems.

CVE-2026-28304: DLL Hijacking Vulnerabilities

Multiple DLL hijacking vulnerabilities allow attackers to execute arbitrary code by placing malicious DLL files in specific locations. These vulnerabilities affect various Windows components and can be exploited during application startup or system service initialization.

Technical Implementation Details

The security fixes implemented in KB5091573 include:

Kernel Hardening

Enhanced memory protection mechanisms prevent exploitation of buffer overflow conditions in kernel space. The update implements Control Flow Integrity (CFI) enhancements and strengthens Address Space Layout Randomization (ASLR) for kernel components.

Network Stack Security

Improved packet validation routines prevent malformed network packets from triggering memory corruption. The update also enhances the Windows Filtering Platform (WFP) to provide better protection against network-based attacks.

Code Integrity Improvements

Strengthened signature verification processes ensure that only properly signed code can bypass application control policies. The update also implements additional validation checks for dynamically loaded libraries.

Deployment Considerations

Enterprise Deployment

Enterprise administrators should prioritize deployment of this update due to its critical security nature. The update can be deployed through existing patch management infrastructure including WSUS, SCCM, and Microsoft Intune.

Testing Requirements

While this is a critical security update, organizations should conduct limited testing in non-production environments to identify potential compatibility issues with line-of-business applications.

Rollback Procedures

The update can be uninstalled through Windows Update history if critical compatibility issues arise. However, uninstalling the update leaves systems vulnerable to the addressed security threats.

Verification and Validation

After installation, administrators can verify successful deployment using the following methods:

PowerShell Verification

Get-HotFix -Id KB5091573
Get-ComputerInfo | Select-Object WindowsVersion, WindowsBuildLabEx

Registry Verification

Check the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion to confirm the build number shows 17763.8647.

Event Log Verification

Review the System event log for Event ID 19 from source "Microsoft-Windows-WindowsUpdateClient" confirming successful installation.