KB5068861: Cumulative update for Windows 11, versions 24H2 and 25H2, November 2025. Exploited Windows kernel flaw patched; handheld battery drain fixed

An actively exploited Windows kernel flaw is patched, along with fixes for handheld gaming battery drain and other problems. The password icon and WSL VPN issues remain listed as known issues.

Does it affect you? Applies to: Devices running Windows 11, versions 25H2 or 24H2, on x64 or Arm64 systems.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fixes 7 changes

Gaming

2 items

Gaming handhelds can stay in low-power states again, helping prevent faster battery drain.¹
Addresses an issue that kept gaming handheld devices from staying in low-power states.
On some gaming handhelds, the controller can respond in apps sooner after sign-in. The touch keyboard also hides after you enter a password or PIN.²
After sign-in with the built-in Gamepad, the controller might not respond in apps for about five seconds. The touch keyboard on the sign-in screen hides after password or PIN entry.

Storage

Some Storage Spaces can be accessed again, and Storage Spaces Direct can create storage clusters.³
Addresses issues that could make some Storage Spaces inaccessible or cause Storage Spaces Direct to fail when creating a storage cluster.

System utilities (known issue)

Closing Task Manager with its Close button no longer leaves background copies that can slow the PC over time.⁴
Addresses a Task Manager process that could remain after closing the app, an issue that might occur after installing KB5067036.

Voice Access

For: Voice Access users

Voice Access setup can complete even when no microphone is connected and the voice model is not installed.⁵
Addresses a failure during initial setup when no microphone was connected and the voice model was not installed.

Window management

Selecting the desktop no longer unexpectedly opens Task View.⁶

Networking

Verified in package

Some HTTP requests are parsed correctly when front-end proxies are part of the setup.⁷
Fixes the HTTP.sys request parser accepting a single line break in HTTP/1.1 chunk extensions, where RFC 9112 requires CRLF. The page also gives the HttpAllowLenientChunkExtParsing DWORD value, set to 1, to turn off strict parsing.

Improvements 2 changes

AI components

Verified in package

Copilot+ PCs receive updated AI components.⁸
Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2510.1159.0.

Servicing stack

The component that installs Windows updates gets quality improvements.⁹
The update includes servicing stack update KB5067035, build 26100.7010.

Known issues

Open Affects: Organizations and IT administrators

Password icon might be missing or invisible in the lock screen sign-in options

The password icon might be missing from lock-screen sign-in options. Personal devices running Windows Home or Pro are very unlikely to be affected; the issue mainly affects enterprise or managed IT environments.¹⁰

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Open Affects: Organizations and IT administrators

Mirror networking on Windows Subsystem for Linux might fail

Mirrored networking in Windows Subsystem for Linux might fail with some third-party VPNs, blocking access to company resources. Home users are unlikely to be affected.¹¹

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-11-11
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5067036, KB5070773, KB5066835, KB5065789

+35 earlier
KB5068221, KB5065426, KB5064081, KB5063878, KB5062660, KB5064489, KB5062553, KB5060829, KB5063060, KB5060842, KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by: KB5072033

Version	Build	Channel
24H2	26100.7171	General availability
25H2	26200.7171	General availability

Security

34 vulnerabilities fixed

1 exploited 2 critical 32 important

Vulnerability	Severity	CVSS
CVE-2025-62215 Exploited Windows Kernel Elevation of Privilege Vulnerability	Important	7.0
CVE-2025-60724 Windows GDI+ Remote Code Execution Vulnerability	Critical	9.8
CVE-2025-60716 DirectX Graphics Kernel Elevation of Privilege Vulnerability	Critical	7.0

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 34 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 24H2 / 25H2

3.8 GB

windows11.0-kb5068861-x64.msu Main update · KB5068861 SHA-1: acc4fe9c…2b62b2 windows11.0-kb5043080-x64.msu Prerequisite · KB5043080 SHA-1: 95344967…9c83e8

Arm64 24H2 / 25H2

3.6 GB

windows11.0-kb5068861-arm64.msu Main update · KB5068861 SHA-1: a3e19ed3…6a15ed windows11.0-kb5043080-arm64.msu Prerequisite · KB5043080 SHA-1: df540a05…0f090b

Updated components

1,229 files changed since the previous update for the same versions.

Top changed components	Files
Graphics and display	24
File Explorer and shell	17
Networking	16
Bluetooth	7
Kernel	7
Security and sign-in	7
Hyper-V and virtualization	5
Secure Boot	5
Settings	5
Audio	3
Emoji and input	3
Printing	3

Verified in package: changed files confirm Networking, AI components.

Sources

Microsoft Support: KB5068861

Updated Nov 7, 2026

Cited passages from Microsoft's official notes (11)

1. Fixed: This update addresses an issue that affects gaming handheld devices. These devices were unable to stay in low-power states, which caused faster battery drain. support.microsoft.com
2. This update addresses an issue on some handheld gaming devices where after signing in using the built-in Gamepad, the controller might not respond in apps for about five seconds, causing a delay. support.microsoft.com
3. This update addresses an issue that could cause some Storage Spaces to become inaccessible or Storage Spaces Direct to fail when creating a storage cluster. support.microsoft.com
4. Fixed: This update addresses an issue where closing Task Manager with the Close button didn’t fully end the process, leaving background instances that could slow performance over time. support.microsoft.com
5. This update addresses an issue where Voice Access failed during initial setup if no microphone was connected and the voice model wasn’t installed. support.microsoft.com
6. This update addresses an issue where selecting the desktop could unexpectedly open Task View. support.microsoft.com
7. This update fixes an issue in the HTTP.sys request parser, a Windows component that reads and processes HTTP requests. support.microsoft.com
8. This release updates the following AI components: support.microsoft.com
9. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
10. After installing the August 2025 non-security preview update (KB5064081) or later updates, you might notice that the password icon is not visible in the sign-in options on the lock screen. support.microsoft.com
11. mirrored networking mode in Windows Subsystem for Linux (WSL) might cause issues with some third-party VPNs. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 11 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake