Known issues in Microsoft Patches:
Microsoft often releases patches to address security and reliability issues. Sometimes, patches itself will introduce unprecedented issues after installing them. Here's the updated list of all the known issues in Microsoft patches and possible workaround for them.
Oops! No results for your search.
workaround
May 18, 2026
KB5089549
2026-05 Cumulative Update for Windows 11, version 24H2 for x64-based Systems (KB5089549) (26100.8457)
"After you install this update (KB5089549), some devices might fail to complete installation with error code 0x800f0922. This issue occurs on devices that have limited free space on the EFI System Partition (ESP), especially if it has 10 MB or less available. What you might experience on affected devices: The update installs successfully during the initial phases. The installation fails during the restart phase at approximately 35-36% completion. Windows then rolls back the update. You may see the message: \"Something didn\'t go as planned. Undoing changes.\" The installation fails with error code 0x800f0922. As a result of this issue, you might see log entries similar to the following in C:\\Windows\\Logs\\CBS\\CBS.log, indicating insufficient free space on the EFI System Partition: SpaceCheck: Insufficient free space ServicingBootFiles failed. Error = 0x70 SpaceCheck: used by third-party/OEM files outside of Microsoft boot directories"
Affected customers can use one of the following workarounds to mitigate this issue. Option 1: Allow the update to install by modifying an ESP registry setting Important: Editing the registry incorrectly can cause serious system problems. Always back up the registry before making any changes. Open Command Prompt as an administrator. Run the following command: reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Bfsvc /v EspPaddingPercent /t REG_DWORD /d 0 /f\" Restart the affected device. Retry installing the update. Option 2: Mitigate the issue by using Known Issue Rollback (KIR) This issue is mitigated using Known Issue Rollback (KIR). The resolution has already propagated automatically to consumer devices and non-managed business devices. Restarting your Windows device might help the resolution apply more quickly. Enterprise-managed devices For devices where Windows updates are managed by IT departments, administrators can apply the mitigation by installing and configuring a special Group Policy. You can find the policy at Computer Configuration > Administrative Templates >. Group Policy download Windows 11, version 25H2 and Windows 11, version 24H2: KB5089549 260514_06221 Known Issue Rollback Important: You must install and configure the Group Policy that matches your version of Windows to resolve this issue. You must also restart affected devices to apply the policy. This Group Policy temporarily disables the change that causes the issue. For more information, seeHow to use Group Policy to deploy a Known Issue Rollback. A resolution is in progress and will be included in a future Windows update. This documentation will be updated once the resolution is available.
workaround
May 13, 2026
KB5087545
2026-05 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5087545)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070892 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
May 13, 2026
KB5087544
2026-05 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5087544)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive."
We are working on a resolution and will provide more information when it is available. To temporarily work around this issue, remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile.
workaround
May 13, 2026
KB5087545
2026-05 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5087545)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
May 13, 2026
KB5087539
2026-05 Cumulative Update for Microsoft server operating system version 24H2 for arm64-based Systems (KB5087539) (26100.32860)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
May 13, 2026
KB5087541
2026-05 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5087541)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070879 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
May 13, 2026
KB5087545
2026-05 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5087545)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
May 13, 2026
KB5087539
2026-05 Cumulative Update for Microsoft server operating system version 24H2 for arm64-based Systems (KB5087539) (26100.32860)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
May 13, 2026
KB5087420
2026-05 Cumulative Update for Windows 11, version 23H2 for arm64-based Systems (KB5087420)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
Apr 24, 2026
KB5082052
2026-04 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5082052)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5087420.
workaround
Apr 24, 2026
KB5082063
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5082063) (26100.32690)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5087539.
workaround
Apr 24, 2026
KB5091575
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5091575)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5087545.
workaround
Apr 24, 2026
KB5091575
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5091575)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Apr 24, 2026
KB5091575
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5091575)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
Apr 24, 2026
KB5091157
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5091157) (26100.32698)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5087539.
workaround
Apr 24, 2026
KB5091157
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5091157) (26100.32698)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Apr 24, 2026
KB5091157
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5091157) (26100.32698)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See Option 1 below.)"
Option 1: Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. Option 2: Apply the Known Issue Rollback (KIR) before installing the update A Known Issue Rollback (KIR) is available for customers who cannot remove the PCR7 group policy before deploying this update. The KIR prevents the automatic switch to the 2023 Boot Manager, avoiding the BitLocker recovery trigger. The KIR should be deployed before installing the update on affected devices. Contact Microsoft's Support for business to obtain this KIR. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
Apr 24, 2026
KB5083769
2026-04 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5083769) (26100.8246)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5083631.
workaround
Apr 24, 2026
KB5083768
2026-04 Cumulative Update for Windows 11, Version 26H1 for x64-based Systems (KB5083768) (28000.1836)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with."
This issue is addressed in KB5083806.
workaround
Apr 24, 2026
KB5083631
2026-04 Cumulative Update Preview for Windows 11 Version 24H2 for arm64-based Systems (KB5083631) (26100.8328)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
This issue is addressed in KB5089549. After installing KB5089549, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. If your device was impacted, Event ID 1032 will appear in the System event log when installing Windows updates: "The Secure Boot update Boot Manager (2023) was not applied due to a known incompatibility with the current BitLocker configuration." If you receive Event ID 1032, Microsoft strongly recommends removing the Group Policy configuration before installing updates so that you can install the 2023-signed Windows Boot Manager and continue to receive the latest Secure Boot protections. Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. If you do not wish to remove this Group Policy configuration, you can install the new Windows Boot Manager by temporarily suspending BitLocker and installing the Secure Boot update. To do this: Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command: Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update" Restart the device. Once the new Windows Boot Manager is successfully installed, enable BitLocker by running the command: manage-bde -protectors -enable C:
workaround
Apr 24, 2026
KB5082142
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5082142)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5087545.
workaround
Apr 20, 2026
KB5082142
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5082142)
"After installing this update, domain controllers in environments with multiple domains in the forest that use Privileged Access Management (PAM), might experience LSASS crashes during startup. As a result, affected domain controllers might restart repeatedly, preventing authentication and directory services from functioning, and potentially rendering the domain unavailable"
This issue is addressed in out-of-band update KB5091575. Note: If your Windows Server 2022 device is enrolled in hotpatching, you should instead install the OOB hotpatch update KB5091576. This hotpatch OOB update is released through Windows Update and does not require the device to restart.
workaround
Apr 20, 2026
KB5082063
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5082063) (26100.32690)
"After installing this update and restarting, domain controllers (DCs) in environments with multiple domains in the forest that use Privileged Access Management (PAM), might experience LSASS crashes during startup. As a result, affected domain controllers might restart repeatedly, preventing authentication and directory services from functioning, and potentially rendering the domain unavailable"
This issue is addressed in out-of-band update KB5091157. Note: If your Windows Server 2025 device is enrolled in hotpatching, you should instead install the OOB hotpatch update KB5091470. This hotpatch OOB update is released through Windows Update and does not require the device to restart.
workaround
Apr 20, 2026
KB5082063
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5082063) (26100.32690)
"A small number of devices might fail to install this update with one of the following error messages: "Install error - 0x800F0983" "Some update files are missing or have problems. We'll try to download the update again later. Error code: (0x80073712)"
This issue is addressed in out-of-band update KB5091157. Note: Hotpatch-enrolled Windows Server 2025 devices affected by this issue can install out-of-band update KB5091157 to receive the same protections as the April security update (KB5082063). However, installing KB5091157 requires a restart and pauses hotpatching. Hotpatch updates will resume after the July 2026 baseline update.
workaround
Apr 20, 2026
KB5082060
2026-04 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5082060)
"After installing this update, domain controllers in environments with multiple domains in the forest that use Privileged Access Management (PAM), might experience LSASS crashes during startup. As a result, affected domain controllers might restart repeatedly, preventing authentication and directory services from functioning, and potentially rendering the domain unavailable"
This issue is addressed in out-of-band update KB5091571.
workaround
Apr 15, 2026
KB5082063
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5082063) (26100.32690)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Apr 15, 2026
KB5082060
2026-04 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5082060)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070879 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Apr 15, 2026
KB5082142
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5082142)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Apr 15, 2026
KB5083769
2026-04 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5083769) (26100.8246)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
This issue is addressed in KB5089549. After installing KB5089549, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. If your device was impacted, Event ID 1032 will appear in the System event log when installing Windows updates: "The Secure Boot update Boot Manager (2023) was not applied due to a known incompatibility with the current BitLocker configuration." If you receive Event ID 1032, Microsoft strongly recommends removing the Group Policy configuration before installing updates so that you can install the 2023-signed Windows Boot Manager and continue to receive the latest Secure Boot protections. Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. If you do not wish to remove this Group Policy configuration, you can install the new Windows Boot Manager by temporarily suspending BitLocker and installing the Secure Boot update. To do this: Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command: Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update" Restart the device. Once the new Windows Boot Manager is successfully installed, enable BitLocker by running the command: manage-bde -protectors -enable C:
workaround
Apr 15, 2026
KB5082200
2026-04 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5082200)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profi"
Option 1: Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. Option 2: Apply the Known Issue Rollback (KIR) before installing the update A Known Issue Rollback (KIR) is available for customers who cannot remove the PCR7 group policy before deploying this update. The KIR prevents the automatic switch to the 2023 Boot Manager, avoiding the BitLocker recovery trigger. The KIR should be deployed before installing the update on affected devices. Contact Microsoft’s Support for business to obtain this KIR. Next steps A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
Apr 15, 2026
KB5082142
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5082142)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
Apr 15, 2026
KB5082063
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5082063) (26100.32690)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
Apr 15, 2026
KB5082052
2026-04 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5082052)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
Mar 11, 2026
KB5078752
2026-03 Cumulative Update for Windows 10 Version 1809 for x86-based Systems (KB5078752)
"After installing this update released on or after January 13, 2026, Japanese language installations of Windows Server 2019 might not correctly display Japanese characters in the PowerShell console."
Open the Command Prompt (cmd.exe) console. To do this, you can click Start, type cmd in the Search box, and then select cmd from the results. In the Command Prompt window, type powershell.exe and then press Enter. This opens a PowerShell console where this issue does not occur.
workaround
Mar 11, 2026
KB5078740
2026-03 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5078740) (26100.32522)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Mar 11, 2026
KB5078734
2026-03 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5078734)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070879 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Mar 11, 2026
KB5078766
2026-03 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5078766)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Feb 17, 2026
KB5075904
2026-02 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5075904)
"After installing this update released on or after January 13, 2026, Japanese language installations of Windows Server 2019 might not correctly display Japanese characters in the PowerShell console. This issue is caused by an unintended change to PowerShell encoding settings, which are incorrectly set to UTF-8 following the installation of the update. English language text can appear correctly, and commands can be entered as usual. However, Japanese output text appea"
Open the Command Prompt (cmd.exe) console. To do this, you can click Start, type "cmd" in the Search box, and then select cmd from the results. In the Command Prompt window, type powershell.exe and then press Enter. This opens a PowerShell console where this issue does not occur.
workaround
Feb 11, 2026
KB5075899
2026-02 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5075899)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Feb 11, 2026
KB5075897
2026-02 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5075897)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070879 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Feb 11, 2026
KB5075906
2026-02 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5075906)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Feb 4, 2026
KB5078135
2026-01 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5078135) (26100.32236)
"Windows Server Update Services (WSUS) does not display error details."
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Feb 4, 2026
KB5078133
2026-01 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5078133)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070879 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Feb 4, 2026
KB5078132
2026-01 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5078132)
"After installing this update, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts."
This issue is fully resolved in Windows updates released on February 10, 2026 (KB5075941), and in all updates released after that date. The update fixes the problem for devices that use Secure Launch and for devices Virtual Secure Mode (VSM) enabled. An earlier fix that helped some Secure Launch devices was first released through the Microsoft Update Catalog in an OOB update on January 17, 2026 (KB5077797), and later through Windows Update in another out‑of‑band update on January 24, 2026 (KB5078132).
workaround
Feb 4, 2026
KB5078127
2026-01 Cumulative Update for Windows 11, version 25H2 for x64-based Systems (KB5078127) (26200.7628)
"After installing the August 2025 non-security preview update (KB5064081) or later updates, you might notice that the password icon is not visible in the sign-in options on the lock screen. If you hover over the space where the icon should appear, you’ll see that the password button is still available. Select this placeholder to open the password text box and enter your password. After entering your password, you can sign in normally."
This issue is addressed in KB5074105.
workaround
Feb 4, 2026
KB5077797
2026-01 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5077797)
"After installing this update, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts. "
This issue will be addressed in a future Windows update. Additional information will be shared as soon as it becomes available.
workaround
Feb 4, 2026
KB5077797
2026-01 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5077797)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078132.
workaround
Feb 4, 2026
KB5077793
2026-01 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5077793) (26100.32234)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078135.
workaround
Feb 4, 2026
KB5077792
2026-01 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5077792)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078133.
workaround
Feb 4, 2026
KB5077792
2026-01 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5077792)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070879 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Feb 4, 2026
KB5077744
2026-01 Cumulative Update for Windows 11, version 25H2 for x64-based Systems (KB5077744) (26200.7627)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078127.
workaround
Feb 4, 2026
KB5077744
2026-01 Cumulative Update for Windows 11, version 25H2 for x64-based Systems (KB5077744) (26200.7627)
"After installing the August 2025 non-security preview update (KB5064081) or later updates, you might notice that the password icon is not visible in the sign-in options on the lock screen. If you hover over the space where the icon should appear, you’ll see that the password button is still available. Select this placeholder to open the password text box and enter your password. After entering your password, you can sign in normally."
This issue is addressed in KB5074105.
workaround
Feb 4, 2026
KB5078136
2026-01 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5078136)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Feb 4, 2026
KB5078131
2026-01 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5078131)
"After installing this update released on or after January 13, 2026, Japanese language installations of Windows Server 2019 might not correctly display Japanese characters in the PowerShell console. This issue is caused by an unintended change to PowerShell encoding settings, which are incorrectly set to UTF-8 following the installation of the update. English language text can appear correctly, and commands can be entered as usual. However, Japanese output text appea"
Open the Command Prompt (cmd.exe) console. To do this, you can click Start, type "cmd" in the Search box, and then select cmd from the results. In the Command Prompt window, type powershell.exe and then press Enter. This opens a PowerShell console where this issue does not occur.
workaround
Feb 4, 2026
KB5078131
2026-01 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5078131)
"After installing this update, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts. "
This issue is addressed in KB5075904.
workaround
Feb 4, 2026
KB5078129
2026-01 Cumulative Update for Windows 10 Version 22H2 for x64-based Systems (KB5078129) (ESU)
"After installing this update, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts. "
This issue is addressed in KB5075912.
workaround
Feb 4, 2026
KB5077800
2026-01 Cumulative Update Preview for Microsoft server operating system version 21H2 for x64-based Systems (KB5077800)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078136.
workaround
Feb 4, 2026
KB5077796
2026-01 Cumulative Update for Windows 10 Version 22H2 for x64-based Systems (KB5077796) (ESU)
"After installing this update, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts. "
This issue will be addressed in a future Windows update. Additional information will be shared as soon as it becomes available.
workaround
Feb 4, 2026
KB5077796
2026-01 Cumulative Update for Windows 10 Version 22H2 for x64-based Systems (KB5077796) (ESU)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078129.
workaround
Feb 4, 2026
KB5077795
2026-01 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5077795)
"After installing this update, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts. "
This issue will be addressed in a future Windows update. Additional information will be shared as soon as it becomes available.
workaround
Feb 4, 2026
KB5077795
2026-01 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5077795)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078131.
workaround
Feb 4, 2026
KB5074109
2026-01 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5074109) (26100.7623) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078127.
workaround
Feb 4, 2026
KB5073455
2026-01 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5073455) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078132.
workaround
Feb 4, 2026
KB5073450
2026-01 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5073450) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078133.
workaround
Feb 4, 2026
KB5073379
2026-01 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5073379) (26100.32230) (CVE-2023-31096) (CVE-2026-21265)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
If you are experiencing this issue, please contact the application developer for possible alternative methods of accessing the files. For Outlook-specific scenarios, moving the PST files out of OneDrive should resolve the issue. For guidance, please see documentation at How to remove an Outlook .pst data file from OneDrive. In addition, email accounts can still be accessed via webmail, if supported by your email provider.
workaround
Feb 4, 2026
KB5073724
2026-01 Cumulative Update for Windows 10 Version 22H2 for x64-based Systems (KB5073724) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265) (ESU)
"After installing this update, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts. "
This issue will be addressed in a future Windows update. Additional information will be shared as soon as it becomes available.
workaround
Feb 4, 2026
KB5073724
2026-01 Cumulative Update for Windows 10 Version 22H2 for x64-based Systems (KB5073724) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265) (ESU)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078129
workaround
Feb 4, 2026
KB5073723
2026-01 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5073723) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing this update, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts. "
This issue will be addressed in a future Windows update. Additional information will be shared as soon as it becomes available.
workaround
Feb 4, 2026
KB5073723
2026-01 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5073723) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078131.
workaround
Feb 4, 2026
KB5073457
2026-01 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5073457) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. In certain Outlook configurations that store PST files on OneDrive, Outlook may hang and fail to reopen unless the process is terminated or the system is restarted. Users may also see missing sent Items or previously downloaded emails being re?downloaded."
This issue is addressed in KB5078136.
workaround
Jan 18, 2026
KB5077793
2026-01 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5077793) (26100.32234)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Jan 18, 2026
KB5077792
2026-01 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5077792)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070879 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Jan 18, 2026
KB5077800
2026-01 Cumulative Update Preview for Microsoft server operating system version 21H2 for x64-based Systems (KB5077800)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Jan 18, 2026
KB5074109
2026-01 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5074109) (26100.7623) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing the January 2026 security update (KB5074109), released on January 13, 2026, credential prompt failures occurred during Remote Desktop connections using the Windows App on Windows client devices, impacting Azure Virtual Desktop and Windows 365. The issue affects Windows App on specific Windows builds, causing sign-in failures."
This issue is addressed in KB5077744.
workaround
Jan 18, 2026
KB5073455
2026-01 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5073455) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing this update, some PCs with Secure Launch are unable to shut down or enter hibernation. Instead, the device restarts. "
This issue is addressed in KB5077797.
workaround
Jan 18, 2026
KB5073455
2026-01 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5073455) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing the January 2026 security update (KB5073455), released on January 13, 2026, credential prompt failures occurred during Remote Desktop connections using the Windows App on Windows client devices, impacting Azure Virtual Desktop and Windows 365. The issue affects Windows App on specific Windows builds, causing sign-in failures."
This issue is addressed in KB5077797.
workaround
Jan 18, 2026
KB5073724
2026-01 Cumulative Update for Windows 10 Version 22H2 for x64-based Systems (KB5073724) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265) (ESU)
"After installing this security update, credential prompt failures occurred during Remote Desktop connections using the Windows App on Windows client devices, impacting Azure Virtual Desktop and Windows 365. The issue affects Windows App on specific Windows builds, causing sign-in failures."
This issue is resolved in Windows updates released on and after January 17, 2026 (such as KB5077796). We recommend you install the latest Windows update for your device as it contains important improvements and issue resolutions, including this one.
workaround
Jan 18, 2026
KB5073723
2026-01 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5073723) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing this security update, credential prompt failures occurred during Remote Desktop connections using the Windows App on Windows client devices, impacting Azure Virtual Desktop and Windows 365. The issue affects Windows App on specific Windows builds, causing sign-in failures."
This issue is resolved in Windows updates released on and after January 17, 2026 (such as KB5077795). We recommend you install the latest Windows update for your device as it contains important improvements and issue resolutions, including this one.
workaround
Jan 18, 2026
KB5073379
2026-01 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5073379) (26100.32230) (CVE-2023-31096) (CVE-2026-21265)
"After installing the January 2026 security update (KB5073379), released on January 13, 2026, credential prompt failures occurred during Remote Desktop connections using the Windows App on Windows client devices, impacting Azure Virtual Desktop and Windows 365. The issue affects Windows App on specific Windows builds, causing sign-in failures."
This issue is addressed in KB5077793.
workaround
Jan 18, 2026
KB5073450
2026-01 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5073450) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing the January 2026 security update (KB5073450), released on January 13, 2026, credential prompt failures occured during Remote Desktop connections using the Windows App on Windows client devices, impacting Azure Virtual Desktop and Windows 365. The issue affects Windows App on specific Windows builds, causing sign-in failures."
This issue is addressed in KB5077792.
workaround
Jan 18, 2026
KB5073457
2026-01 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5073457) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing the January 2026 security update (KB5073457), released on January 13, 2026, credential prompt failures occured during Remote Desktop connections using the Windows App on Windows client devices, impacting Azure Virtual Desktop and Windows 365. The issue affects Windows App on specific Windows builds, causing sign-in failures."
This issue is addressed in KB5077800.
workaround
Jan 18, 2026
KB5073695
2026-01 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB5073695) (CVE-2023-31096) (ESU)
"After installing updates released January 11, 2022 or later updates, apps using Microsoft .NET Framework to acquire or set Active Directory Forest Trust Information might fail, close, or you might receive an error from the app or Windows. You might also receive an access violation (0xc0000005) error."
To resolve this issue manually, apply the out-of-band updates for the version of .NET Framework used by the app.
workaround
Jan 18, 2026
KB5073695
2026-01 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB5073695) (CVE-2023-31096) (ESU)
"After installing this update on domain controllers (DCs), affected versions of Windows Server might restart unexpectedly."
This issue is resolved in KB5010794.
workaround
Jan 18, 2026
KB5073695
2026-01 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB5073695) (CVE-2023-31096) (ESU)
"After installing this update on a device by using Unified Extensible Firmware Interface (UEFI), virtual machines (VMs) in Hyper-V might not start."
This issue is resolved in KB5010794.
workaround
Jan 18, 2026
KB5073695
2026-01 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB5073695) (CVE-2023-31096) (ESU)
"Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)â€. This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege."
Do one of the following: Perform the operation from a process that has administrator privilege. Perform the operation from a node that doesn’t have CSV ownership. Microsoft is working on a resolution and will provide an update in an upcoming release.
workaround
Jan 14, 2026
KB5073457
2026-01 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5073457) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Jan 14, 2026
KB5073450
2026-01 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5073450) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070879 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Jan 14, 2026
KB5073379
2026-01 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5073379) (26100.32230) (CVE-2023-31096) (CVE-2026-21265)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Jan 14, 2026
KB5074109
2026-01 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5074109) (26100.7623) (CVE-2023-31096) (CVE-2026-20805) (CVE-2026-21265)
"After installing the August 2025 non-security preview update (KB5064081) or later updates, you might notice that the password icon is not visible in the sign-in options on the lock screen. If you hover over the space where the icon should appear, you’ll see that the password button is still available. Select this placeholder to open the password text box and enter your password. After entering your password, you can sign in normally."
This issue is mitigated using Known Issue Rollback (KIR). For enterprise-managed devices managed by IT departments that have installed the affected update and encountered this issue, IT administrators can resolve it by installing and configuring the Group policy.
Disclaimer:This webpage is intended to provide you information about patch announcement for certain specific software products. The information is provided "As Is" without warranty of any kind. The links provided point to pages on the vendors websites. You can get more information by clicking the links to visit the relevant pages on the vendors website.