KB5083769

Microsoft has released cumulative update KB5083769 for Windows 11, version 25H2 (2025 Update) as part of Patch Tuesday (April 2026). This update includes quality improvements — no new system features are introduced, however it contains all fixes and changes from the previous update KB5086672 (Build 26200.8117), and brings refinements to the Settings app with improved structure and data display, fixes and new features in File Explorer, as well as support for displays with a refresh rate of 1000 Hz and higher.

• Secure Boot. The Windows Security app (Settings > Privacy & security > Windows Security) may now display the status of Secure Boot certificate updates. The system shows notifications and status icons. On commercial devices this feature is disabled by default. As part of the Windows quality update, additional data has been added to accurately determine compatible devices, expanding the list of devices that can automatically receive new Secure Boot certificates. Certificate installation occurs in stages — only on devices where successful updates have been recorded, ensuring controlled roll-out.
• Network. Improved reliability when using SMB compression over QUIC. After installing the update, such requests perform more stably, reducing the likelihood of timeouts and improving overall connection performance.
• Remote Desktop. Enhanced protection against phishing attacks using Remote Desktop (.rdp) files. Now when opening an .rdp file, all connection parameters are displayed before the connection is established, and they are disabled by default. The first time you open such a file, a security warning also appears.

Fixed an issue where the device could enter BitLocker recovery mode after Secure Boot updates. Also resolved an error where resetting the device could fail when selecting the Keep my files or Remove everything options — this issue occurred after installing security update KB5079420 (hotpatch for March 2026). If you have installed previous updates, only the new updates contained in this package will be downloaded and installed on your device.

Cumulative update KB5083769 for PCs installs automatically via Windows Update. To check, go to Settings > Windows Update and click Check for updates. A system restart is required to complete installation. After the update, the Windows 11 build number will change to 26200.8246.

Please note! Update KB5083769 is delivered in a checkpoint format. These cumulative updates will be smaller in size and contain only changes since the last checkpoint, speeding up the download process.

Before installing KB5083769, you must install the previous updates — KB5043080 (Build 26200.1742) for Windows 11, version 25H2. You can also manually download update KB5083769 from the links above.

How the new features work:

Secure Boot: Secure Boot certificate updates are now managed in stages via the Windows quality update mechanism. The system checks device compatibility using additional telemetry data, and only after successful installation on pilot devices are certificates rolled out further. On commercial builds, the feature is forcibly disabled. Notifications in the Windows Security app display status via local policies and state flags.

Network: Improved stability of SMB compression over the QUIC protocol. When transferring data via RDMA and QUIC, the frequency of timeouts is reduced by optimizing buffer management and packet retransmission. The SMB stack adapts to variable latency in lossy networks, which is especially important for remote connections. The mechanism applies automatically when QUIC support is detected on both nodes.

Remote Desktop: Enhanced protection against phishing via RDP files. When opening an .rdp file, the system parses connection parameters and displays them to the user before the session is established, blocking dangerous redirections (e.g., redirected drives). All advanced features are disabled by default. The first opening is accompanied by a separate warning via SmartScreen and a confirmation dialog.

The last 10 Windows updates: