KB5066835: Cumulative update for Windows 11, versions 24H2 and 25H2, October 2025. Exploited modem and Remote Access flaws addressed

Windows closes actively exploited flaws in its modem driver and Remote Access Connection Manager. File Explorer also disables previews for files downloaded from the internet.

Does it affect you? Applies to: Devices running Windows 11, versions 25H2 or 24H2, on x64 or Arm64 systems. The AI component updates apply only to Copilot+ PCs.

Review notes Additional details from the official release notes (2) Read notes

In detail Windows 11 version 24H2 Home and Pro reach end of support on October 13, 2026.
Known issues The USB keyboard and mouse issue in WinRE is addressed by KB5070773.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fixes 5 changes

Browser

Print preview stops responding less often in Chromium-based browsers.¹
Addresses an issue that caused the print preview screen to stop responding.

Gaming

For: People signing in with only a Gamepad

Games and apps respond to input after signing in at the lock screen with only a Gamepad.²
Fixes the input issue when no other input method, such as touch or fingerprint, was used during sign-in.

PowerShell

2 items

PowerShell commands are less likely to time out during remote management.³
Addresses PowerShell Remoting and Windows Remote Management (WinRM) commands timing out after 10 minutes.
An audit event that was previously missing is logged.⁴
Addresses an issue that prevented an audit event from being logged.

Windows Hello

For: People setting up Windows Hello face recognition

People can complete face recognition setup with a USB infrared camera instead of getting a repeated error.⁵
Addresses a setup issue with Windows Hello face recognition using USB infrared camera modules.

Improvements 4 changes

Cryptography

RSA-based smart card certificates must use a newer Windows certificate storage method.⁶
Requires Key Storage Provider (KSP) instead of Cryptographic Service Provider (CSP) for RSA-based smart card certificates. The KB directs readers with authentication problems to the Windows Release Health site.

File Explorer

File Explorer turns off previews for files downloaded from the internet to help prevent a security risk.⁷
Automatically disables the preview feature for files downloaded from the internet. The KB links to instructions for unblocking files.

AI components

Verified in package

For: Copilot+ PC users

Four AI components receive updates on Copilot+ PCs.⁸
Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2509.1022.0.

Servicing stack

The component that installs Windows updates gets quality improvements.⁹
Includes servicing stack update KB5067360, build 26100.6893.

Removal 1 change

Compatibility

For: People using fax modem hardware that depends on this driver

Some fax modems stop working because Windows no longer includes their required driver.¹⁰
Removes the ltmdm64.sys driver. Fax modem hardware that depends on this driver no longer works.

Known issues

Open Affects: Organizations and IT administrators

Password icon might be missing or invisible in the lock screen sign-in options

The password icon might be missing from lock screen sign-in options. The issue mainly affects enterprise or managed IT environments; personal Home and Pro devices are very unlikely to be affected.¹¹

How to apply the workaround Workaround

Select the blank space where the password icon should be, then enter the password in the box that opens.¹¹
Open Affects: Everyone

Problems playing protected content in some BluRay/DVD/Digital TV apps

Some Blu-ray, DVD, and digital TV apps might show protection errors, interrupt playback, stop unexpectedly, or show a black screen. Streaming services are not affected.¹²

How to apply the workaround Workaround

KB5065789 and later updates address problems in some apps using Enhanced Video Renderer with HDCP. KB5067036 adds improvements for apps using DRM for digital audio.¹²
Open Affects: Everyone

IIS websites might fail to load

IIS websites might fail to load on some devices after the listed updates. This can affect 25H2 devices with the September preview update or 24H2 devices with this update.¹³

How to apply the workaround Workaround

Check for Windows updates, install any available updates, and restart—even if no updates are available.¹³
Step-by-step workaround instructions
3 steps

Show steps Hide steps
Step-by-step procedure
1. Open Settings and go to Windows Update.
2. Search for updates and install any that are available.
3. Restart the device, even if no updates were installed.
Open Affects: Everyone

USB mouse and keyboard not working in the Windows Recovery Environment

USB keyboards and mice might not work in the Windows Recovery Environment, preventing navigation of its recovery options. They still work normally in Windows.¹⁴

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-10-14
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5065789, KB5068221, KB5065426, KB5064081

+32 earlier
KB5063878, KB5062660, KB5064489, KB5062553, KB5060829, KB5063060, KB5060842, KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by: KB5070773

Version	Build	Channel
24H2	26100.6899	General availability
25H2	26200.6899	General availability

Security

126 vulnerabilities fixed

3 exploited 2 critical 124 important

Vulnerability	Severity	CVSS
CVE-2025-24990 Exploited Windows Agere Modem Driver Elevation of Privilege Vulnerability	Important	7.8
CVE-2025-59230 Exploited Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Important	7.8
CVE-2025-47827 Exploited MITRE CVE-2025-47827: Secure Boot bypass in IGEL OS before 11	Important	4.6
CVE-2025-49708 Microsoft Graphics Component Elevation of Privilege Vulnerability	Critical	9.9
CVE-2016-9535 MITRE CVE-2016-9535: LibTIFF Heap Buffer Overflow Vulnerability	Critical	4.0
CVE-2025-24052 Windows Agere Modem Driver Elevation of Privilege Vulnerability	Important	7.8
CVE-2025-2884 Cert CC: CVE-2025-2884 Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation	Important	5.3

The table lists the 7 exploited, publicly disclosed or critical vulnerabilities. See all 126 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 24H2 / 25H2

3.8 GB

windows11.0-kb5066835-x64.msu Main update · KB5066835 SHA-1: 2f193bc5…cc813a windows11.0-kb5043080-x64.msu Prerequisite · KB5043080 SHA-1: 95344967…9c83e8

Arm64 24H2 / 25H2

3.6 GB

windows11.0-kb5066835-arm64.msu Main update · KB5066835 SHA-1: fde0614c…6cc17a windows11.0-kb5043080-arm64.msu Prerequisite · KB5043080 SHA-1: df540a05…0f090b

Updated components

1,734 files changed since the previous update for the same versions.

Top changed components	Files
Graphics and display	43
Networking	22
Printing	19
Security and sign-in	19
Remote Desktop	18
File Explorer and shell	13
Search	12
Storage and file systems	12
Kernel	9
Settings	8
Secure Boot	7
Bluetooth	5

Verified in package: changed files confirm AI components.

Sources

Microsoft Support: KB5066835

Updated Nov 7, 2026

Cited passages from Microsoft's official notes (14)

1. [Browser] Fixed: This update addresses an issue that caused the print preview screen to stop responding in Chromium-based browsers. support.microsoft.com
2. [Gaming] Fixed: An issue occurred when users signed in to a Windows device using only a Gamepad at the lock screen. support.microsoft.com
3. commands might time out after 10 minutes. support.microsoft.com
4. Fixed: This update addresses an issue that prevented an audit event from being logged. support.microsoft.com
5. Users were unable to complete setup due to a persistent error message support.microsoft.com
6. requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. support.microsoft.com
7. File Explorer automatically disables the preview feature for files downloaded from the internet. support.microsoft.com
8. This release updates the following AI components: support.microsoft.com
9. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
10. This update removes the ltmdm64.sys driver. Fax modem hardware dependent on this specific driver will no longer work in Windows. support.microsoft.com
11. If you hover over the space where the icon should appear, you’ll see that the password button is still available. Select this placeholder to open the password text box support.microsoft.com
12. The non-security September 2025 Windows preview update (KB5065789) and later updates address problems affecting certain applications that use the Enhanced Video Renderer (EVR) with HDCP support.microsoft.com
13. Make sure to restart your device, even if no updates are installed. support.microsoft.com
14. USB devices, such as keyboards and mice, do not function in the Windows Recovery Environment (WinRE). support.microsoft.com

Checked automatically: 8 of 8 checks passed, 14 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake