Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday

KB5065431

KB5065431: Cumulative update for Windows 11, version 23H2, September 2025. SMBv1 file sharing may fail; MSI repairs get fewer UAC prompts

In short

Shared folders might stop opening over SMBv1 after installation. The update also reduces unexpected prompts during some MSI repairs and includes a fix for a publicly disclosed Windows SMB flaw.

Does it affect you? Applies to: This update applies to Windows 11, version 23H2, and version 22H2 Enterprise and Education editions.

Build
22631.5909
Security
50 fixed · 8 critical
Restart
Required
Review notes Additional details from the official release notes (4) Read notes
  • Known issues KB5065790 addresses the SMBv1 connectivity issue.
  • In detail The UAC fix is documented for Windows 11, version 22H2 Enterprise and Education editions.
  • What changes The UAC fix is documented for Windows 11, version 22H2 Enterprise and Education editions.
  • What changes The SMB auditing change is documented for Windows 11, version 22H2 Enterprise and Education editions.

The official sources are linked at the end of the page.

What changes

Fix 1 change

App compatibility (known issue)

For: Non-admin users and IT administrators

  • Some non-admin users get fewer unexpected approval prompts during certain app setup or repair steps.1
    Reduces the scope for UAC prompts during certain MSI custom actions and lets IT admins disable prompts for specific apps by adding them to an allowlist.

Improvement 1 change

Servicing stack

  • The part of Windows that installs updates gets quality improvements.2
    The servicing stack update is KB5064743, build 22621.5973.

New feature 1 change

File server

  • IT teams can check whether devices or software may conflict with SMB server security settings before turning on those protections.3
    Enables auditing of SMB client compatibility for SMB Server signing and SMB Server EPA.

Known issues

  1. Open Affects: Everyone

    SMBv1 protocol connectivity

    Some users might not connect to shared files and folders over SMBv1 on NetBIOS over TCP/IP. The problem can occur if either the SMB client or server has the September 2025 security update. Setups using SMBv2 or SMBv3 are not affected.4

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-09-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5064080, KB5066189, KB5063875, KB5062663
+38 earlier KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5066793
VersionBuildChannel
23H2 22631.5909 General availability

Security

50 vulnerabilities fixed
8 critical 41 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2025-54918
Windows NTLM Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2025-53800
Windows Graphics Component Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2025-55224
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 7.8
CVE-2025-55228
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2025-55236
Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.3
CVE-2025-48807
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 6.7
CVE-2025-55226
Graphics Kernel Remote Code Execution Vulnerability
 Critical 6.7
CVE-2025-53799
Windows Imaging Component Information Disclosure Vulnerability
 Critical 5.5
CVE-2025-55234
Windows SMB Elevation of Privilege Vulnerability
 Important 8.8

The table lists the 9 exploited, publicly disclosed or critical vulnerabilities. See all 50 vulnerabilities →

Updated components

732 files changed since the previous update for the same versions.

Top changed componentsFiles
Networking20
Graphics and display18
Remote Desktop11
Security and sign-in10
Secure Boot9
Kernel7
Storage and file systems4
File Explorer and shell3
Bluetooth2
Hyper-V and virtualization2

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. Fixed: Addresses an issue that caused non-admin users to receive unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. This update enabled auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA. support.microsoft.com
  4. 4. After installing the Windows update released on or after September 9, 2025, you might fail to connect to shared files and folders using the Server Message Block (SMB) v1 protocol on NetBIOS over TCP/IP support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake