Skip to the content
The Update Bureau
Windows 11 24H2 / 25H2 Windows 11 24H2 / 25H2 Security update
Patch Tuesday

KB5083769

KB5083769: Cumulative update for Windows 11, versions 24H2 and 25H2, April 2026. Critical IKE and TCP/IP flaws; Secure Boot status added

In short

Critical remote-code flaws affect Windows IKE and TCP/IP. The update also adds Secure Boot certificate status in Windows Security and hardens the blocklist for vulnerable drivers.

Does it affect you? Applies to: This update applies to Windows 11, versions 25H2 and 24H2, on x64 and Arm64 devices. The BitLocker issue is limited to some devices with a specific managed policy setup.

Builds
26100.8246 · 26200.8246
Security
120 fixed · 2 critical
Restart
Required

What changes

Improvements 6 changes

Secure Boot

Gradual rollout Verified in package

For: Devices eligible for new Secure Boot certificates

  • More eligible devices can receive new Secure Boot certificates automatically, through a controlled, phased rollout.1
    Windows quality updates include additional high-confidence device targeting data. New certificates are offered after devices show enough successful update signals.

Networking

Verified in package
  • SMB compression over QUIC completes more reliably, with fewer timeouts.2

Remote Desktop

Verified in package

For: People opening Remote Desktop files

  • Remote Desktop shows requested connection settings before connecting, with each setting off by default. A one-time security warning appears the first time you open an .rdp file on a device.3
    These changes protect against phishing attacks that use Remote Desktop (.rdp) files.

Vulnerable driver blocklist

Verified in package
  • The blocklist adds known vulnerable kernel drivers. Some backup apps that rely on blocked drivers might fail when managing disk images.4
    Affected apps might show errors such as VSS_E_BAD_STATE or a message that Microsoft VSS timed out during snapshot creation. Microsoft advises updating to an app version with newer drivers.

AI components

Verified in package
  • AI components receive updates for Copilot+ PCs.5
    Image Search, Content Extraction, Semantic Analysis, and Settings Model update to version 1.2603.377.0. These components apply only to Copilot+ PCs.

Servicing stack

For: Devices installing this update

  • The component that installs Windows updates receives quality improvements.6
    The combined package includes servicing stack update KB5088467, build 26100.8247.

Fixes 2 changes

Secure Boot

Verified in package
  • Addresses a problem that might send a device to BitLocker Recovery after Secure Boot updates.7

Reset this PC

  • Addresses a problem that might make Reset this PC fail when you choose to keep your files or remove everything.8
    The issue might occur after installing the March 2026 KB5079420 Hotpatch security update.

New feature 1 change

Secure Boot

Verified in package

For: Windows devices; disabled by default on commercial devices

  • Windows Security can show whether Secure Boot certificate updates have reached your device. The status feature is off by default on commercial devices.9
    The status appears in Windows Security under Settings > Privacy & security > Windows Security.

Known issues

  1. Open Affects: Organizations and IT administrators

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    Some devices with a specific BitLocker policy and Secure Boot setup might ask for the recovery key on the first restart after installing this update. The page lists the issue for this update and says KB5089549 addresses it.10

    How to apply the workaround Group Policy

    Removing the policy lets Windows use its selected default PCR profile for BitLocker bindings. The policy change should be propagated, and BitLocker protection suspended and resumed, if enabled on the C: drive.10

    Step-by-step instructions, command & download kit
    4 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. In Group Policy Editor or the Group Policy Management Console, go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
    2. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    3. Run the commands below on affected devices.
    4. Alternatively, temporarily suspend BitLocker, run Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update", restart the device, then enable BitLocker again.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:
  2. Open Affects: Everyone

    Warnings related to Remote Desktop might not display correctly

    On some multi-monitor setups with different display scaling settings, the Remote Desktop warning might show overlapping text or partly hidden buttons. The page lists the issue for this update and says KB5083631 addresses it.11

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-04-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5086672, KB5079391, KB5085516, KB5079473
+48 earlier KB5077241, KB5077181, KB5074105, KB5078127, KB5077744, KB5074109, KB5072033, KB5070311, KB5068861, KB5067036, KB5070773, KB5066835, KB5065789, KB5068221, KB5065426, KB5064081, KB5063878, KB5062660, KB5064489, KB5062553, KB5060829, KB5063060, KB5060842, KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5089549
VersionBuildChannel
24H2 26100.8246 General availability
25H2 26200.8246 General availability

Security

120 vulnerabilities fixed
2 critical 117 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2026-33824
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-33827
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.1

The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 120 vulnerabilities →

Updated components

2,638 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display26
Networking26
Audio20
File Explorer and shell20
Security and sign-in19
Settings18
Secure Boot16
Hyper-V and virtualization15
Printing15
Kernel13
Search13
Remote Desktop12

Verified in package: changed files confirm Secure Boot, Networking, Remote Desktop, Vulnerable driver blocklist, AI components.

Sources

Updated
Cited passages from Microsoft's official notes (11)
  1. 1. Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. SMB compression requests over QUIC complete more consistently, reducing the likelihood of timeouts support.microsoft.com
  3. 3. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. support.microsoft.com
  4. 4. This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. support.microsoft.com
  5. 5. Image Search 1.2603.377.0 Content Extraction 1.2603.377.0 Semantic Analysis 1.2603.377.0 Settings Model 1.2603.377.0 support.microsoft.com
  6. 6. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  7. 7. This update addresses an issue where the device might enter BitLocker Recovery after the Secure Boot updates. support.microsoft.com
  8. 8. This update addresses an issue that might cause device reset to fail when using the “Keep my files” or “Remove everything” options. support.microsoft.com
  9. 9. The status of Secure Boot certificate updates on your device may be displayed in the Windows Security app support.microsoft.com
  10. 10. This issue is addressed in KB5089549. support.microsoft.com
  11. 11. This issue is addressed in KB5083631. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 11 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake