Microsoft's July 2026 Patch Tuesday is here

Microsoft's July 14, 2026 Patch Tuesday update, delivered as KB5095093, is one of the more substantial summer releases for Windows 11 in some time, combining a headline recovery feature with the final stage of a year-long security overhaul for enterprise networks.

The standout addition is Point-in-time Restore, a new recovery tool that captures automatic system snapshots every 24 hours using the Volume Shadow Copy Service. It is enabled by default on Home and Pro editions with system drives of 200GB or larger. It lets users roll a PC back to a previous working state from the Windows Recovery Environment if a driver or update causes a failure. Restore points are retained for up to 72 hours by default.

Microsoft gives more control

Microsoft is also giving users more control over update timing. The Pause updates feature now uses a calendar interface instead of fixed 7, 14, or 21-day blocks, letting users pick an exact pause date up to 35 days out. A pause can be renewed as soon as it expires, giving users an effectively indefinite way to defer automatic updates. 

Other changes include Screen Tint, a new accessibility overlay that applies a color wash across the display to reduce eye strain, and quieter default behavior for Windows Widgets, which no longer open automatically on taskbar hover.

Kerberos RC4 retirement

On the enterprise side, this update marks the final phase of Microsoft's Kerberos RC4 retirement, tied to CVE-2026-20833. Domain controllers already stopped issuing RC4 tickets by default after April 2026 enforcement updates. July's update removes the RC4DefaultDisablementPhase registry key entirely, eliminating the temporary rollback option administrators had relied on. From here, RC4 will only work for accounts explicitly configured to allow it. IT teams that haven't already migrated legacy applications to AES encryption should expect authentication failures.

The release also includes the cumulative fix for CVE-2026-50656, known as RoguePlanet, a privilege-escalation flaw in the Microsoft Malware Protection Engine that Microsoft patched out of band on July 8 after a public proof-of-concept exploit surfaced. Windows 11 devices will receive the update automatically through Windows Update.