Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday

KB5065429

KB5065429: Cumulative update for Windows 10, versions 21H2 and 22H2, September 2025. SMB hardening support added; SMBv1 connections may fail

In short

Adds support for SMB hardening and fixes problems with MSI repairs and NDI streaming. SMBv1 file sharing might fail until a later update is installed.

Does it affect you? Applies to: This update applies to Windows 10, version 22H2 (all editions), and version 21H2 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021. Windows 10 support ended on October 14, 2025; Microsoft no longer provides free updates, technical assistance, or security fixes.

Builds
19044.6332 · 19045.6332
Security
49 fixed · 8 critical
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What to do For offline images, KB5031539 is required only if the image lacks KB5028244 or a later LCU. For WSUS or Catalog installs, KB5005260 is required only if the device lacks KB5003173 or a later LCU.

The official sources are linked at the end of the page.

What changes

Fixes 2 changes

App compatibility (known issue)

For: Non-admin users and IT administrators

  • Some non-admin users see fewer unexpected permission prompts during MSI app installs or repairs. The change can help apps such as Office Professional Plus 2010 and Autodesk apps run.1
    Reduces the scope of unexpected User Account Control (UAC) prompts for MSI custom actions. IT administrators can add specific apps to an allowlist to disable UAC prompts for them.

WinSock

Verified in package
  • Audio and video streaming or transfers between PCs might no longer have delays or uneven performance when using NDI.1
    Fixes the issue reported after KB5063709 when using Network Device Interface (NDI) to stream or transfer feeds between PCs.

Improvement 1 change

Servicing stack

  • The component that installs Windows updates gets quality improvements.2
    The combined servicing stack update is KB5063979, builds 19044.6271 and 19045.6271.

New feature 1 change

File Server

  • IT administrators can deploy measures that harden SMB file sharing.3
    Adds support for deploying SMB hardening measures as part of Windows updates released on and after September 9, 2025.

Known issues

  1. Open Affects: Everyone

    SMBv1 protocol connectivity

    After this update, shared files and folders might be unreachable over SMBv1 on NetBIOS over TCP/IP. The issue can affect a client or server with the September 2025 security update; SMBv2 and SMBv3 are not affected. KB5066198 resolves it.4

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Resolved Affects: Organizations and IT administrators Resolved by KB5066198

    Autopilot Enrollment Status Page (ESP)

    On Windows 10, version 22H2 build 19045.6332, the Autopilot Enrollment Status Page might not load during setup. Users might reach the desktop before policies and apps are installed. KB5066198 resolves this issue.5

    Resolution Fixed in KB5066198

    Install KB5066198 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-09-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5063842, KB5066188, KB5063709, KB5062649
+22 earlier KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by
KB5066791
VersionBuildChannel
21H2 19044.6332 General availability
22H2 19045.6332 General availability

Security

49 vulnerabilities fixed
8 critical 40 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2025-54918
Windows NTLM Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2025-53800
Windows Graphics Component Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2025-55224
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 7.8
CVE-2025-55228
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2025-55236
Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.3
CVE-2025-48807
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 6.7
CVE-2025-55226
Graphics Kernel Remote Code Execution Vulnerability
 Critical 6.7
CVE-2025-53799
Windows Imaging Component Information Disclosure Vulnerability
 Critical 5.5
CVE-2025-55234
Windows SMB Elevation of Privilege Vulnerability
 Important 8.8

The table lists the 9 exploited, publicly disclosed or critical vulnerabilities. See all 49 vulnerabilities →

Updated components

841 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display28
Networking24
Security and sign-in19
Settings18
File Explorer and shell10
Hyper-V and virtualization7
Kernel7
Remote Desktop5
Storage and file systems5
Secure Boot4
Bluetooth3
Search3

Verified in package: changed files confirm WinSock.

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. This fix reduces the scope for requiring UAC prompts for MSI repairs and enables IT admins to disable UAC prompts for specific apps by adding them to an allowlist. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. [File Server] New! As part of the Windows updates released on and after September 9, 2025, this update enables support for IT administrators to deploy hardening measures for SMB. support.microsoft.com
  4. 4. This issue is resolved in Windows updates released on and after September 25, 2025 (KB5066198). support.microsoft.com
  5. 5. Organizations using Windows Autopilot to deploy Windows 10 to devices with the Enrollment Status Page (ESP) configured might find that the ESP doesn't load during the Out-of-Box Experience (OOBE). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake