The Update BureauKB5082123: Cumulative update for Windows 10, version 1809, April 2026. Critical IKE and TCP/IP flaws patched; .rdp files get safer prompts
Fixes 99 vulnerabilities, including two critical remote code execution flaws in IKE service extensions and TCP/IP. It also adds security checks when opening .rdp files and changes Secure Boot reporting.
Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSC 2019, version 1809.
Review notes Additional details from the official release notes (1) Read note
- What changes The included KB5082118 servicing stack update adds logic to verify whether a device is hosted on Azure, using an updated certificate chain.
The official sources are linked at the end of the page.
Microsoft publishes separate notes for this KB for Windows Server.
What changes
Improvements 3 changes
Remote Desktop
- Before connecting from an .rdp file, Remote Desktop shows the requested connection settings, with each setting turned off by default. A one-time security warning appears the first time you open an .rdp file on the device.1
Secure Boot
For: devices eligible for automatic Secure Boot certificate updates
-
More eligible devices can automatically receive new Secure Boot certificates, with a controlled rollout based on successful update signals.2
Windows quality updates include additional high-confidence device targeting data. Certificates are delivered only after devices show sufficient successful update signals.
Vulnerable driver blocklist
For: users of backup applications that rely on blocked drivers
-
Known vulnerable kernel drivers are blocked. Backup apps that depend on blocked drivers might fail when mounting or managing disk images; update affected apps to versions that use newer drivers with the required protections.3
Failures might include “The backup has failed because Microsoft VSS has timed out during the snapshot creation” or
VSS_E_BAD_STATE.
Fix 1 change
Secure Boot
- A problem that could send a device into BitLocker Recovery after Secure Boot updates is fixed.4
New feature 1 change
Secure Boot
-
The Windows Security app can report Secure Boot status. These status alerts are off by default on commercial devices and servers.5
Status reporting appears in Settings > Update & Security > Windows Security.
Known issues
-
Remote Desktop security warnings might not display correctly
With multiple monitors set to different display scaling, the Remote Desktop security warning might show overlapping text or partially hidden buttons. Updates released on and after May 12, 2026, such as KB5087538, resolve the issue.6
Resolution Fixed in KB5087538Install KB5087538 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-04-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5078752, KB5075904, KB5078131, KB5077795
- Replaced by
- KB5091573
| Version | Build | Channel |
|---|---|---|
| 1809 | 17763.8644 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows TCP/IP Remote Code Execution Vulnerability
|
Critical | 8.1 |
The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 99 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
1,729 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Audio | 22 |
| Secure Boot | 19 |
| Graphics and display | 18 |
| Networking | 14 |
| Security and sign-in | 13 |
| File Explorer and shell | 12 |
| Kernel | 11 |
| Search | 8 |
| Settings | 8 |
| Hyper-V and virtualization | 7 |
| Bluetooth | 4 |
| Remote Desktop | 4 |
Verified in package: changed files confirm Remote Desktop, Secure Boot, Vulnerable driver blocklist.
Sources
Cited passages from Microsoft's official notes (6)
-
1.
When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. A one-time security warning also appears the first time you open an .rdp file on a device.
support.microsoft.com -
2.
Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout.
support.microsoft.com -
3.
This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist.
support.microsoft.com -
4.
This update fixes an issue that could cause a device to enter BitLocker Recovery after Secure Boot updates.
support.microsoft.com -
5.
Note that these enhancements are disabled by default on commercial devices and servers.
support.microsoft.com -
6.
When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 3/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake