November 11, 2025—Hotpatch KB5068840 (OS Build 20348.4346)

To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates.

To view the latest updates about this release, visit the Windows release health dashboard or the update history page for Windows Server 2022.

Announcements and messages

This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.

Windows Secure Boot certificate expiration

Important: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time. To avoid disruption, we recommend reviewing the guidance and taking action to update certificates in advance. For details and preparation steps, see Windows Secure Boot certificate expiration and CA updates.

Improvements and fixes

This security update includes quality improvements. The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change.

This update makes miscellaneous security improvements to internal OS functionality. No additional issues were documented for this release.

If you've already installed previous updates, your device will download and install only the new updates included in this package.

Known issues in this update

After installing KB5070892 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.

How to get this update

Before you install this update

Microsoft now combines the latest servicing stack update (SSU) for your operating system with the hotpatch update. For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.

If you are using Windows Update or Windows Server Update Services (WSUS), the latest SSU installs with this update.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.