Microsoft has published two new Important-rated security advisories for the Windows version of Intune Remote Help and says customers need to update the app. The fixed release is Remote Help 5.2.1040.0. This is a product-specific security update for organizations that use Microsoft Intune Remote Help—not a new Windows cumulative update, Patch Tuesday release, preview update, or Insider build.
Windows Remote Help: update to 5.2.1040.0 or later
Microsoft lists one spoofing vulnerability and one denial-of-service vulnerability. Both require an authorized attacker with local access, and Microsoft says neither was publicly disclosed nor known to be exploited when the advisories were published.
Reporting cutoff: August 20, 2026 at 7:00 p.m. EDT (23:00 UTC).
What Microsoft disclosed today
Windows Remote Help spoofing
Microsoft describes an uncontrolled search-path issue that could let an authorized local attacker perform spoofing. It is rated Important.
CVSS 7.1
Attack vector: local • privileges required: low • user interaction: none • exploitation assessed as less likely.
Windows Remote Help denial of service
A second uncontrolled search-path issue could let an authorized local attacker disrupt the Remote Help app. It is also rated Important.
CVSS 5.5
Attack vector: local • privileges required: low • user interaction: none • exploitation assessed as less likely.
Microsoft marks customer action required for both records. The common vendor fix is Remote Help 5.2.1040.0. The Microsoft Update Catalog lists that package as a 7.5 MB update, says it replaces version 5.2.1037.0, requires no restart, and should not request user input.
Who is affected—and who is not?
Phone readers: swipe the table left to see every column.
| Environment | Likely status | What to check |
|---|---|---|
| Business using Microsoft Intune Remote Help on Windows | Affected if an older app build is installed | Inventory helper and sharer devices; require version 5.2.1040.0 or later. |
| Managed Windows PC that does not have Remote Help installed | Not affected by these two product-specific records | Confirm through Intune app inventory or Installed apps rather than assuming. |
| Home PC using Windows Update only | Usually not affected | Look under Settings → Apps → Installed apps for “Remote Help.” |
| Windows Quick Assist user | Not named in these advisories | Do not confuse Quick Assist with the paid Intune Remote Help product. |
| Mac using Apple Remote Desktop, Screen Sharing, or another support tool | Not affected by these Windows Remote Help CVEs | Continue checking updates for the actual remote-support product you use. |
What home users should do
- Open Settings → Apps → Installed apps and search for Remote Help.
- If it is not installed, these two advisories do not require you to add it or change Windows settings.
- If it is present on a work-managed computer, leave the device online and contact your organization’s IT team before uninstalling anything.
- Do not accept unsolicited remote-support sessions. A legitimate technician should identify the organization, explain the session, and obtain your consent.
What businesses and IT teams should do
- Inventory both sides of the session. Check helper devices and user devices that can launch the native Windows Remote Help app.
- Set 5.2.1040.0 as the minimum accepted build. Verify the version through Intune application inventory or the app’s entry in Installed apps. Do not treat a successful deployment command as proof that every endpoint updated.
- Pilot, then deploy broadly. Test sign-in, screen sharing, elevation prompts, remote launch, and session closure on a representative device before organization-wide enforcement.
- Confirm the result. Re-query inventory after deployment and investigate devices that remain below the fixed version.
- Review Remote Help controls. Microsoft documents Entra sign-in, role-based access control, Conditional Access, compliance warnings, and session reporting. Require MFA for helpers where practical and keep elevation rights tightly scoped.
- Review sessions if you suspect abuse. Intune can report who helped whom, on which device, and for how long. Preserve relevant audit records before making changes.
Good news
- Microsoft says exploitation is less likely.
- No public disclosure or active exploitation was listed at the cutoff.
- The catalog says the update does not require a restart.
- The affected product scope is specific, making inventory-based remediation practical.
Cautions
- Microsoft explicitly marks customer action as required.
- Remote-support tools occupy a high-trust path between helpers and user devices.
- A local, authorized attack requirement reduces exposure but does not make the flaws harmless.
- Unmanaged or rarely connected endpoints can miss app deployments.
How this differs from the August Windows update
The August Windows security cumulative updates were released on August 11, 2026. Microsoft’s Windows 11 release information still lists that “B” release as the latest production OS update at this cutoff—for example, KB5121003 with builds 26200.9168 for Windows 11 25H2 and 26100.9168 for 24H2. Today’s Remote Help disclosure does not create a new Windows OS KB for ordinary home PCs.
For broader operating-system context, see our complete August 2026 Microsoft Patch Tuesday guide. If you are troubleshooting the separate Windows 11 game-crash reports tied to the August cumulative update, use our practical KB5121003 game-crash guide.
Apple check: no same-day macOS security release
Apple’s official security-release table showed no new macOS, Safari, Rapid Security Response, or Background Security Improvement dated August 20 at our cutoff. The newest Mac-related security listing was Safari 26.6.1 for Sonoma and Sequoia on August 18; the newest macOS listing was macOS Tahoe 26.6.2 on August 17. Apple’s Developer releases page most recently listed macOS 27.0 beta 6 on August 17, which is a beta—not a production security update.
FAQ
Is this an actively exploited zero-day?
No. Microsoft’s exploit-status fields said Publicly Disclosed: No, Exploited: No, and exploitation less likely at the reporting cutoff.
Does installing the regular August Windows update fix Remote Help?
Do not assume so. Microsoft identifies a separate Remote Help app build—5.2.1040.0—as the vendor fix. Verify the app version itself.
Do I need to reboot?
The Microsoft Update Catalog says the Remote Help 5.2.1040.0 package never restarts the computer. Your organization may still schedule a maintenance window to test the complete support workflow.
Should I uninstall Remote Help?
Usually not if your organization relies on it. Update first, verify the fixed build, and use Intune controls to limit who can help, who can receive help, and when elevation is allowed. Uninstalling without coordination can remove a needed support channel.
Is Quick Assist the same thing?
No. Quick Assist and Microsoft Intune Remote Help are separate products. These two CVE records name Windows Remote Help as the affected product.
Official sources
- Microsoft Security Response Center: CVE-2026-55013
- Microsoft Security Response Center: CVE-2026-55015
- Microsoft Update Catalog: Remote Help 5.2.1040.0
- Microsoft Learn: Use Remote Help with Microsoft Intune
- Microsoft: Windows 11 release information
- Apple security releases
- Apple Background Security Improvements by date
- Apple Developer software releases
Need help checking managed Windows PCs?
The IT Guys can help Treasure Coast homes and small businesses identify the software actually installed, verify update status, and tighten remote-support access without breaking a working help-desk process. Schedule an appointment or call (772) 288-3022.