Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday

KB5082052

KB5082052: Cumulative update for Windows 11, version 23H2, April 2026. Remote Desktop shows connection settings; Microsoft sign-in fixed

In short

Remote Desktop shows requested settings before connecting, and a Microsoft account sign-in error is fixed. The update also adds protections against vulnerable kernel drivers.

Does it affect you? Applies to: This update applies to devices running Windows 11, version 23H2. Version 23H2 Enterprise and Education editions reach the end of updates on November 10, 2026.

Build
22631.6936
Security
114 fixed · 2 critical
Restart
Required
Review notes Additional details from the official release notes (3) Read notes
  • Known issues The relevant configuration is a Group Policy setting for TPM platform validation; it is not a UEFI policy.
  • Known issues KB5093998 addresses this BitLocker recovery issue. If Event ID 1032 appears, Microsoft recommends removing the Group Policy configuration before installing updates.
  • Known issues KB5087420 addresses the Remote Desktop warning display issue.

The official sources are linked at the end of the page.

What changes

Improvements 5 changes

Secure Boot

Gradual rollout Verified in package
  • More eligible devices can receive new Secure Boot certificates automatically, in a controlled, phased rollout.1
    Windows quality updates include additional high confidence device targeting data. Devices receive new certificates only after showing sufficient successful update signals.

Networking

Verified in package
  • SMB compression over QUIC completes more consistently, reducing the chance of timeouts.2

Remote Desktop

Verified in package

For: devices that open .rdp files

  • Remote Desktop shows the requested connection settings before connecting. A one-time security warning appears the first time an .rdp file is opened on a device.3
    Each requested setting is turned off by default when an .rdp file is opened.

Vulnerable driver blocklist

Verified in package

For: users of backup apps that rely on blocked drivers

  • Backup apps that use blocked drivers might fail to mount or manage disk images. A newer app version with updated drivers may avoid the problem.4
    The update adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. Errors might include VSS_E_BAD_STATE or a VSS timeout during snapshot creation.

Servicing stack

  • The servicing stack gets quality improvements to help devices install Windows updates reliably.5
    The package includes servicing stack update KB5086307, build 22621.6937.

Fixes 2 changes

Secure Boot

Verified in package
  • This update addresses an issue that might send a device to BitLocker Recovery after Secure Boot updates.6

Sign-In

  • Some users can sign in to Microsoft apps again when a working internet connection was incorrectly reported as unavailable.7
    The issue affects sign-in to apps with a Microsoft account, including Microsoft Teams, after Windows updates released on or after March 10, 2026.

New feature 1 change

Secure Boot

Verified in package
  • Secure Boot certificate update status may appear in the Windows Security app.8
    The status appears in Settings > Privacy & security > Windows Security. These enhancements are disabled by default on commercial devices.

Known issues

  1. Open Affects: Organizations and IT administrators

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    Some managed devices might ask for the BitLocker recovery key once, on the first restart after this update. This requires BitLocker on the OS drive, a UEFI policy that includes PCR7, PCR7 binding reported as “Not Possible,” the Windows UEFI CA 2023 certificate in the Secure Boot Signature Database, and a device not already running the 2023-signed Windows Boot Manager.9

    How to apply the workaround Group Policy

    Removing explicit PCR7 settings lets BitLocker use the Windows-selected default PCR profile.9

    Step-by-step instructions, command & download kit
    4 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. In Group Policy Editor or the Group Policy Management Console, open Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
    2. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    3. Run gpupdate /force to apply the policy change.
    4. If BitLocker is enabled on the C: drive, suspend it and then resume it with the commands below.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:
  2. Open Affects: Everyone

    Warnings related to Remote Desktop might not display correctly

    Remote Desktop security warnings might show overlapping text or partly hidden buttons when monitors use different display scaling settings.10

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Security

114 vulnerabilities fixed
2 critical 111 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2026-33824
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-33827
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.1

The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 114 vulnerabilities →

Updated components

2,357 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display30
Networking23
Audio21
File Explorer and shell20
Security and sign-in19
Settings18
Secure Boot16
Hyper-V and virtualization14
Kernel13
Search12
Remote Desktop10
Emoji and input5

Verified in package: changed files confirm Secure Boot, Networking, Remote Desktop, Vulnerable driver blocklist.

Sources

Updated
Cited passages from Microsoft's official notes (10)
  1. 1. Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout. support.microsoft.com
  2. 2. After you install this update, SMB compression requests over QUIC complete more consistently, reducing the likelihood of timeouts and supporting smoother, more dependable performance. support.microsoft.com
  3. 3. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. support.microsoft.com
  4. 4. This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. support.microsoft.com
  5. 5. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  6. 6. This update addresses an issue where the device might enter BitLocker Recovery after the Secure Boot updates. support.microsoft.com
  7. 7. Even when the device has a working Internet connection, a “no Internet” error appears during sign in and prevents access to Microsoft services and apps such as Microsoft Teams. support.microsoft.com
  8. 8. The status of Secure Boot certificate updates on your device may be displayed in the Windows Security app (Settings > Privacy & security > Windows Security). support.microsoft.com
  9. 9. If you receive Event ID 1032, Microsoft strongly recommends removing the Group Policy configuration before installing updates so that you can install the 2023-signed Windows Boot Manager and continue to receive the latest Secure Boot protections. support.microsoft.com
  10. 10. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake