Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5066793

KB5066793: Cumulative update for Windows 11, version 23H2, October 2025. Exploited Remote Access flaw addressed; risky file previews disabled

In short

The update addresses 109 vulnerabilities, including three exploited flaws, and disables File Explorer previews for files downloaded from the internet. It also removes a fax-modem driver and addresses PowerShell remoting timeouts.

Does it affect you? Applies to: Devices running Windows 11, version 23H2, and devices running version 22H2 Enterprise or Education editions. The update page also notes support dates for other 23H2 editions.

Build
22631.6060
Security
109 fixed · 2 critical · 3 exploited
Restart
Required

What changes

Improvements 3 changes

Cryptography

  • RSA-based smart card certificates use a different Windows certificate provider. Smart card authentication might be affected by this change.1
    Requires Key Storage Provider (KSP) instead of Cryptographic Service Provider (CSP) for RSA-based smart card certificates. If smart card authentication causes problems, the page points to Windows Release Health for resolution steps.

File Explorer

  • File Explorer automatically disables previews for files downloaded from the internet.2
    The change is intended to prevent a vulnerability when users preview potentially unsafe files. The page links to steps for unblocking files.

Servicing stack

  • The component that installs Windows updates receives quality improvements.3
    Servicing stack update KB5066792 is included with the cumulative update.

Fix 1 change

PowerShell

For: Devices using PowerShell Remoting or Windows Remote Management

  • The update addresses PowerShell Remoting and Windows Remote Management commands that might time out after 10 minutes.4
    Listed for Windows 11, version 22H2 Enterprise and Education editions.

Removal 1 change

Compatibility

For: Devices with fax modem hardware that depends on this driver

  • Fax modem hardware that relies on the ltmdm64.sys driver will no longer work in Windows.5
    The update removes the ltmdm64.sys driver. This change is listed for Windows 11, version 22H2 Enterprise and Education editions.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-10-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5065790, KB5065431, KB5064080, KB5066189
+40 earlier KB5063875, KB5062663, KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5068865
VersionBuildChannel
23H2 22631.6060 General availability

Security

109 vulnerabilities fixed
3 exploited 2 critical 107 important
VulnerabilitySeverityCVSS
CVE-2025-24990 Exploited
Windows Agere Modem Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-59230 Exploited
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-47827 Exploited
MITRE CVE-2025-47827: Secure Boot bypass in IGEL OS before 11
 Important 4.6
CVE-2025-49708
Microsoft Graphics Component Elevation of Privilege Vulnerability
 Critical 9.9
CVE-2016-9535
MITRE CVE-2016-9535: LibTIFF Heap Buffer Overflow Vulnerability
 Critical 4.0
CVE-2025-24052
Windows Agere Modem Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-2884
Cert CC: CVE-2025-2884 Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation
 Important 5.3

The table lists the 7 exploited, publicly disclosed or critical vulnerabilities. See all 109 vulnerabilities →

Updated components

1,147 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display27
Networking20
Windows Update15
File Explorer and shell13
Search12
Secure Boot11
Security and sign-in10
Storage and file systems9
Kernel7
Remote Desktop7
Printing6
Bluetooth4

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. This update enforces a security hardening improvement by requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. support.microsoft.com
  2. 2. After installing this update, File Explorer automatically disables the preview feature for files downloaded from the internet. This change is designed to enhance security by preventing a vulnerability when users preview potentially unsafe files. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. Fixed: This update addresses an issue that affects PowerShell Remoting and Windows Remote Management (WinRM), where commands might time out after 10 minutes. support.microsoft.com
  5. 5. This update removes the ltmdm64.sys driver. Fax modem hardware dependent on this specific driver will no longer work in Windows. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake