KB5101649

Update KB5101649 (build 28000.2525) for Windows 11 version 26H1 has been released as part of the July 2026 Patch Tuesday. The cumulative package contains various security improvements for internal OS functions and fixes 570 security issues, including three zero-day vulnerabilities. The build also includes all fixes and changes from the preliminary update KB5095091 (Build 28000.2340).

• Magnifier. Clearer Narrator announcements have been implemented, the ability to magnify protected content has been added, and the smoothness of the Lens mode has been improved.
• Task Manager. Tracking of NPU and GPU neural engines has been expanded.
• Camera. Support for Multi-App Camera and Basic Camera mode has been added.
• Windows Setup. The ability to choose a custom user folder name during the system installation stage has been introduced.
• Shell Performance. Launching apps and core interface elements — Start menu, Search, and Notification Center — has been accelerated.
• Personalization. Wallpaper retention has been improved.
• Windows Hello. The sign-in method, which is now used by default, has been refined.
• Search. File prioritization now triggers after typing just two characters.
• Dev Drive. The ability to specify the size in gigabytes has been added.
• USB and Docking Stations. The reliability of USB4 docks and the USB3 stack has been enhanced.
• Fonts. Times New Roman fonts for the Greek and Cyrillic alphabets have been updated.
• Emoji Panel. As part of standard deployment, the GIF image source has been updated (GIPHY instead of Tenor).
• Recycle Bin. Fixed the display of the file name upon deletion.
• Push Notifications. Resolved an issue causing apps using the Windows Push Notification Service (WNS) to freeze.
• Third-party Apps. Fixed an issue that appeared after installing the June 2026 security update KB5095091. Some apps using OLE Automation to interact with Microsoft Office were unable to launch Office or open documents.
• Secure Boot. The list of devices that can automatically receive new Secure Boot certificates has been expanded. Their deployment via Windows Update will continue over the coming months on supported PCs and unmanaged enterprise devices.

Known issues and important changes:

• Hotkeys. Behavior has changed when unregistering and clearing key combinations. In rare cases, some built-in Windows functions may temporarily stop responding to certain combinations. Restarting the app usually helps.
• Task Management. at.exe and schedcli.dll can no longer be used to manage AT Time and ATSvc servers. Microsoft recommends abandoning ATServer, which is disabled by default in Windows Server 2012. AT.exe and ATServer will be removed in future versions of Windows. Use schtasks.exe, PowerShell ScheduledTasks commands, or the TaskSchedulerService interface instead.
• Network. Security requirements for TDI transport registration have been strengthened. Apps using sockets via unregistered third-party TDI transports may stop working after installing the update. Registered transports are not affected by this change.
• RDP Security. Support for SHA-2 certificate thumbprints has been added for trusted RDP publishers. SHA-1 is retained for compatibility, but will be removed in the future. Microsoft recommends migrating to SHA-256 or a stronger algorithm as soon as possible.

To install the update, go to Settings > Windows Update and click Check for updates. A system restart will be required to complete the installation.

How the new features work:

Magnifier. Clearer Narrator announcements have been implemented, the ability to magnify protected content has been added, and the smoothness of the Lens mode has been improved.

Task Manager. Tracking of NPU and GPU neural engines has been expanded, now providing detailed monitoring of AI accelerator utilization directly in the performance tab.

Camera. Support for Multi-App Camera and Basic Camera mode has been added, enabling simultaneous video stream sharing across multiple apps and a stripped-down fundamental capture mode.

Windows Setup. The ability to choose a custom user folder name during the system installation stage has been introduced, allowing users to override the automatically generated truncated profile directory name.

Shell Performance. Launching apps and core interface elements — Start menu, Search, and Notification Center — has been accelerated through optimized rendering priority and resource caching.

Personalization. Wallpaper retention has been improved; the system now more reliably preserves desktop background preferences, preventing spontaneous resets to default Windows wallpapers.

Windows Hello. The sign-in method, which is now used by default, has been refined with faster biometric sensor response and strengthened cryptographic channel protection between driver and biometric framework.

Search. File prioritization now triggers after typing just two characters, with indexing and ranking logic optimized to deliver relevant local content results earlier in the search flow.

Dev Drive. The ability to specify the size in gigabytes has been added, giving precise control over disk space allocation when creating performant ReFS developer volumes.

USB and Docking Stations. The reliability of USB4 docks and the USB3 stack has been enhanced, reducing peripheral connection failures and device enumeration crashes.

Fonts. Times New Roman fonts for the Greek and Cyrillic alphabets have been updated, improving kerning markup and diacritic rendering for system interfaces and documents.

Emoji Panel. As part of standard deployment, the GIF image source has been updated — GIPHY instead of Tenor — switching the API endpoint for animated graphics insertion.

Recycle Bin. Fixed the display of the file name upon deletion, correcting the confirmation dialog that previously showed an incorrect filename.

Push Notifications. Resolved an issue causing apps using Windows Push Notification Service (WNS) to freeze due to deadlocks in incoming socket event processing loops.

Third-party Apps. Fixed an issue after installing June 2026 security update KB5095091 where apps using OLE Automation to interact with Microsoft Office were unable to launch Office or open documents due to interface marshaling failures.

Secure Boot. The list of devices that can automatically receive new Secure Boot certificates has been expanded. Their deployment via Windows Update will continue over the coming months on supported PCs and unmanaged enterprise devices.

Known issues and important changes:

Hotkeys. Behavior has changed when unregistering and clearing key combinations. In rare cases, some built-in Windows functions may temporarily stop responding to certain combinations, as global hooks lose their handler link. Restarting the app usually helps.

Task Management. at.exe and schedcli.dll can no longer be used to manage AT Time and ATSvc servers. Microsoft recommends abandoning ATServer, disabled by default in Windows Server 2012. These will be removed in future versions. Use schtasks.exe, PowerShell ScheduledTasks commands, or TaskSchedulerService interface instead.

Network. Security requirements for TDI transport registration have been strengthened. Apps using sockets via unregistered third-party TDI transports may stop working after installing the update. Registered transports are unaffected.

RDP Security. Support for SHA-2 certificate thumbprints has been added for trusted RDP publishers. SHA-1 is retained for compatibility but will be removed in the future. Microsoft recommends migrating to SHA-256 or stronger as soon as possible.

The last 10 Windows updates: