KB5087420

Microsoft released cumulative update KB5087420 for Windows 11, version 23H2 (2023 Update) as part of the May 2026 Patch Tuesday. The cumulative update package KB5087420 (Build 22631.7079) is intended for Windows 11, version 23H2 (Windows 11 2023 Update) on x64 (amd64) and ARM64 processors for Enterprise and Education editions. This update includes quality improvements; no new system features are introduced.

• Expansion of Secure Boot targeting data. Microsoft expanded the targeting data composition in Windows quality updates, increasing the scope of devices ready to automatically receive new Secure Boot certificates. Certificates are delivered only after sustained signals of successful update installation — ensuring controlled phased rollout ahead of certificate expirations starting June 2026.
• COSA profile update. Country and Operator Settings Asset (COSA) profiles have been updated, improving support for mobile operator settings on compatible devices.
• Support for daylight saving time changes in Egypt. Added support for the 2023 daylight saving time rule changes in the Arab Republic of Egypt.
• Enterprise State Roaming management via Windows Backup for Organizations. Management of the Enterprise State Roaming (ESR) feature is now possible through Windows Backup for Organizations policies, simplifying device configuration setup and management in organizations. Microsoft transitioned ESR management into Windows Backup for Organizations starting May 2026.
• Microsoft Defender SmartScreen improvement. Microsoft Defender SmartScreen can now send hash values of unsigned files from the shell to improve application reputation checks using modern security models.
• Servicing stack quality improvements (SSU). The update includes servicing stack quality improvements — the component responsible for installing Windows updates.

Known issue: BitLocker. On devices with a non-recommended BitLocker group policy configuration, after the first reboot following the update installation, a BitLocker recovery key may be required. The issue affects a limited set of systems where all conditions are met simultaneously: BitLocker is enabled on the system drive; the Configure TPM platform validation profile for native UEFI firmware configurations group policy is set, and PCR7 is included in the validation profile (or the corresponding registry parameter is manually set). On personal devices not managed by corporate IT, these conditions are unlikely.

Cumulative update 5087420 for PCs installs automatically via Windows Update for Enterprise and Education editions. To check, go to Settings > Windows Update and click Check for updates.

The last 10 Windows updates: