Skip to the content
The Update Bureau
Windows 11 26H1 Windows 11 26H1 Security update
Patch Tuesday

KB5083768

KB5083768

Cumulative update for Windows 11, version 26H1, April 2026

In short

Remote code execution flaws in Remote Desktop, IKE and TCP/IP are among the security fixes. Secure Boot certificates and Remote Desktop warnings also get changes.

Does it affect you? Applies to: Devices running Windows 11, version 26H1. AI component updates apply only to Copilot+ PCs.

Build
28000.1836
Security
119 fixed · 3 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • What changes The status of Secure Boot certificate updates may be displayed in the Windows Security app.
  • Known issues Microsoft says the Remote Desktop warning display issue is addressed in KB5083806.

The official sources are linked at the end of the page.

What changes

Improvements 5 changes

Secure Boot

Gradual rollout Verified in package

For: Devices eligible for new Secure Boot certificates

  • More eligible devices can receive new Secure Boot certificates. The rollout is controlled and happens in phases.1
    Windows quality updates include additional high confidence device targeting data. Devices receive new certificates only after showing enough successful update signals.

Networking

Verified in package
  • SMB compression over QUIC completes more reliably, reducing the chance of timeouts.2
    Improves reliability when Windows uses SMB compression over QUIC.

Remote Desktop

Verified in package

For: People opening .rdp files

  • Remote Desktop shows requested connection settings before connecting from an .rdp file. Settings are off by default, and a one-time warning appears the first time you open such a file.3
    Improves protection against phishing attacks that use Remote Desktop (.rdp) files.

AI components

Verified in package
  • Four AI components receive updates on Copilot+ PCs.4
    Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2602.1451.0. These components do not install on other Windows PCs or Windows Server.

Servicing stack

For: Devices installing Windows updates

  • The component that installs Windows updates receives quality improvements.5
    Includes servicing stack update KB5088834, build 28000.1837.

Fix 1 change

Secure Boot

Verified in package

For: Devices receiving Secure Boot updates

  • Addresses an issue that might send a device into BitLocker Recovery after Secure Boot updates.6

New feature 1 change

Secure Boot

Verified in package

For: Windows devices; disabled by default on commercial devices

  • Windows Security can show the status of Secure Boot certificate updates.7
    The status appears in Windows Security under Settings > Privacy & security > Windows Security. These enhancements are disabled by default on commercial devices.

Known issues

  1. Open Affects: Everyone

    Warnings related to Remote Desktop might not display correctly

    After this update, Remote Desktop security warnings might display incorrectly when monitors use different scaling settings. Text might overlap, or buttons might be partly hidden.8

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-04-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5079489, KB5079466, KB5077239, KB5077179
Replaced by
KB5089548
VersionBuildChannel
26H1 28000.1836 General availability
26H1 28000.1836 Release Preview Channel

Security

119 vulnerabilities fixed
3 critical 115 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2026-33824
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-32157
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-33827
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.1

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 119 vulnerabilities →

Updated components

2,828 files changed since the previous update for the same versions.

Top changed componentsFiles
Networking32
Audio26
Graphics and display26
Security and sign-in24
Settings20
File Explorer and shell19
Printing16
Hyper-V and virtualization15
Secure Boot15
Remote Desktop14
Search13
Kernel11

Verified in package: changed files confirm Secure Boot, Networking, Remote Desktop, AI components.

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout. support.microsoft.com
  2. 2. After you install this update, SMB compression requests over QUIC complete more consistently, reducing the likelihood of timeouts and supporting smoother, more dependable performance. support.microsoft.com
  3. 3. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. support.microsoft.com
  4. 4. This release updates the following AI components: support.microsoft.com
  5. 5. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  6. 6. This update addresses an issue where the device might enter BitLocker Recovery after the Secure Boot updates. support.microsoft.com
  7. 7. The status of Secure Boot certificate updates on your device may be displayed in the Windows Security app (Settings > Privacy & security > Windows Security). support.microsoft.com
  8. 8. After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake