This non-security out-of-band (OOB) update for Windows 11, version 23H2 (KB5134130) is cumulative. It includes updates from previous releases, along with additional non-security improvements.
Who should install this update
This out-of-band (OOB) update is intended for devices that do not receive current certificate trust list (CTL) updates, including updates to the list of untrusted certificates. Examples include devices in disconnected environments, devices that cannot access Microsoft’s certificate-update service and devices where automatic CTL updates are disabled.
Improvements
Important
Use EKB KB5027397 to update to Windows 11, version 23H2.
This update contains fixes and quality improvements from the following update:
The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change.
- [Certificates] This update includes an updated trusted root certificate payload in the Windows cumulative update for devices that cannot access Microsoft’s certificate-update service and devices where automatic certificate trust list (CTL) updates are disabled. To learn more, see Certificates and trust in Windows.
If you've already installed previous updates, your device will download and install only the new updates included in this package.
Known issues in this update
Microsoft is not currently aware of any issues with this update.
Windows 11 servicing stack update (KB5126652) - 22621.7641
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates. To learn more about SSUs, see Servicing stack updates.
How to get this update
Before you install this update
For Windows Update: You must have the Windows update released on or after July 8, 2025 (such as KB5062552) installed before installing this update.
For Windows Server Update Services (WSUS) deployment or when installing the standalone package from Microsoft Update Catalog: You must have the Windows update released on or after July 8, 2025 (such as KB5062552) installed before installing this update.
For Servicing Stack Update (SSU): You must have the latest SSU installed to install this update.
Deployment
If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.
Note
The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.
To ensure the boot.stl file is included as part of the installation media, do one of the following:
- Use the Update WinPE script to update an existing Windows image. (Recommended)
- Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.
For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.
Install this update
To install this update, use one of the following Windows and Microsoft release channels.
| Available | Next Step |
|---|---|
|
This update is available from the Microsoft Update Catalog. |
File information
A list of the files that are included in this update are provided in a CSV (Comma delimited) (*.csv) file. The file can be opened in a text editor such as Notepad or in Microsoft Excel.
Note The English (United States) version of this software update might contain files for additional languages.
Download the file information for out-of-band update KB5134130.
Download the file information for SSU (KB5126652) - version 22621.7641.
Related topics
Microsoft Store for Business and Education with Configuration Manager