Skip to the content
The Update Bureau
Windows 11 24H2 Windows 11 24H2 Out-of-band update
Out-of-band

KB5064489

KB5064489: Cumulative update for Windows 11, version 24H2, July 2025. Azure VM startup issue addressed; Secure Boot certificate warning

In short

Addresses a startup issue affecting some Azure virtual machines with VBS enabled. Secure Boot certificates for most Windows devices began expiring in June 2026, which might affect secure boot if they are not updated in time.

Does it affect you? Applies to: Devices running Windows 11, version 24H2. The startup issue affects some Azure standard, non–Trusted Launch General Enterprise virtual machines on older VM SKUs.

Build
26100.4656
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • In detail KB5064489 also includes the security fixes and improvements from the July 8, 2025 update, KB5062553.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fix 1 change

Azure Virtual Machines

Verified in package

For: Some Azure standard, non–Trusted Launch General Enterprise VMs on older VM SKUs

  • The update addresses a problem that prevented some Azure virtual machines from starting when VBS was enabled.1
    The issue affected VMs using version 8.0, a non-default version, where VBS was offered by the host. In Azure, this applies to standard non–Trusted Launch General Enterprise VMs running on older VM SKUs; the cause was a secure kernel initialization issue.

Improvement 1 change

Servicing stack

  • The component that installs Windows updates is improved to help devices receive and install updates reliably.2
    Includes servicing stack update KB5063666, build 26100.4651.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-07-13
Classification
Updates
Type
Cumulative update
Restart
Required
Replaces
KB5062553, KB5060829, KB5063060, KB5060842
+25 earlier KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5063878
VersionBuildChannel
24H2 26100.4656 General availability

Security

No vulnerabilities are listed for this update.

Updated components

144 files changed since the previous update for the same versions.

Top changed componentsFiles
Kernel3
File Explorer and shell2
Graphics and display2
Hyper-V and virtualization2
Secure Boot2
Printing1

Verified in package: changed files confirm Azure Virtual Machines.

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. This update addresses an issue that prevented some virtual machines (VMs) from starting when Virtualization-Based Security (VBS) was enabled. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake