Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday

KB5087539

KB5087539: Cumulative update for Windows Server, version 2025, May 2026. Secure Boot certificate rollout expands; ML-DSA signing added

In short

Secure Boot certificate updates can reach more eligible devices, and certificate authorities can use post-quantum signatures. The update also fixes a Remote Desktop warning dialog that could render incorrectly across monitors.

Does it affect you? Applies to: This update applies to x64 devices running Windows Server 2025. The listed changes include Secure Boot certificate updates for eligible devices and performance improvements for domain controllers with Microsoft Defender enabled.

Build
26100.32860
Security
66 fixed · 5 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • In detail KB5094125 addresses the BitLocker issue. On affected devices, Event ID 1032 may appear when installing updates.
  • Known issues KB5094125 addresses the BitLocker issue. On affected devices, Event ID 1032 may appear when installing updates.

The official sources are linked at the end of the page.

What changes

Improvements 6 changes

Secure Boot

Gradual rollout Verified in package
  • More eligible devices can receive new Secure Boot certificates, but the rollout waits for signs that updates are working well.1
    Windows quality updates include additional high-confidence device targeting data. Devices receive new Secure Boot certificates after sufficient successful update signals.

Connectivity

  • SSDP notifications work more reliably, helping prevent the service from becoming unresponsive.2
    Improves Simple Service Discovery Protocol (SSDP) notification reliability.

Daylight saving time (DST)

For: devices configured for Egypt

  • The time change for Egypt in 2023 is supported.3

Domain controllers

For: domain controllers with Microsoft Defender enabled

  • Domain controllers use less CPU and memory for some event collection when Microsoft Defender is enabled.4
    Improves LSASS performance during Event Tracing for Windows collection of IDL_DRSGetNCChanges events when Microsoft Defender is enabled.

Sign-In

For: some users signing in with a Microsoft account

  • Some users might see a “no Internet” error when signing in to apps with a Microsoft account, even when the device is online.5
    The page describes the issue after Windows updates released on or after March 10, 2026; it does not state that this update resolves it.

Servicing stack

  • The component that installs Windows updates receives quality improvements.6
    The update includes servicing stack update KB5089717, build 26100.32837.

New features 2 changes

Secure Boot

Verified in package
  • Eligible devices get a new folder with scripts that help IT teams check and deploy Secure Boot certificate updates.7
    The C:\Windows\SecureBoot folder contains sample scripts for checking certificate update status and automating deployment through a safe rollout in an Active Directory environment.

Active Directory Certificate Services

  • Certificate services can use new post-quantum signatures for certificates used in code signing and secure connections.8
    Adds support for Module-Lattice-Based Digital Signature Algorithm (ML-DSA) post-quantum signatures. Administrators can configure new certification authorities with ML-DSA-44, ML-DSA-65, or ML-DSA-87, and issue certificates for code signing, TLS, and OCSP response signing.

Fix 1 change

Remote Desktop

Verified in package

For: devices using multiple monitors with different scaling

  • The Remote Desktop security warning dialog displays correctly on monitors with different scaling settings.9
    Fixes incorrect rendering of the Remote Desktop Connection security warning dialog in multi-monitor scenarios with different scaling, an issue that could occur after the April 2026 security update.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    After KB5070881 or a later update, WSUS does not show synchronization error details in its error reports. Microsoft says this function is temporarily removed to address CVE-2025-59287.10

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    Some devices with a specific BitLocker policy might ask for the recovery key on the first restart after installing this update. Microsoft lists this issue for this update.11

    How to apply the workaround Group Policy

    Removing the explicit PCR7 setting lets Windows use its default PCR profile for BitLocker bindings.11

    Step-by-step instructions, command & download kit
    4 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Confirm all listed conditions apply, including PCR7 in the validation profile and PCR7 Binding reported as Not Possible in msinfo32.exe.
    2. In Group Policy, go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives and set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    3. Run gpupdate /force on affected devices.
    4. If BitLocker is enabled on C:, run the suspend command, then the resume command.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-05-12
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5091157, KB5082063, KB5078740, KB5075899
+24 earlier KB5078135, KB5077793, KB5073379, KB5072033, KB5072359, KB5068861, KB5070881, KB5070773, KB5066835, KB5068221, KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5044284, KB5043080
Replaced by
KB5094125
VersionBuildChannel
2025 26100.32860 General availability

Security

66 vulnerabilities fixed
5 critical 61 important
VulnerabilitySeverityCVSS
CVE-2026-41089
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-41096
Windows DNS Client Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-40403
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-35421
Windows GDI Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-32161
Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 66 vulnerabilities →

Updated components

3,583 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display39
Networking35
Audio27
Hyper-V and virtualization26
Security and sign-in22
Printing21
Search16
Settings16
Storage and file systems15
Remote Desktop14
File Explorer and shell13
Kernel13

Verified in package: changed files confirm Secure Boot, Remote Desktop.

Sources

Updated
Cited passages from Microsoft's official notes (11)
  1. 1. With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. This update improves the reliability of Simple Service Discovery Protocol (SSDP) notifications to help prevent the service from becoming unresponsive. support.microsoft.com
  3. 3. This update supports the 2023 DST change for the Arab Republic of Egypt. support.microsoft.com
  4. 4. It reduces CPU and memory usage during Event Tracing for Windows collection of IDL_DRSGetNCChanges events. support.microsoft.com
  5. 5. Even when the device has a working Internet connection, a “no Internet” error appears during sign in and prevents access to Microsoft services and apps such as Microsoft Teams. support.microsoft.com
  6. 6. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  7. 7. This update adds a new SecureBoot folder under C:\Windows on eligible devices. support.microsoft.com
  8. 8. This update adds support for Module‑Lattice‑Based Digital Signature Algorithm (ML‑DSA) post‑quantum signatures in Active Directory Certificate Services (AD CS). support.microsoft.com
  9. 9. Fixed: This update addresses an issue that affects the Remote Desktop Connection security warning dialog. support.microsoft.com
  10. 10. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
  11. 11. Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 11 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake