Windows 10 KB5099539 ESU Update Has a Networking Catch

Microsoft shipped KB5099539 on July 14, 2026, the July Patch Tuesday cumulative update for Windows 10, and this one reaches only PCs paying into the Extended Security Updates program that opened after the operating system hit end of support last November. It moves 22H2 and 21H2 machines to OS Build 19045.7548, fixes an OLE Automation regression that a June update introduced, and hardens Secure Boot and Remote Desktop. The catch most coverage buries: a new networking rule can silently break applications that route sockets over unregistered third-party TDI transports.

• KB5099539 is Windows 10's July 2026 security rollup, delivered only to devices enrolled in the paid Extended Security Updates (ESU) program.
• It patches a June 2026 OLE Automation regression in oleaut32.dll that could make COM automation calls using BYREF parameters fail.
• A security hardening change enforces TDI transport registration, so apps that use unregistered third-party TDI transports might stop working.
• Consumers can enroll in ESU free by syncing PC settings or with 1,000 Microsoft Rewards points, or pay a one-time $30 that covers up to 10 devices.

What exactly is inside KB5099539?

Four things stand out. Windows Security now shows a live Secure Boot status, and Microsoft expanded which devices are eligible to receive the newer Secure Boot certificates rolling out over Windows Update. The update fixes a compatibility bug in OLE Automation that a June 2026 security update had introduced, where applications calling COM methods through IDispatch::Invoke with BYREF parameters that share the same underlying storage could hit marshaling errors or failed automation calls. Remote Desktop gains support for SHA-2 certificate thumbprints for trusted publishers, with Microsoft signaling that SHA-1 will eventually be removed, plus new Group Policy controls for which .rdp files users can open. Microsoft also released parallel rollups for older branches: KB5099538 lifts version 1809 to build 17763.9020 with its own Remote Desktop, File Explorer, and OLE fixes.

RelatedRolldown 1.0 Lands in Vite 8: One Rust Bundler to Rule Them

Why is this update locked behind ESU?

Because Windows 10 reached end of support on November 14, 2025, and Microsoft no longer ships free security updates, bug fixes, features, or technical help for it. The Extended Security Updates program is the paid, security-only lifeline that keeps critical and important patches flowing, defined by the Microsoft Security Response Center, for devices on Windows 10 version 22H2. ESU does not restore feature updates or support; it exists purely to reduce malware and attack risk on machines that cannot or will not move to Windows 11. To qualify, a device needs to run a 22H2 edition (Home, Pro, Pro Education, or Workstation), have the latest updates installed, and sign in with an administrator Microsoft account. Only then does the enroll link appear under Settings, Update and Security, Windows Update.

What is the TDI change that could break apps?

TDI stands for Transport Driver Interface, a legacy kernel-mode networking interface that older security tools, VPN clients, and traffic filters sometimes hook into. KB5099539 introduces a security hardening change that enforces TDI transport registration requirements, and the practical effect is blunt: applications that push sockets over an unregistered third-party TDI transport might stop working after the update installs. Registered transports are unaffected. This is the kind of change that will not touch most home PCs at all, then quietly take down a niche endpoint agent or a corporate VPN filter on the machines that do rely on it. If your Windows 10 fleet runs older network drivers, this single line in the release notes is the reason to stage the update before pushing it everywhere.

Who is affected, and what should they do?

Anyone still running Windows 10 who wants patches. For consumers that means enrolling through the built-in flow, then installing KB5099539 from Windows Update or pulling it from the Microsoft Update Catalog. For businesses it means Extended Security Updates through Volume Licensing at $61 per device for the first year, with the important catch that ESU pricing is cumulative: buy in during Year Two and you still owe Year One. The action item for administrators is not the install itself but the TDI hardening. Inventory the machines running third-party networking or endpoint drivers, test KB5099539 on a pilot ring, and confirm those agents still connect before a broad rollout.

RelatedDeno 2.7 Lands Temporal, Windows ARM, and Deploy GA

1. Nov 14, 2025Windows 10 reaches end of support free updates stop
2. Late 2025ESU enrollment opens for consumers and business paid, security only
3. June 2026A security update introduces the OLE Automation regression BYREF calls fail
4. Jul 14, 2026KB5099539 ships, build 19045.7548 fixes OLE, adds TDI hardening
5. 2027 onwardESU winds down and pressure to move to Windows 11 grows the lifeline is temporary

Our take

KB5099539 is a reminder that Windows 10 is not dead, it is on life support, and the bill is now itemized. The Secure Boot and Remote Desktop work is quietly good hygiene, and fixing the June OLE regression is overdue. But the TDI hardening is the story: Microsoft is tightening a decades-old networking interface, and the machines most likely to break are exactly the ones businesses kept on Windows 10 to avoid disruption. That irony is the whole ESU era in one update. If you are paying to stay, treat every one of these monthly rollups as a change to test, not a routine to trust, because the security work that justifies the fee is the same work that can knock a legacy driver offline.

Original analysis by GenZTech. Reporting informed by Microsoft support documentation.