KB5083768

Microsoft has released cumulative security update KB5083768 (Build 28000.1836) for Windows 11, version 26H1 as part of the April 2026 Patch Tuesday for PCs with ARM processors. Windows 11, version 26H1 received the KB5083768 security update for April 2026 for PCs with ARM64 architecture processors (Snapdragon). Additionally, the update is available for devices with x64 architecture processors (x86-64, Intel and AMD) that have been updated to version 26H1 using official ISO images.

• Emoji 16.0. Added support for Emoji 16.0.
• Windows Backup. Expanded recovery capabilities via Windows Backup, including automatic restoration of settings and applications upon first login.
• Quick system recovery. Improved the Quick system recovery feature — it now automatically enables on some devices and performs system checks.
• Visual interface improvements and network speed test. Introduced visual interface improvements and a new built-in network speed test via the taskbar.
• Secure Boot. The Windows Security app (Settings > Privacy & security > Windows Security) may now display the status of Secure Boot certificate updates. The system shows notifications and status icons. On commercial devices, this feature is disabled by default. As part of the Windows quality update, additional data has been added to accurately identify compatible devices. This allows expanding the list of devices that can automatically receive new Secure Boot certificates. Certificate installation occurs in stages — only on devices where successful updates have been recorded, ensuring controlled deployment.
• Fix for BitLocker issue. Fixed an issue where the device could enter BitLocker recovery mode after Secure Boot updates.
• Network (SMB over QUIC). Improved reliability when using SMB compression over QUIC. After installing the update, such requests execute more stably, reducing the likelihood of timeouts and improving overall connection performance.
• Remote Desktop (phishing protection). Enhanced protection against phishing attacks using Remote Desktop (.rdp) files. Now when opening an .rdp file, all connection parameters are displayed before establishing the connection, and they are disabled by default. A security warning also appears when opening such a file for the first time.

The update description does not list any specific known issues for KB5083768, however the main focus is on internal optimizations, update stability, and improving system reliability. The update includes all fixes and changes from the preview update KB5079489 (Build 28000.1764) for Windows 11, version 26H1.

Installation via Windows Update. Note: Automatic installation via Windows Update works only on devices with ARM processors. Go to Settings > Windows Update and click Check for updates. A computer restart is required to complete installation.

How the new features work:

Emoji 16.0: Added support for the new Emoji 16.0 set. The character rendering engine is updated via the seguiemj.ttf font — new glyphs and ZWJ sequence modifiers are added, allowing correct rendering of modern emojis in any application using DirectWrite.

Windows Backup: Recovery capabilities are expanded: on first login after OS reinstallation, the backup automatically restores registry keys, app settings (from AppData), and the apps themselves via the Microsoft cloud service. The process uses background Windows Push Notification for state synchronization.

Quick system recovery: Improved automatic self‑recovery mechanism. On some devices it now enables without user intervention, periodically running system file integrity checks (via DISM and SFC). If corruption is found, the WinRE bootloader automatically applies fixes before OS login.

Visual interface improvements and network speed test: Updated UI visuals (shadows, animations, rounded window corners). A built‑in network speed test is added to the taskbar notification area — the tool measures ping, download, and upload via Network List Manager and sends test packets to Microsoft servers without third‑party apps.

Secure Boot: The Windows Security app shows Secure Boot certificate update status. The system shows a critical‑change icon notification. On commercial devices the feature is disabled by default. The Windows quality update adds data to accurately identify compatible devices, expanding the supported list. Certificate installation is staged — only on devices with recorded successful updates, ensuring controlled deployment.

Fix for BitLocker issue: Fixed a bug where after Secure Boot certificate updates the device unexpectedly entered BitLocker recovery mode. The root cause was a mismatch in boot chain measurements (Platform Configuration Registers). The update stabilizes recovery key validation logic before OS login.

Network (SMB over QUIC): Improved reliability when using SMB compression over QUIC. Fixed timeouts and connection instability on unreliable networks. The mechanism now better handles packet loss and reordering typical for UDP by optimizing the compression queue in the mrxsmb.sys driver, reducing latency.

Remote Desktop (phishing protection): Enhanced phishing protection for RDP files (.rdp). When opening such a file, the system displays all connection parameters before establishing the connection (they are disabled by default). A security warning appears on first open — this prevents automatic launch of malicious resource redirections.

The last 10 Windows updates: