Important
This standalone security update provides additional Windows PowerShell security improvements for hotpatch-enrolled devices. It is offered only after the November 2026 hotpatch security update has been installed.
Improvements
The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change.
- [Security] This update improves security for Windows PowerShell Desired State Configuration (DSC), Invoke-WebRequest, and PowerShell Workflow. For more information, see CVE-2026-124224, CVE-2026-124225, and CVE-2026-124226.
About this update
| Item | Description |
|---|---|
| Applicability | This update applies to eligible hotpatch-enabled devices. |
| Prerequisites | Devices must have installed the November 2026 hotpatch security update before this update is offered. |
| Restart information | Your device might require a restart if affected Windows PowerShell files are in use when this update is installed. Otherwise, no restart is required. |
| Update replacement | This update does not replace a previously released update. |
Known issues in this update
Microsoft is not currently aware of any issues with this update.
How to get this update
Before you install this update
Microsoft combines the latest servicing stack update (SSU) for your operating system with the hotpatch update. For general information about SSUs, see Servicing stack updates.
If you are using Windows Update, the latest SSU installs with this update.
Install this update
To install this update, use one of the following Windows and Microsoft release channels.
| Release Channels | Available | Next step |
|---|---|---|
| Windows Update |
|
This update downloads and installs automatically from Windows update. |
| Catalog |
|
See the other options. |
| Server Update Services |
|
See the other options. |
File information
For a list of the files provided in this update, download the file information for the out-of-band hotpatch update KB5135385.