KB5101650

Microsoft has released cumulative update KB5101650 for Windows 11 version 25H2 (2025 Update) as part of the July 2026 Patch Tuesday. The build number is 26200.8875. The main focus of the update is on strengthening security: this month, 570 vulnerabilities have been closed, including three actively exploited zero-day vulnerabilities. The patch also includes all fixes and improvements from the preliminary update KB5095093 (Build 26200.8737).

• Restore to a point in time. A quick PC rollback feature to automatic restore points has been implemented to increase system stability.
• Pause updates. A convenient interface with a calendar has appeared in Windows Update, allowing you to postpone the installation of updates for up to 35 days.
• Updated widgets. The widgets panel has been refined to reduce the number of distracting elements on the desktop.
• Color tint and Magnifier. In the Accessibility section, the operation of the Magnifier has been improved and a color tint setting for the screen has been added.
• File Explorer. Quick actions have been optimized and File Explorer launch has been accelerated.
• Bluetooth and LE Audio. The reliability of Bluetooth connections has been increased and LE Audio support has been improved.
• Phone Link. Audio routing for calls through the Phone Link app has been improved.
• Voice access and voice typing. Support for French, German, and Spanish languages has been added.
• IPP printer installation. The IPP protocol is now used for printer installation by default.
• Touchpad. The ability to configure the right-click zone size on the touchpad has been added.
• Emoji panel. As part of the standard deployment, the Emoji panel has been updated: GIPHY is now used instead of Tenor.
• Secure Boot. The list of devices that can automatically receive new Secure Boot certificates has been expanded. Their deployment through Windows Update will continue in the coming months on supported PCs and unmanaged enterprise devices. High-confidence targeting data for new Secure Boot certificates has also been added.

Known issues and important changes in this update:

• Third-party applications. An issue that appeared after installing the June security update KB5095091 has been fixed. Some applications using OLE Automation to interact with Microsoft Office could not launch Office or open documents.
• Hotkeys. Behavior when unregistering and clearing key combinations has been changed. In rare cases, some built-in Windows functions may temporarily stop responding to certain combinations. Restarting the application usually helps.
• Task management. at.exe and schedcli.dll can no longer be used to manage AT Time and ATSvc servers. Microsoft recommends moving away from ATServer, which is disabled by default in Windows Server 2012. In future versions of Windows, AT.exe and ATServer will be removed. Use schtasks.exe, PowerShell ScheduledTasks commands, or the TaskSchedulerService interface instead.
• Network. Security requirements for TDI transport registration have been strengthened. Applications using sockets through unregistered third-party TDI transports may stop working after installing the update. Registered transports are not affected by this change.
• RDP security. Support for SHA-2 certificate fingerprints has been added for trusted RDP publishers. SHA-1 is still retained for compatibility, but will be removed in the future. Microsoft recommends switching to SHA-256 or a stronger algorithm as soon as possible.

This update also fixes the display of the file name when deleting to the Recycle Bin, and improves the Start menu and notification icons on the Taskbar.

Cumulative update KB5101650 for PCs installs automatically through Windows Update. To manually check, go to Settings > Windows Update and click Check for updates. You can also download the standalone installer from the official Microsoft Update Catalog website for manual installation.

How the new features work:

Restore to a point in time. A rapid system rollback mechanism has been implemented using automatically created restore points to increase fault tolerance. The process relies on the Volume Shadow Copy Service (VSS), which captures the state of system files, the registry, and drivers, allowing the OS to be quickly returned to a stable snapshot without a full reinstallation.

Pause updates. A calendar-based scheduler has been implemented in the Windows Update interface, allowing the deferral of update delivery for up to 35 days. The feature works through a deferred installation policy, temporarily blocking the download and application of update packages without altering the overall system servicing configuration.

Updated widgets. The widgets panel has been refined to minimize distracting elements: the content aggregation algorithm and animation rendering logic have been modified. The WebView2 engine optimizes card rendering and reduces resource consumption by the graphics subsystem during desktop idle time.

Color tint and Magnifier. In the Accessibility section, the operation of the Magnifier has been improved and a screen color tint setting has been added. The Magnifier uses per-pixel scaling via the DWM graphics pipeline, while the filter overlays a color transformation matrix onto the final frame buffer, altering color rendition without degrading rendering performance.

File Explorer. The processing of quick actions has been optimized, and the launch of the File Explorer shell has been accelerated. Improvements are achieved by reworking the library preloading logic and asynchronous initialization of the shell namespace, reducing delays when accessing the file system and rendering the directory tree.

Bluetooth and LE Audio. The reliability of Bluetooth connections has been increased and support for the LE Audio specification has been improved. The protocol stack now handles Isochronous Channels (ISO Channels) and the Telephony and Media Audio profile more efficiently, ensuring more stable audio stream transmission over Bluetooth Low Energy.

Phone Link. Audio routing for calls through the Phone Link app has been improved. The mechanism redirects audio streams with VoIP codecs directly to the system's I/O endpoint, bypassing software priority conflicts, which enhances speech clarity when using a PC headset.

Voice access and voice typing. Support for French, German, and Spanish languages has been added. The feature relies on an online Automatic Speech Recognition (ASR) engine that converts the acoustic model into text, after which a semantic parser maps commands to standard UI automation interfaces.

IPP printer installation. The IPP (Internet Printing Protocol) is now used by default for printer installation. Instead of classic v3/v4 drivers, the system utilizes IPP-class drivers, sending print jobs via HTTP requests to the printer endpoint in accordance with the PWG 5100 standard.

Touchpad. The ability to configure the right-click zone size on the touchpad has been added. The HID class driver interprets touch coordinates in the designated area as a right-click signal, with the sensitivity parameter stored in the registry and managed via the Precision Touchpad API.

Emoji panel. As part of standard deployment, the Emoji panel has been updated: searching for and inserting GIFs is now done through the GIPHY service instead of Tenor. The text input component integrates the GIPHY platform API to fetch animated images, which are then inserted into the input field via the OLE clipboard.

Secure Boot. The list of devices that can automatically receive new Secure Boot certificates has been expanded. Their deployment via Windows Update will continue on supported PCs. High-confidence targeting data has been added, allowing for the safe application of updated UEFI firmware signatures without breaking the trust chain on unmanaged enterprise devices.

Known issues and important changes.

Third-party applications. An issue that appeared after installing the June security update KB5095091 has been fixed. The problem affected OLE Automation calls to Microsoft Office: due to broken COM factory initialization, some applications could not create an automation object instance, blocking the launch of Office programs and the opening of documents through the IDispatch interface.

Hotkeys. The behavior when unregistering and clearing key combinations has been changed. In rare cases, some built-in Windows functions may temporarily stop responding to certain combinations due to a synchronization failure in the global accelerator table; restarting the application reinitializes keyboard hooks and restores processing.

Task management. The at.exe utility and the schedcli.dll library can no longer manage AT Time and ATSvc servers. Microsoft recommends moving away from ATServer, which is disabled by default in Windows Server 2012. Use schtasks.exe, PowerShell ScheduledTasks cmdlets, or the TaskSchedulerService interface for task scheduling.

Network. Security requirements for TDI transport registration have been strengthened. Applications using sockets through unregistered third-party TDI transports may stop working after installing the update. Filtering at the I/O manager level now blocks sockets lacking a correct digital transport signature, while registered drivers remain unaffected.

RDP security. Support for SHA-2 certificate fingerprints has been added for trusted RDP publishers. SHA-1 is still retained for compatibility but will be removed in the future. A transition to SHA-256 is recommended. The Remote Desktop certificate verification mechanism now checks the hash using the SHA-256 algorithm against a trusted list, strengthening protection against MITM attacks.

The last 10 Windows updates: