KB5078885: Cumulative update for Windows 10, versions 21H2 and 22H2, March 2026. Secure Boot certificate rollout expands; File History handles more names

Addresses 43 Important-severity vulnerabilities and improves Secure Boot certificate targeting, File History backups, and graphics stability. Secure Boot certificates have started expiring in June 2026, so review Microsoft's guidance.

Does it affect you? Applies to: The update applies to Windows 10, version 22H2 devices enrolled in the Extended Security Updates program, and Windows 10 Enterprise LTSC 2021, version 21H2.

What changes

Improvements 8 changes

File History

2 items

For: People backing up files with File History

File History can back up new files with names containing certain Chinese and Private Use Area characters.¹
The change applies to File History in Control Panel.
File History can back up new files with names containing certain Chinese and Private Use Area characters.¹
The change applies to File History in Control Panel.

Graphics

2 items

Graphics stability improves for certain GPU configurations.²
Graphics stability improves for certain GPU configurations.²

Secure Boot

Gradual rollout Verified in package 3 items

More eligible devices can receive new Secure Boot certificates automatically, through a controlled, phased rollout.³
Targeting relies primarily on client diagnostic data. Servers are unlikely to qualify because of limited data, although they are not explicitly excluded. Devices receive certificates after demonstrating sufficient successful update signals.
More eligible devices can receive new Secure Boot certificates automatically, through a controlled, phased rollout.³
Targeting relies primarily on client diagnostic data. Servers are unlikely to qualify because of limited data, although they are not explicitly excluded. Devices receive certificates after demonstrating sufficient successful update signals.
The servicing stack update replaces the 2011-signed boot manager file with a 2023-signed version when the 2023 PCA is in the device's DB.⁴
The file is bootmgfw.efi; replacement is conditional on the 2023 PCA being in the DB.

Servicing stack

For: Azure-hosted devices

The servicing stack update adds logic to verify whether a device is hosted on Azure.⁵
The verification uses an updated certificate chain.

New features 2 changes

Windows System Image Manager

2 items

For: Windows System Image Manager users

A warning helps you check that a selected catalog file comes from a trusted source.⁶
A warning helps you check that a selected catalog file comes from a trusted source.⁶

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-03-10
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5075912, KB5078129, KB5077796, KB5073724

+32 earlier
KB5074976, KB5071546, KB5068781, KB5066791, KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by: KB5082200

Version	Build	Channel
21H2	19044.7058	General availability
22H2	19045.7058	General availability

Security

43 vulnerabilities fixed

43 important

Vulnerability	Severity	CVSS

The table lists the 0 exploited, publicly disclosed or critical vulnerabilities. See all 43 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 21H2 / 22H2

846.1 MB

windows10.0-kb5078885-x64.msu Main update · KB5078885 SHA-1: 8013483b…007a31

Arm64 21H2 / 22H2

783.2 MB

windows10.0-kb5078885-arm64.msu Main update · KB5078885 SHA-1: af3aa9e0…050f20

x86 21H2 / 22H2

532.3 MB

windows10.0-kb5078885-x86.msu Main update · KB5078885 SHA-1: b5e47e2d…396a81

Updated components

1,148 files changed since the previous update for the same versions.

Top changed components	Files
Graphics and display	36
File Explorer and shell	22
Networking	21
Security and sign-in	11
Printing	10
Storage and file systems	10
Hyper-V and virtualization	8
Kernel	8
Secure Boot	7
Settings	7
Remote Desktop	6
Search	5

Verified in package: changed files confirm Secure Boot.

Sources

Microsoft Support: KB5078885

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (6)

1. Improved: File History in Control Panel when backing up files. New files with names containing some Chinese and Private Use Area characters can now be backed up. support.microsoft.com
2. Improved: A stability issue affecting certain GPU configurations. support.microsoft.com
3. Devices receive new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout. support.microsoft.com
4. This SSU update replaces the 2011 signed bootmgfw.efi with the 2023 signed bootmgfw.efi if the 2023 PCA is in the DB. support.microsoft.com
5. This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. support.microsoft.com
6. This update adds a warning dialog to help users confirm that the selected catalog file comes from a trusted source. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 25, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake