Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5037771

KB5037771: Cumulative update for Windows 11, version 23H2, May 2024. Exploited MSHTML and DWM flaws patched; VPN failures addressed

In short

The update patches 45 vulnerabilities, including two actively exploited flaws in MSHTML and DWM Core Library. It also addresses VPN connection failures and slow SMB transfers.

Does it affect you? Applies to: Devices running Windows 11, versions 22H2 and 23H2. The page lists improvements for both versions.

Build
22631.3593
Security
45 fixed · 2 exploited
Restart
Required
Review notes Additional details from the official release notes (3) Read notes
  • What changes The issue concerns domain controllers, where NTLM authentication traffic might increase.
  • What changes The issue can affect Virtual Secure Mode scenarios including VPN, Windows Hello, Credential Guard, and Key Guard.
  • What changes SMB clients might fail to make SMB Multichannel connections, making file transfers slow.

The official sources are linked at the end of the page.

What changes

Fixes 4 changes

VPN

  • VPN connection failures after installing the update dated April 9, 2024, or later are addressed.1
    Addresses a known issue that might cause VPN connections to fail.

Domain controllers

  • NTLM authentication traffic might increase on domain controllers; this issue is addressed.2
    Addresses an issue that might affect domain controllers (DC).

Virtual Secure Mode

For: Devices using VSM scenarios

  • VPN, Windows Hello, Credential Guard, and Key Guard scenarios using Virtual Secure Mode might fail; this issue is addressed.3
    Addresses issues affecting Virtual Secure Mode (VSM) scenarios.

SMB clients

  • SMB clients can make SMB Multichannel connections again, avoiding the slow file transfers caused by connection failures.4
    Addresses SMB Multichannel connection failures that occur after installing KB5036980. Event ID 30826 appears for Microsoft-Windows-SMBClient/Connectivity in the Windows Event Log.

Improvement 1 change

Servicing stack

  • The component that installs Windows updates receives quality improvements.5
    Includes servicing stack update versions 22621.3522 and 22631.3522.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5040527

    After installing this update or later updates, you might face issues while upgrading from Windows Pro to a valid Windows Enterprise subscription.Resulting from this operation, you might observe the f…

    Upgrading from Windows Pro to a valid Enterprise subscription might fail. The LicenseAcquisition scheduled task's “Last Run Result” might show “Access denied error (error code 0x80070005).” KB5040527 addresses this issue.6

    Resolution Fixed in KB5040527

    Install KB5040527 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Everyone Resolved by KB5037853

    After installing this update, you might be unable to [change your user account profile picture](https://support.microsoft.com/en-us/windows/change-your-account-picture-3645cdc7-acab-49d2-76a9-4ce7e5e…

    Changing your user account profile picture might fail with error 0x80070520. KB5037853 addresses this issue.7

    Resolution Fixed in KB5037853

    Install KB5037853 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-05-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5036980, KB5036893, KB5035942, KB5035853
+4 earlier KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5039212
VersionBuildChannel
23H2 22631.3593 General availability

Security

45 vulnerabilities fixed
2 exploited 44 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2024-30040 Exploited
Windows MSHTML Platform Security Feature Bypass Vulnerability
 Important 8.8
CVE-2024-30051 Exploited
Windows DWM Core Library Elevation of Privilege Vulnerability
 Important 7.8

The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 45 vulnerabilities →

Updated components

650 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display24
Security and sign-in15
Remote Desktop12
Hyper-V and virtualization10
Networking10
Kernel7
File Explorer and shell4
Settings4
Storage and file systems4
Bluetooth2
Secure Boot1

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. This update addresses a known issue that might cause your VPN connection to fail. This occurs after you install the update dated April 9, 2024, or later. support.microsoft.com
  2. 2. This update addresses an issue that might affect domain controllers (DC). NTLM authentication traffic might increase. support.microsoft.com
  3. 3. This update addresses an issue that might affect Virtual Secure Mode (VSM) scenarios. They might fail. These scenarios include VPN, Windows Hello, Credential Guard, and Key Guard. support.microsoft.com
  4. 4. This update addresses an issue that affects Server Message Block (SMB) clients. They fail to make SMB Multichannel connections. Because of this, file transfers are slow. support.microsoft.com
  5. 5. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  6. 6. This issue is addressed in [KB5040527] support.microsoft.com
  7. 7. This issue is addressed in [KB5037853] support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake