KB5074109: Cumulative update for Windows 11, versions 24H2 and 25H2, January 2026. Exploited Desktop Window Manager flaw patched; modem drivers removed

The update patches an actively exploited flaw in Desktop Window Manager and removes four older modem drivers, which can leave dependent modem hardware unusable.

Does it affect you? Applies to: Devices running Windows 11, version 25H2 or 24H2, on x64 or Arm64 processors. The 24H2 end-of-updates date for Home and Pro editions is October 13, 2026.

Review notes Additional details from the official release notes (1) Read note

What changes Secure Boot certificates used by most Windows devices started expiring in June 2026. Devices without the newer certificates will continue to start and operate normally, and standard Windows updates will continue to install.

The official sources are linked at the end of the page.

What changes

Improvements 4 changes

Credentials autofill

Some credential prompts no longer accept virtual keyboard input from remote support or screen sharing tools.¹
Adds security hardening for certain applications that autofill credentials during remote support sessions or automated authentication workflows.

Secure Boot

Gradual rollout Verified in package

For: Devices eligible for new Secure Boot certificates

Eligible devices receive new Secure Boot certificates in phases after they show successful update signals.²
Windows quality updates now include high-confidence device-targeting data to identify devices eligible for automatic certificate updates.

Windows Deployment Services (WDS)

For: IT administrators using WDS hands-free deployment

Hands-free deployment is no longer supported by default in WDS.²
WDS changes its default behavior for hands-free deployment; Microsoft provides separate guidance for IT administrators.

AI components

Verified in package

This update includes newer versions of several AI components on Copilot+ PCs.³
Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2511.1224.0. These components apply only to Copilot+ PCs.

Fixes 4 changes

Networking (known issues)

Verified in package 2 items

WSL mirrored networking can connect to corporate resources over VPN again after some updates caused route errors.⁴
Addresses mirrored networking failures in Windows Subsystem for Linux (WSL), including “No route to host” errors, that might occur after KB5067036.
RemoteApp connections in Azure Virtual Desktop work again for users affected by connection failures.⁴
Addresses RemoteApp connection failures in Azure Virtual Desktop environments that might occur after KB5070311.

Power & Battery

Devices with an NPU are less likely to stay powered on while idle, which can affect power use.⁴
Addresses an idle power issue on devices with a Neural Processing Unit (NPU).

WinSqlite3.dll

For: Users whose security software flagged WinSqlite3.dll

Some security software should no longer flag a Windows component as vulnerable.⁵
Updates the Windows component WinSqlite3.dll. This is separate from application-specific sqlite3.dll files.

New feature 1 change

Start menu

Gradual rollout

For: Windows devices receiving the gradual rollout

The redesigned Start menu continues to reach more devices over time.⁶

Removal 1 change

Compatibility

For: Devices using these modem drivers

Some modem hardware will stop working because Windows no longer includes its required drivers.⁷
Removes agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64), and smserial.sys (x86).

Known issues

Open Affects: Organizations and IT administrators

Password icon might be missing or invisible in the lock screen sign-in options

Microsoft lists a lock-screen sign-in issue: the password icon might be invisible, mainly in managed environments. The blank space still opens the password box.⁸

How to apply the workaround Workaround

Select the blank space where the password icon should appear to open the password box. KB5074105 addresses the issue.⁸
Open Affects: Everyone

Apps might become unresponsive when saving files to cloud-based storage

Microsoft lists an issue where some apps might hang or show errors when opening or saving files in cloud storage, such as OneDrive or Dropbox.⁹

How to apply the workaround Workaround

KB5078127 addresses this issue.⁹
Open Affects: Organizations and IT administrators

Connection and authentication failures in Azure Virtual Desktop and Windows 365

Microsoft lists connection and sign-in failures with the Windows App on specific Windows builds, affecting Azure Virtual Desktop and Windows 365.¹⁰

How to apply the workaround Workaround

KB5077744 addresses this issue.¹⁰

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-01-13
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5072033, KB5070311, KB5068861, KB5067036

+38 earlier
KB5070773, KB5066835, KB5065789, KB5068221, KB5065426, KB5064081, KB5063878, KB5062660, KB5064489, KB5062553, KB5060829, KB5063060, KB5060842, KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by: KB5077744

Version	Build	Channel
24H2	26100.7623	General availability
25H2	26200.7623	General availability

Security

86 vulnerabilities fixed

1 exploited 3 critical 82 important 1 not rated

Vulnerability	Severity	CVSS
CVE-2026-20805 Exploited Desktop Window Manager Information Disclosure Vulnerability	Important	5.5
CVE-2026-20822 Windows Graphics Component Elevation of Privilege Vulnerability	Critical	7.8
CVE-2026-20854 Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability	Critical	7.5
CVE-2026-20876 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability	Critical	6.7
CVE-2023-31096 MITRE: CVE-2023-31096 Windows Agere Soft Modem Driver Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-21265 Secure Boot Certificate Expiration Security Feature Bypass Vulnerability	Important	6.4

The table lists the 6 exploited, publicly disclosed or critical vulnerabilities. See all 86 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 24H2 / 25H2

4.2 GB

windows11.0-kb5074109-x64.msu Main update · KB5074109 SHA-1: fe29a336…70b9a1 windows11.0-kb5043080-x64.msu Prerequisite · KB5043080 SHA-1: 95344967…9c83e8

Arm64 24H2 / 25H2

3.8 GB

windows11.0-kb5074109-arm64.msu Main update · KB5074109 SHA-1: c0b5fa70…e18490 windows11.0-kb5043080-arm64.msu Prerequisite · KB5043080 SHA-1: df540a05…0f090b

Updated components

2,739 files changed since the previous update for the same versions.

Top changed components	Files
Settings	62
Graphics and display	40
Remote Desktop	25
Security and sign-in	25
File Explorer and shell	24
Printing	16
Hyper-V and virtualization	14
Search	14
Kernel	11
Networking	10
Secure Boot	7
Emoji and input	6

Verified in package: changed files confirm Secure Boot, AI components, Networking (known issues).

Sources

Microsoft Support: KB5074109

Updated Nov 7, 2026

Cited passages from Microsoft's official notes (10)

1. credential dialogs do not respond to virtual keyboard input from remote desktop or screen sharing tools or apps. support.microsoft.com
2. Starting with this update, Windows quality updates include a subset of high confidence device targeting data that identifies devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
3. This release updates the following AI components: support.microsoft.com
4. This update addresses an issue where mirrored networking in Windows Subsystem for Linux (WSL) could fail causing “No route to host” errors support.microsoft.com
5. The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. support.microsoft.com
6. The redesigned Start menu continues its gradual rollout to Windows devices. support.microsoft.com
7. This update removes the following modem drivers: agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64) and smserial.sys (x86). Modem hardware dependent on these specific drivers will no longer work in Windows. support.microsoft.com
8. If you hover over the space where the icon should appear, you’ll see that the password button is still available. Select this placeholder to open the password text box and enter your password. support.microsoft.com
9. This issue is addressed in KB5078127. support.microsoft.com
10. The issue affects Windows App on specific Windows builds, causing sign-in failures. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Oct 21, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake