The Update BureauKB5071546: Cumulative update for Windows 10, versions 21H2 and 22H2, December 2025. PowerShell adds a warning before running web content
In short
The update adds a security warning and confirmation prompt to PowerShell 5.1’s Invoke-WebRequest command. It also includes a fix for an actively exploited Cloud Files driver vulnerability.
Does it affect you? Applies to: Windows 10, version 22H2 devices enrolled in ESU, and Windows 10 Enterprise LTSC 2021, version 21H2.
Review notes Additional details from the official release notes (1) Read note
- This page Invoke-WebRequest adds a confirmation prompt warning about script-execution risk, and users can continue or cancel the request.
The official sources are linked at the end of the page.
What changes
Improvements 3 changes
PowerShell 5.1
2 items
-
PowerShell now warns about script execution risk and asks before continuing when you use Invoke-WebRequest.1
The confirmation prompt applies to Windows 10, version 22H2 devices covered by ESU.
-
PowerShell now warns about script execution risk and asks before continuing when you use Invoke-WebRequest.1
The confirmation prompt applies to Windows 10 Enterprise LTSC 2021, version 21H2.
Servicing stack
-
Azure-hosted devices get improved verification to help future updates install.2
SSU KB5068780 adds logic to verify whether a device is hosted on Azure, using an updated certificate chain.
Known issues
-
Message Queuing (MSMQ)
In enterprise or managed environments, MSMQ queues could become inactive, IIS sites could fail with resource errors, and applications could be unable to write to queues. The issue was resolved by KB5074976 and later out-of-band updates.3
Resolution Fixed in KB5074976Install KB5074976 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-12-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5068781, KB5066791, KB5066198, KB5065429
- Replaced by
- KB5074976
| Version | Build | Channel |
|---|---|---|
| 21H2 | 19044.6691 | General availability |
| 22H2 | 19045.6691 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2025-62221
Exploited
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
|
Important | 8.8 |
|
PowerShell Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Windows Projected File System Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Storage VSP Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Storage VSP Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Win32k Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Projected File System Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Projected File System Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Projected File System Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Client-Side Caching Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Projected File System Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Common Log File System Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Installer Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Shell Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Storage VSP Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows File Explorer Elevation of Privilege Vulnerability
|
Important | 7.5 |
|
Windows File Explorer Elevation of Privilege Vulnerability
|
Important | 7.3 |
|
DirectX Graphics Kernel Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
DirectX Graphics Kernel Denial of Service Vulnerability
|
Important | 6.5 |
|
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
|
Important | 6.5 |
|
Windows DirectX Information Disclosure Vulnerability
|
Important | 6.5 |
|
Windows Hyper-V Denial of Service Vulnerability
|
Important | 5.3 |
Downloads (Microsoft Update Catalog)
x64
21H2 / 22H2
1.0 GB
Arm64
21H2 / 22H2
682.9 MB
x86
21H2 / 22H2
430.6 MB
Updated components
1,007 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Graphics and display | 26 |
| File Explorer and shell | 19 |
| Security and sign-in | 18 |
| Networking | 15 |
| Secure Boot | 11 |
| Kernel | 9 |
| Remote Desktop | 9 |
| Hyper-V and virtualization | 8 |
| Storage and file systems | 6 |
| Settings | 4 |
| Bluetooth | 3 |
| Search | 3 |
Sources
Updated
Cited passages from Microsoft's official notes (3)
-
1.
The Invoke-WebRequest command now includes a confirmation prompt with a security warning of a script execution risk. You can choose to continue or cancel the request.
support.microsoft.com -
2.
This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation.
support.microsoft.com -
3.
This issue was resolved by the Windows out-of-band update released on and after December 18, 2025 (such as KB5074976).
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake