Microsoft has released mandatory Windows 11 cumulative updates that deliver the May 2026 Patch Tuesday security patches for 120 vulnerabilities across supported builds.
KB5089549 and KB5087420: mandatory May 2026 Patch Tuesday updates
Today’s updates are distributed as KB5089549 for Windows 11 25H2/24H2 and KB5087420 for 23H2. Microsoft notes that this is the fifth Patch Tuesday release in 2026, and while the build basis is 24H2, 25H2 receives the same fixes; there are no exclusive or special changes between those two branches. Installation is available via Start > Settings > Windows Update > Check for Updates, or by manual download from the Microsoft Update Catalog.
Security scope: 120 vulnerabilities and no known new issues
The update bundle is mandatory because it contains the May 2026 Patch Tuesday security patches for 120 vulnerabilities "discovered in previous months." Microsoft reports it is not aware of any new issues introduced by this month’s release, and characterizes the update as relatively small compared with some prior releases. The company also states it has committed to a stable and reliable Windows experience.
Functional changes: Xbox mode, File Explorer, input, and Drop Tray
- Xbox mode: The update “adds Xbox mode to the desktop,” described as an Xbox console-like experience on PC.
- File Explorer: Archive format support is expanded to include uu, cpio, xar, and NuGet Packages (nupkg). View and Sort preferences are preserved in folders (for example, Downloads and Documents) when apps open File Explorer directly to those locations. The update removes a white flash in dark mode when opening This PC or resizing the Details pane, and improves reliability so relevant explorer.exe processes stop after closing File Explorer windows.
- Input and voice typing: Haptic feedback is now available on compatible input devices for actions such as aligning objects in PowerPoint or snapping/resizing windows; the setting appears under Settings > Bluetooth & devices > Mouse, Touchpad, or Pen > Haptic signals. Supported devices listed are Surface Slim Pen 2, ASUS Pen 3.0, and MSI Pen 2; support for additional compatible devices, including select mice such as Logitech MX Master 4, “might become available” as partners release updates. Voice typing on the touch keyboard gets a simplified design that removes the full-screen overlay and surfaces animations on the dictation key.
- Sharing UX: Drag Tray is renamed Drop Tray and its settings move to Settings > System > Multitasking (previously Nearby sharing). Drop Tray uses a smaller peek view intended to reduce accidental openings and make dismissal easier near the top of the screen.
Controls, reliability, and other technical improvements
- Administrative control for batch files: Administrators and Application Control for Business policy authors can enable a “more secure processing mode for batch files” that prevents batch files from changing during execution. The registry method is documented as: Registry Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor; Value name: LockBatchFilesWhenInUse; Type: DWORD; Data: 0 (disabled) or 1 (enabled). Policy authors can also use the LockBatchFilesWhenInUse application manifest control per the Application Control for Business manifest schema.
- Storage and FAT32 formatting: Performance when viewing storage information for large volumes is improved, and the size limit for formatting FAT32 volumes from the command line increases from 32GB to 2TB.
- Reliability and performance fixes: Improvements include Windows Hello Face reliability, persistence of Windows Hello Fingerprint across upgrades, better taskbar system tray loading reliability, reduced memory usage for Delivery Optimization, improved persistence and availability of monitor color profiles, and performance of launching startup apps. The update also reduces unexpected Microsoft Store errors (0x80070057, 0x80240008, and 0x80073d28), refines font rendering for several scripts in Leelawadee UI, and improves third-party driver compatibility with midisrv.exe.
What this means for security teams, administrators, and end users
- Security teams: The package consolidates fixes for 120 vulnerabilities; applying the update will be a priority because Microsoft has marked it mandatory. Teams that manage patch cycles should schedule deployment and verification, especially where administrative controls such as LockBatchFilesWhenInUse are of interest.
- Administrators and policy authors: New registry and manifest controls allow tighter handling of batch-file execution. Administrators who rely on kiosk configurations, packaged apps, or Microsoft Edge in kiosk mode should note simplified configuration changes and review allowed app lists.
- End users: New consumer-facing features — Xbox mode on desktop, Drop Tray, reduced white flashes in File Explorer, and haptic feedback on supported input devices — will be visible after updating. Users who install apps from the Microsoft Store may see fewer download/install errors once updated.
Microsoft says it is also working on a larger Windows 11 2026 quality update that will restore the movable taskbar and substantially improve performance of modern interfaces, including the right‑click menu; the company additionally plans to limit Copilot integration, reduce ads, and make the out‑of‑the‑box experience faster with skippable Windows Updates. The source material includes a separate security warning that “AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming,” and references an Autonomous Validation Summit (May 12 & 14) that demonstrates autonomous, context-rich validation for exploitability and remediation.
After installation, build numbers will change: Windows 11 25H2 (KB5089549) becomes 26200.8457 (25H2) and 26100.8457 (24H2), while 23H2 (KB5087420) becomes 22631.7079.
