The Update BureauKB5075941: Cumulative update for Windows 11, version 23H2, February 2026. Exploited Shell and MSHTML security bypasses addressed
In short
Addresses 27 vulnerabilities, including exploited Windows Shell and MSHTML security feature bypasses, and fixes several Windows 11 23H2 issues. It also updates Secure Boot components and certificate rollout data.
Does it affect you? Applies to: Devices running Windows 11, version 23H2. The end-of-updates date applies to Enterprise and Education editions.
What changes
Fixes 5 changes
Display & Graphics
-
Addresses an issue that caused the Desktop Window Manager to restart unexpectedly.1
The issue affected the Desktop Window Manager (DWM) process.
File Explorer
-
Addresses cases where custom folder names do not appear correctly when folders with desktop.ini files are renamed.2
The
LocalizedResourceNamesetting was ignored.
Graphics
For: Devices with certain GPU configurations
-
Addresses a system error that some GPU configurations might experience, which can lead to a KERNEL_SECURITY_CHECK_FAILURE error.3
The error is related to
dxgmms2.sys.
OS Security (known issue)
-
Some PCs using Virtual Secure Mode can shut down or enter hibernation instead of restarting.4
Addresses the issue that affected some PCs after installing a Windows security update released on or after January 13, 2026.
Windows Security
For: Users and organizations relying on these event logs
- Addresses an issue that prevented Microsoft Defender SmartScreen Application Reputation events from being logged, interrupting event tracking for advanced threat investigations.5
Improvements 4 changes
Secure Boot
Gradual rollout
Verified in package
2 items
-
For devices that already have the Windows UEFI CA 2023 certificate, the boot manager switches to a 2023-signed boot file.6
Replaces the 2011-signed
bootmgfw.efiwith the 2023-signed version. Resetting the DB or turning Secure Boot on or off can cause a “Secure Boot violation”; in rare cases, the stated solution is to create Secure Boot recovery media. - Windows quality updates include data to help determine which devices are ready to receive new Secure Boot certificates. Devices receive the certificates after showing sufficient successful update signals, supporting a phased rollout.8
Fonts & Display
For: Users who read or display Chinese text
- Chinese fonts support the GB18030-2022A standard for character coverage and display.7
Servicing stack
-
The update includes quality improvements to the component that installs Windows updates.9
Includes servicing stack update KB5077457, build 22621.6642.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-02-10
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5078132, KB5077797, KB5073455, KB5071417
+48 earlier
KB5070312, KB5068865, KB5067112, KB5066793, KB5065790, KB5065431, KB5064080, KB5066189, KB5063875, KB5062663, KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123 - Replaced by
- KB5078883
| Version | Build | Channel |
|---|---|---|
| 23H2 | 22631.6649 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2026-21510
Exploited
Windows Shell Security Feature Bypass Vulnerability
|
Important | 8.8 |
|
CVE-2026-21513
Exploited
MSHTML Framework Security Feature Bypass Vulnerability
|
Important | 8.8 |
|
CVE-2026-21519
Exploited
Desktop Window Manager Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
CVE-2026-21533
Exploited
Windows Remote Desktop Services Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
CVE-2026-21525
Exploited
Windows Remote Access Connection Manager Denial of Service Vulnerability
|
Moderate | 6.2 |
|
Windows Hyper-V Security Feature Bypass Vulnerability
|
Important | 8.8 |
|
Windows Kernel Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows HTTP.sys Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Kernel Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows HTTP.sys Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Graphics Component Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
GDI+ Denial of Service Vulnerability
|
Important | 7.5 |
|
Windows Graphics Component Elevation of Privilege Vulnerability
|
Important | 7.3 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Important | 7.3 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Important | 7.3 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Important | 7.3 |
|
Windows Connected Devices Platform Service Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Windows Subsystem for Linux Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Windows Subsystem for Linux Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Mailslot File System Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Windows Storage Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Windows Kernel Information Disclosure Vulnerability
|
Important | 5.5 |
|
Windows NTLM Spoofing Vulnerability
|
Important | 3.3 |
| Not rated | — |
Downloads (Microsoft Update Catalog)
x64
23H2
1.0 GB
Arm64
23H2
1.1 GB
Updated components
1,629 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Graphics and display | 30 |
| Networking | 21 |
| Remote Desktop | 20 |
| Hyper-V and virtualization | 16 |
| Search | 12 |
| File Explorer and shell | 11 |
| Secure Boot | 11 |
| Settings | 10 |
| Kernel | 9 |
| Storage and file systems | 9 |
| Security and sign-in | 8 |
| Bluetooth | 6 |
Verified in package: changed files confirm Secure Boot.
Sources
Updated
Cited passages from Microsoft's official notes (9)
-
1.
Fixed: This update addresses an issue caused the Desktop Window Manager (DWM) process to re‑start unexpectedly.
support.microsoft.com -
2.
Fixed: This update addresses an issue where folder renaming with desktop.ini files in File Explorer isn't work correctly. The LocalizedResourceName setting is ignored, so custom folder names don't appear.
support.microsoft.com -
3.
Fixed: This update addresses an issue where certain GPU configurations might recently have experienced a system error related to dxgmms2.sys, resulting in the KERNEL_SECURITY_CHECK_FAILURE error.
support.microsoft.com -
4.
some PCs which run Virtual Secure Mode (VSM) are unable to shut down or enter hibernation. Instead, the device restarts.
support.microsoft.com -
5.
This update addresses an issue that affected Microsoft Defender SmartScreen Application Reputation (AppRep) events from being logged.
support.microsoft.com -
6.
It replaces the 2011 signed bootmgfw.efi with the 2023 signed bootmgfw.efi.
support.microsoft.com -
7.
Updates the Chinese fonts to support the GB18030‑2022A standard for character coverage and display.
support.microsoft.com -
8.
Devices will receive the new certificates only after they show sufficient successful update signals, which helps ensures a safe and phased rollout.
support.microsoft.com -
9.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake