KB5066793: Windows 11 Security Update for Versions 22H2 and 23H2 (October 14, 2025)

Summary

KB5066793 is the cumulative security update for Windows 11 versions 22H2 (Enterprise and Education) and 23H2, released on October 14, 2025, producing OS builds 22621.6060 and 22631.6060. It addresses security vulnerabilities across the operating system and carries several targeted quality fixes. This is also the final security update for Windows 11 version 22H2. See Microsoft Support for full details.

Highlights

• This update addresses security issues for the Windows operating system.

Improvements and fixes

The following changes apply to Windows 11 version 22H2 (Enterprise and Education editions) and are also inherited by version 23H2. They build on fixes from KB5065790, released September 23, 2025.

• [Compatibility] The ltmdm64.sys driver has been removed. Any fax modem hardware that depended on this specific driver will no longer function under Windows after this update is installed.
• [Cryptography] A security hardening change now requires RSA-based smart card certificates to use the Key Storage Provider (KSP) rather than the legacy Cryptographic Service Provider (CSP). Environments that experience smart card authentication problems as a result should consult the Windows Release Health site for resolution steps. This change relates to CVE-2024-30098.
• [File Explorer] File Explorer now automatically disables the preview feature for files downloaded from the internet. The change is intended to prevent a security vulnerability that could be triggered when users preview potentially unsafe downloaded files. Microsoft has published separate guidance covering how to unblock files when needed.
• [PowerShell] A fix is included for a problem affecting PowerShell Remoting and Windows Remote Management (WinRM) where commands could time out after 10 minutes.

Windows 11 version 23H2 incorporates all of the above improvements and lists no additional documented changes specific to that version.

Known issues

Microsoft lists no known issues for this update at the time of writing.

How to get this update

Microsoft bundles the latest servicing stack update (SSU) - KB5066792, versions 22621.6051 and 22631.6051 - together with this cumulative update (LCU) in a single package. No separate SSU installation step is required before applying KB5066793.

The update is available through the following channels:

• Windows Update and Microsoft Update - the package downloads and installs automatically.
• Windows Update for Business - the update deploys automatically in line with configured policies.
• Microsoft Update Catalog - a standalone package can be downloaded directly for manual or offline deployment.
• Windows Server Update Services (WSUS) - the update syncs automatically when Products is set to "Windows 11" and Classification is set to "Security Updates".

Removing the LCU: If you need to uninstall the LCU after applying the combined SSU and LCU package, use the DISM /Remove-Package command with the LCU package name as the argument. You can retrieve the package name by running DISM /online /get-packages. Running wusa.exe with the /uninstall switch against the combined package will not work because the package also contains the SSU, which cannot be removed once installed.

End of servicing note: October 14, 2025 is the last security update for Windows 11 version 22H2. After this date, version 22H2 will no longer receive security updates. Microsoft recommends upgrading to the latest version of Windows 11 to remain protected.

Frequently asked questions

Is this the last update for Windows 11 version 22H2?

Yes. Microsoft confirmed that Windows 11 version 22H2 Enterprise and Education editions reached end of servicing on October 14, 2025. Non-security preview updates for those editions had already stopped on June 26, 2025. After this date, no further security updates will be released for version 22H2, and an upgrade to a supported version is required to stay protected.

What happens to smart card authentication after the cryptography change?

This update requires RSA-based smart card certificates to use the Key Storage Provider (KSP) instead of the older Cryptographic Service Provider (CSP). Organizations that encounter smart card sign-in failures after applying this update should visit the Windows Release Health site, which Microsoft has indicated will carry resolution steps. The change addresses CVE-2024-30098.

Will file previews in File Explorer stop working for all downloaded files?

File Explorer will automatically disable the preview pane for files downloaded from the internet, not for all files. The restriction targets downloaded content specifically to reduce the risk from unsafe file previews. Microsoft has published a separate support document that explains how users or administrators can unblock individual files when a preview is needed.

Do I need to install the servicing stack update separately before applying KB5066793?

No. Microsoft packages the servicing stack update (KB5066792) together with KB5066793 in a single combined update. Devices receiving the update through Windows Update, Windows Update for Business, WSUS, or the Microsoft Update Catalog will get both components in one installation pass.