May 12, 2026—KB5087544 (OS Builds 19045.7291 and 19044.7291)

May 12, 2026—KB5087544 OS Builds 19045.7291 and 19044.7291 Windows Secure Boot certificate expirationImportant: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business device...

May 12, 2026—KB5087541 (OS Build 25398.2330)

May 12, 2026—KB5087541 OS Build 25398.2330 This cumulative update for Windows Server, version 23H2 KB5087541, includes the latest security fixes and improvements, along with non-security updates from last month’s optional preview release. To learn more about differences between security updates,...

May 12, 2026—KB5087537 (OS Build 14393.9140)

May 12, 2026—KB5087537 OS Build 14393.9140 Windows Secure Boot certificate expirationImportant: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices for the past...

May 12, 2026—KB5087471 (Monthly Rollup)

May 12, 2026—KB5087471 Monthly Rollup Important The installation of this Extended Security Update ESU might fail when you try to install it on an Azure Arc-enabled device that is running Windows Server 2012 R2. For a successful installation, please make sure all Subset of endpoints for ESU only a...

March 10, 2026—KB5078883 (OS Build 22631.6783)

March 10, 2026—KB5078883 OS Build 22631.6783 ​​​​​This cumulative update for Windows 11, version 23H2 KB5078883, includes the latest security fixes and improvements, along with non-security updates from last month’s optional preview release. To learn more about differences between security update...

KB5078738: Cumulative security update for Internet Explorer: March 10, 2026

KB5078738: Cumulative security update for Internet Explorer: March 10, 2026 Important Certain versions of Microsoft Internet Explorer have reached the end of support. Note that some versions of Internet Explorer may be supported past the latest OS end date when Extended Security Updates ESUs are...

March 10, 2026—Hotpatch KB5078736 (OS Build 26100.32463)

March 10, 2026—Hotpatch KB5078736 OS Build 26100.32463 This update applies to Windows Server 2025 Datacenter & Standard machines connected to Azure Arc. To learn more about differences between security updates, optional non-security preview updates, out-of-band OOB updates, and continuous...

February 10, 2026—Hotpatch KB5075943 (OS Build 20348.4711)

February 10, 2026—Hotpatch KB5075943 OS Build 20348.4711 This Hotpatch update for Windows Server 2022 KB5075943, improves functionality, performance, and reliability. To learn more about differences between security updates, optional non-security preview updates, out-of-band OOB updates, and...

February 10, 2026—Hotpatch KB5075942 (OS Build 26100.32313)

February 10, 2026—Hotpatch KB5075942 OS Build 26100.32313 This update applies to Windows Server 2025 Datacenter & Standard machines connected to Azure Arc. To learn more about differences between security updates, optional non-security preview updates, out-of-band OOB updates, and continuous...

January 17, 2026—KB5077796 (OS Builds 19045.6811 and 19044.6811) Out-of-band

January 17, 2026—KB5077796 OS Builds 19045.6811 and 19044.6811 Out-of-band Windows Secure Boot certificate expirationImportant: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed...

January 17, 2026—KB5077795 (OS Build 17763.8280) Out-of-band

January 17, 2026—KB5077795 OS Build 17763.8280 Out-of-band Windows Secure Boot certificate expirationImportant: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business device...

CVE-2026-21265

CVE-2026-21265 describes a Secure Boot bypass tied to expiration of Microsoft root certificates in the UEFI KEK/DB chain. Affected certificates include KEK CA 2011 (expires 2026-06-24), UEFI CA 2011 (expires 2026-06-27), and Windows Production PCA 2011 (expires 2026-10-19). The vulnerability aris...

CVE-2026-21265

Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes...

January 13, 2026—KB5073696 (Monthly Rollup)

January 13, 2026—KB5073696 Monthly Rollup Important The installation of this Extended Security Update ESU might fail when you try to install it on an Azure Arc-enabled device that is running Windows Server 2012 R2. For a successful installation, please make sure all Subset of endpoints for ESU on...

December 9, 2025—KB5071507 (Security-only update)

December 9, 2025—KB5071507 Security-only update Windows Secure Boot certificate expirationImportant: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices for the...

December 9, 2025—KB5071506 (Security-only update)

December 9, 2025—KB5071506 Security-only update Windows Secure Boot certificate expirationImportant: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices for the...

October 14, 2025—KB5066836 (OS Build 14393.8519)

October 14, 2025—KB5066836 OS Build 14393.8519 Windows Secure Boot certificate expirationImportant: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices for the pa...

October 14, 2025—KB5066780 (OS Build 25398.1913)

October 14, 2025—KB5066780 OS Build 25398.1913 Windows Secure Boot certificate expirationImportant: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices for the pa...

KB5071813: Servicing stack update for Windows Server 2012: November 11, 2025

KB5071813: Servicing stack update for Windows Server 2012: November 11, 2025 Windows Secure Boot certificate expirationImportant: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-manag...

September 9, 2025—Hotpatch KB5065306 (OS Build 20348.4106)

September 9, 2025—Hotpatch KB5065306 OS Build 20348.4106 Windows Secure Boot certificate expirationImportant: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices...