Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday

KB5087544

KB5087544: Cumulative update for Windows 10, versions 21H2 and 22H2, May 2026. Secure Boot certificates begin expiring; Remote Desktop warning fixed

In short

Secure Boot certificates have started expiring in June 2026, which might affect secure booting on some devices if they are not updated in time; Microsoft recommends reviewing its preparation guidance. The update also fixes a Remote Desktop warning display issue.

Does it affect you? Applies to: This update applies to Windows 10, version 22H2 devices enrolled in the ESU program, and Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021 devices running version 21H2.

Builds
19044.7291 · 19045.7291
Security
54 fixed · 3 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • What to do The latest SSU must be installed before applying Windows updates. Without it, an update might not be offered until the SSU is installed.
  • In detail The 21H2 editions receiving this update are Enterprise LTSC 2021 and IoT Enterprise LTSC 2021. Their support ends January 12, 2027, and January 13, 2032, respectively.

The official sources are linked at the end of the page.

What changes

Improvements 3 changes

Secure Boot

Gradual rollout Verified in package 2 items
  • Windows Security can report Secure Boot status dynamically.1
    Enables dynamic status reporting for Secure Boot states in Windows Security App.
  • More eligible devices can be identified for automatic Secure Boot certificate updates, which continue to roll out in phases.2
    Windows quality updates include additional high confidence device targeting data. Devices receive new certificates only after demonstrating sufficient successful update signals.

Daylight Savings Time

Verified in package

For: Devices using Egypt’s time settings

  • Daylight-saving time settings are updated for Egypt to support its government’s 2023 change order.3

Fix 1 change

Remote Desktop security warnings

Verified in package

For: Windows 10, versions 22H2 and 21H2

  • The Remote Desktop Connection security warning dialog displays correctly in multi-monitor setups with different display scaling settings.4
    The issue might occur after installing KB5082200.

New feature 1 change

Secure Boot

Verified in package

For: Eligible devices; IT administrators

  • Eligible devices get a SecureBoot folder with sample scripts for organizations that manage updates across a device fleet.5
    The C:\Windows\SecureBoot folder contains scripts to detect certificate update status and automate deployment through a safe rollout mechanism in an Active Directory environment.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5122878

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    On a limited number of devices, the first restart after installing the update might prompt for the BitLocker recovery key. This requires all of these conditions: BitLocker is enabled on the OS drive; the Group Policy Configure TPM platform validation profile for native UEFI firmware configurations includes PCR7; System Information reports PCR7 Binding as Not Possible; the Windows UEFI CA 2023 certificate is in the Secure Boot Signature Database; and the device is not already running the 2023-signed Windows Boot Manager. The issue is resolved by KB5122878.6

    How to apply the workaround Group Policy

    Removing the explicit PCR7 setting lets Windows use its selected default PCR profile for BitLocker bindings.6

    Step-by-step instructions, command & download kit
    4 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. In Group Policy Editor or the Group Policy Management Console, open Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
    2. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    3. Run gpupdate /force on affected devices.
    4. If BitLocker is enabled on the C: drive, suspend it and then resume it to update the BitLocker bindings.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-05-12
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5082200, KB5078885, KB5075912, KB5078129
+34 earlier KB5077796, KB5073724, KB5074976, KB5071546, KB5068781, KB5066791, KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by
KB5094127
VersionBuildChannel
21H2 19044.7291 General availability
22H2 19045.7291 General availability

Security

54 vulnerabilities fixed
3 critical 51 important
VulnerabilitySeverityCVSS
CVE-2026-40403
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-35421
Windows GDI Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-32161
Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 54 vulnerabilities →

Updated components

2,334 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display41
Secure Boot21
Networking20
Security and sign-in20
File Explorer and shell18
Hyper-V and virtualization13
Audio12
Printing10
Remote Desktop10
Kernel9
Storage and file systems7
Settings4

Verified in package: changed files confirm Secure Boot, Daylight Savings Time, Remote Desktop security warnings.

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This update enables dynamic status reporting for Secure Boot states in Windows Security App. support.microsoft.com
  2. 2. With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  3. 3. Update for Arab Republic of Egypt to support the government DST change order in 2023. support.microsoft.com
  4. 4. Fixed: The Remote Desktop Connection security warning dialog might render incorrectly in multi-monitor configurations with different display scaling settings. support.microsoft.com
  5. 5. This update adds a new SecureBoot folder under C:\Windows on eligible devices. support.microsoft.com
  6. 6. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake