Windows 11 26H1 Security Update Expands Secure Boot Certificate Protection
Microsoft's Windows 11 26H1 update KB5124012 widens Secure Boot certificate deployment and patches two elevation flaws.
Microsoft released September 2026 cumulative update KB5124012 for Windows 11 version 26H1, reaching OS Build 28000.2954 and broadening automatic deployment of new Secure Boot certificates. Servicing stack update KB5125104 is included, and installation media must contain boot.stl or Dynamic Update setup can fail with error 0xc0430001. Out-of-band update KB5129194 (Build 28000.2956) fixes Remote Desktop and virtualization issues and adds protections for elevation-of-privilege flaws CVE-2026-62721 and CVE-2026-85921. Microsoft warned Credential Guard machine accounts can lose their Active Directory secure channel unless domain controllers are at Windows Server 2025 functional level or higher. Version 26H1 is offered only on new devices with selected silicon.
- KB5124012 updates Windows 11 26H1 to OS Build 28000.2954.
- Automatic Secure Boot certificate coverage expands for consumer and unmanaged PCs.
- KB5129194 adds protections for CVE-2026-62721 and CVE-2026-85921.
- Credential Guard accounts may lose Active Directory trust after install.
- Missing boot.stl on install media can cause error 0xc0430001.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-62721 | Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally | 7.8 | <1% | ||
| CVE-2026-85921 | Double Free in Windows Secure Kernel Mode Enables Local Privilege Escalation | 8.2 | — |
From the original article
3 min read at gbhackers.com
Microsoft has released the cumulative security update for September 2026 for Windows 11 version 26H1. This update expands the range of systems that can automatically receive new Secure Boot certificates. KB5124012, released on September 8, brings devices to OS Build 28000.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.