Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday

KB5082200

KB5082200: Cumulative update for Windows 10, versions 21H2 and 22H2, April 2026. Critical IKE and TCP/IP remote-code flaws patched

In short

The update fixes 106 security flaws, including two critical remote-code execution vulnerabilities in IKE and TCP/IP. It also fixes Microsoft-account sign-in problems and adds safer handling of Remote Desktop files.

Does it affect you? Applies to: Windows 10, version 22H2 devices covered by the Windows 10 ESU program, and Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021 devices on version 21H2.

Builds
19044.7184 · 19045.7184
Security
106 fixed · 2 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • What changes Secure Boot certificates used by most Windows devices started expiring in June 2026. If they are not updated in time, some devices might not boot securely; Microsoft recommends reviewing the guidance and updating certificates in advance.
  • What changes The servicing stack update changes how Windows verifies whether a device is hosted on Azure, using an updated certificate chain.

The official sources are linked at the end of the page.

What changes

Improvements 7 changes

Remote Desktop

Verified in package 2 items
  • When you open an .rdp file, Remote Desktop shows the requested connection settings before connecting, with each setting off by default. A one-time security warning appears the first time you open an .rdp file on a device.1
    Improves protection against phishing attacks that use Remote Desktop (.rdp) files.
  • When you open an .rdp file, Remote Desktop shows the requested connection settings before connecting, with each setting off by default. A one-time security warning appears the first time you open an .rdp file on a device.1
    Improves protection against phishing attacks that use Remote Desktop (.rdp) files.

Secure Boot

Gradual rollout Verified in package 2 items
  • More eligible devices can automatically receive new Secure Boot certificates, but they get the certificates only after showing sufficient successful update signals.2
    Windows quality updates include additional high-confidence device-targeting data to expand eligible-device coverage while maintaining a controlled, phased rollout.
  • More eligible devices can automatically receive new Secure Boot certificates, but they get the certificates only after showing sufficient successful update signals.2
    Windows quality updates include additional high-confidence device-targeting data to expand eligible-device coverage while maintaining a controlled, phased rollout.

Vulnerable driver blocklist

Verified in package 2 items

For: users of backup apps that rely on blocked drivers

  • Known vulnerable kernel drivers are added to the blocklist. Backup apps that rely on blocked drivers might fail when mounting or managing disk images.3
    Affected backup apps might report that Microsoft VSS timed out during snapshot creation or return VSS_E_BAD_STATE. Microsoft advises affected users to update to an app version with newer drivers that include the required protections.
  • Known vulnerable kernel drivers are added to the blocklist. Backup apps that rely on blocked drivers might fail when mounting or managing disk images.3
    Affected backup apps might report that Microsoft VSS timed out during snapshot creation or return VSS_E_BAD_STATE. Microsoft advises affected users to update to an app version with newer drivers that include the required protections.

Licensing

For: IT administrators creating LTSC images

  • DISM can add security packages during offline image creation for the listed LTSC editions.4
    Addresses licensing-enforcement limits that prevented DISM offline operations from applying security updates to Windows 10 IoT Enterprise LTSC 2021, Windows 10 Enterprise G SKU, and Windows 10 Enterprise N LTSC.

Fixes 4 changes

Sign-In

Verified in package 2 items
  • Fixes a problem that could prevent some users from signing in to apps with a Microsoft account, even when the device had an Internet connection.5
    The issue affected sign-in to Microsoft services and apps such as Microsoft Teams after installing a Windows update released on or after March 10, 2026.
  • Fixes a problem that could prevent some users from signing in to apps with a Microsoft account, even when the device had an Internet connection.5
    The issue affected sign-in to Microsoft services and apps such as Microsoft Teams after installing a Windows update released on or after March 10, 2026.

Secure Boot

Verified in package 2 items
  • Fixes an issue that could cause a device to enter BitLocker Recovery after Secure Boot updates.6
  • Fixes an issue that could cause a device to enter BitLocker Recovery after Secure Boot updates.6

New features 2 changes

Secure Boot

Verified in package 2 items
  • The Windows Security app can report Secure Boot status dynamically and show alerts. This is disabled by default on commercial devices and servers.7
    Status reporting is available in Settings > Update & Security > Windows Security.
  • The Windows Security app can report Secure Boot status dynamically and show alerts. This is disabled by default on commercial devices and servers.7
    Status reporting is available in Settings > Update & Security > Windows Security.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5122878

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    A limited number of devices might require the BitLocker recovery key on the first restart after installing this update. This applies only when all conditions are met: BitLocker is enabled on the OS drive; the Group Policy Configure TPM platform validation profile for native UEFI firmware configurations is set with PCR7 included, or the equivalent registry key is set manually; System Information reports PCR7 Binding as Not Possible; the Windows UEFI CA 2023 certificate is in the Secure Boot Signature Database; and the device is not already running the 2023-signed Windows Boot Manager. The key is needed only once if the policy remains unchanged. KB5122878 addresses the issue.8

    How to apply the workaround Group Policy

    Removing the incompatible policy lets BitLocker use the Windows-selected default PCR profile. Suspending and resuming BitLocker updates its bindings.8

    Step-by-step instructions, command & download kit
    4 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. In Group Policy Editor or the Group Policy Management Console, open Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
    2. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    3. Run gpupdate /force on affected devices.
    4. If BitLocker is enabled on the C: drive, run the suspend command, then the resume command.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:
  2. Resolved Affects: Everyone Resolved by KB5087544

    Remote Desktop security warnings might not display correctly

    The Remote Desktop security warning might show overlapping text or partly hidden buttons when monitors use different display scaling settings. This issue is resolved by KB5087544.9

    Resolution Fixed in KB5087544

    Install KB5087544 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-04-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5078885, KB5075912, KB5078129, KB5077796
+33 earlier KB5073724, KB5074976, KB5071546, KB5068781, KB5066791, KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by
KB5087544
VersionBuildChannel
21H2 19044.7184 General availability
22H2 19045.7184 General availability

Security

106 vulnerabilities fixed
2 critical 103 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2026-33824
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-33827
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.1

The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 106 vulnerabilities →

Updated components

2,817 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display38
Audio30
Secure Boot27
File Explorer and shell26
Networking24
Security and sign-in24
Search21
Kernel17
Remote Desktop15
Settings15
Hyper-V and virtualization13
Bluetooth6

Verified in package: changed files confirm Remote Desktop, Secure Boot, Vulnerable driver blocklist, Sign-In.

Sources

Updated
Cited passages from Microsoft's official notes (9)
  1. 1. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. support.microsoft.com
  2. 2. With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  3. 3. This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. support.microsoft.com
  4. 4. Now, you can use DISM to add security packages during offline image creation for LTSC. support.microsoft.com
  5. 5. Fixed: After you install the Windows update released on or after March 10, 2026, some users might experience an issue signing in to apps with a Microsoft account. support.microsoft.com
  6. 6. This update fixes an issue that could cause a device to enter BitLocker Recovery after Secure Boot updates. support.microsoft.com
  7. 7. This update enables dynamic status reporting for Secure Boot states in the Windows Security App (Settings > Update & Security > Windows Security). support.microsoft.com
  8. 8. This issue is addressed in update KB5122878. After installing update KB5122878, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. support.microsoft.com
  9. 9. This issue is resolved in Windows updates released on and after May 12, 2026 (such as KB5087544). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake