Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday

KB5087420

KB5087420: Cumulative update for Windows 11, version 23H2, May 2026. Critical DNS Client flaw patched; BitLocker recovery prompt remains

In short

Critical vulnerabilities include a DNS Client remote code execution flaw. Some managed PCs might ask for a BitLocker recovery key after the first restart.

Does it affect you? Applies to: Devices running Windows 11, version 23H2, on x64 or Arm64. The end-of-updates date applies to Enterprise and Education editions; the issue described affects a limited number of IT-managed systems.

Build
22631.7079
Security
56 fixed · 5 critical
Restart
Required

What changes

Improvements 4 changes

Secure Boot

Gradual rollout Verified in package

For: devices eligible for new Secure Boot certificates

  • More eligible devices can receive new Secure Boot certificates through a phased rollout.1
    Windows quality updates add high-confidence device targeting data. Devices receive certificates after enough successful update signals.

Country and Operator Settings Asset (COSA)

Verified in package
  • Profiles for certain mobile operators are updated.2

Daylight saving time (DST)

For: devices in the Arab Republic of Egypt

  • The update supports Egypt’s 2023 daylight saving time change.3

Microsoft Defender SmartScreen

  • SmartScreen can send file hashes for unsigned files to improve app reputation checks.4
    The Windows shell sends hashes for unsigned files so SmartScreen can use newer reputation models.

New features 2 changes

Secure Boot

Verified in package
  • Eligible devices get a folder with example scripts for organizations that manage Secure Boot updates.5
    The C:\Windows\SecureBoot folder contains scripts to check certificate update status and automate deployment in an Active Directory environment.

Enterprise State Roaming (ESR)

  • IT administrators can manage Enterprise State Roaming through Windows Backup for Organizations policies.6

Fix 1 change

Remote Desktop

Verified in package

For: people using multiple monitors with different scaling settings

  • The Remote Desktop security warning dialog displays correctly on monitors with different scaling settings.7
    Addresses incorrect rendering of the Remote Desktop Connection security warning dialog in multi-monitor setups with different scaling, which might occur after KB5082052.

Known issues

  1. Open Affects: Organizations and IT administrators

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    Some managed PCs might ask for the BitLocker recovery key on the first restart after installing this update. This affects systems with BitLocker on the OS drive, PCR7 in the TPM validation profile, PCR7 binding reported as “Not Possible,” the Windows UEFI CA 2023 certificate present, and a boot manager not yet signed with 2023.8

    How to apply the workaround Group Policy

    Removing the policy lets Windows use its default PCR profile and updates the BitLocker bindings.8

    Step-by-step instructions, command & download kit
    4 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. In Group Policy Editor or Group Policy Management Console, open Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
    2. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    3. Run gpupdate /force to apply the policy change.
    4. If BitLocker is enabled on C:, run the suspend command, then the resume command.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-05-12
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5082052, KB5078883, KB5075941, KB5078132
+51 earlier KB5077797, KB5073455, KB5071417, KB5070312, KB5068865, KB5067112, KB5066793, KB5065790, KB5065431, KB5064080, KB5066189, KB5063875, KB5062663, KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5093998
VersionBuildChannel
23H2 22631.7079 General availability

Security

56 vulnerabilities fixed
5 critical 51 important
VulnerabilitySeverityCVSS
CVE-2026-41096
Windows DNS Client Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-40402
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 9.3
CVE-2026-40403
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-35421
Windows GDI Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-32161
Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 56 vulnerabilities →

Updated components

1,598 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display32
Networking19
File Explorer and shell14
Hyper-V and virtualization11
Security and sign-in8
Kernel7
Remote Desktop7
Printing6
Secure Boot6
Storage and file systems4
Audio2
Emoji and input2

Verified in package: changed files confirm Secure Boot, Country and Operator Settings Asset (COSA), Remote Desktop.

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. This update brings profiles up to date for certain mobile operators. support.microsoft.com
  3. 3. This update supports the 2023 DST change for the Arab Republic of Egypt. support.microsoft.com
  4. 4. This update enables Microsoft Defender SmartScreen in the Windows shell to send file hashes for unsigned files. support.microsoft.com
  5. 5. This update adds a new SecureBoot folder under C:\Windows on eligible devices. support.microsoft.com
  6. 6. ESR can now be managed through Windows Backup for Organizations policies. support.microsoft.com
  7. 7. Fixed: This update addresses an issue that affects the Remote Desktop Connection security warning dialog. The dialog could render incorrectly in multi-monitor scenario when the monitors had different scaling set. support.microsoft.com
  8. 8. Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake