Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5073455

KB5073455: Cumulative update for Windows 11, version 23H2, January 2026. Exploited Desktop Window Manager flaw patched; RDP issues addressed

In short

An actively exploited Desktop Window Manager flaw gets a security fix. The update also removes several modem drivers and addresses Remote Desktop connection failures.

Does it affect you? Applies to: Devices running Windows 11, version 23H2, including x64 and Arm64 devices. The listed end-of-updates date applies to Enterprise and Education editions.

Build
22631.6491
Security
80 fixed · 2 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • Known issues KB5077797 addresses the credential prompt failures affecting Azure Virtual Desktop and Windows 365.
  • Known issues KB5078132 addresses the issue with some apps becoming unresponsive when opening or saving files in cloud storage.

The official sources are linked at the end of the page.

What changes

Fixes 3 changes

Display Kernel

Verified in package

For: users of Remote Desktop

  • The update addresses Remote Desktop connections that fail and might require a device restart.1
    Addresses an issue affecting Remote Desktop Protocol (RDP) connections.

Input

  • The update addresses apps that might close unexpectedly while you type.2
    Affected apps include Outlook, Teams, Edge, Chrome, and Excel.

WinSqlite3.dll

For: users whose security software flagged WinSqlite3.dll

  • The update addresses security software warnings about a Windows component.3
    Updates the Windows core component WinSqlite3.dll, which some security software might have detected as vulnerable. The note distinguishes it from app-specific sqlite3.dll files.

Improvements 3 changes

Credentials autofill

Verified in package
  • Some credential prompts no longer accept input from virtual keyboards during remote support or automated sign-in.4
    Credential dialogs do not respond to virtual keyboard input from remote desktop or screen-sharing tools or apps in the affected workflows.

Secure Boot

Gradual rollout Verified in package
  • Windows can deliver new Secure Boot certificates in stages to eligible devices.5
    Quality updates include high-confidence device targeting data. New certificates are sent after devices show enough successful update signals.

Servicing stack

For: all devices receiving this update

  • The update improves the component that installs Windows updates.6
    Includes servicing stack update KB5071963, build 22621.6265.

Removal 1 change

Compatibility

For: devices using the specified modem drivers

  • Modem hardware that depends on the removed drivers will no longer work.7
    Removes agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64), and smserial.sys (x86).

Known issues

  1. Open Affects: Everyone

    Apps might become unresponsive when saving files to cloud-based storage

    Some apps might stop responding or show errors when opening files from or saving files to cloud storage. Outlook might hang when its PST files are stored on OneDrive.8

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Connection and authentication failures in Azure Virtual Desktop and Windows 365

    The update is listed with credential prompt failures during Remote Desktop connections through the Windows App, affecting Azure Virtual Desktop and Windows 365 sign-ins on specific Windows builds.9

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Open Affects: Everyone

    Secure Launch-capable devices might fail to shut down or hibernate

    Some Secure Launch-capable PCs restart instead of shutting down or entering hibernation. Microsoft says KB5075941 and later updates resolve the issue.10

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Security

80 vulnerabilities fixed
1 exploited 2 critical 77 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-20805 Exploited
Desktop Window Manager Information Disclosure Vulnerability
 Important 5.5
CVE-2026-20822
Windows Graphics Component Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-20876
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 6.7
CVE-2023-31096
MITRE: CVE-2023-31096 Windows Agere Soft Modem Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-21265
Secure Boot Certificate Expiration Security Feature Bypass Vulnerability
 Important 6.4

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 80 vulnerabilities →

Updated components

1,202 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display36
Security and sign-in18
Kernel13
Printing12
Search12
File Explorer and shell11
Hyper-V and virtualization10
Networking8
Secure Boot6
Storage and file systems4
Bluetooth2
Windows Update2

Verified in package: changed files confirm Display Kernel, Credentials autofill, Secure Boot.

Sources

Updated
Cited passages from Microsoft's official notes (10)
  1. 1. This update addresses an issue affecting Remote Desktop Protocol (RDP) connections, where the connection fails and you might need to restart your device. support.microsoft.com
  2. 2. These apps might close unexpectedly when you enter text. support.microsoft.com
  3. 3. The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. support.microsoft.com
  4. 4. credential dialogs do not respond to virtual keyboard input from remote desktop or screen sharing tools or apps. support.microsoft.com
  5. 5. Windows quality updates include a subset of high confidence device targeting data that identifies devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  6. 6. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  7. 7. This update removes the following modem drivers: agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64) and smserial.sys (x86). Modem hardware dependent on these specific drivers will no longer work in Windows. support.microsoft.com
  8. 8. After installing this update, some applications may become unresponsive or encounter unexpected errors when opening files from or saving files to cloud-based storage, such as OneDrive or Dropbox. support.microsoft.com
  9. 9. credential prompt failures occurred during Remote Desktop connections using the Windows App on Windows client devices, impacting Azure Virtual Desktop and Windows 365. support.microsoft.com
  10. 10. This issue is fully resolved in Windows updates released on February 10, 2026 (KB5075941), and in all updates released after that date. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Oct 21, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake