KB5066835: Windows 11 Security Update - OS Builds 26200.6899 and 26100.6899 (October 2025)

Summary

KB5066835 is the October 2025 monthly security update for Windows 11 versions 24H2 and 25H2, producing OS builds 26200.6899 and 26100.6899. Released on October 14, 2025, it addresses security vulnerabilities and quality issues, and bundles the servicing stack update KB5067360 (build 26100.6893). Source: Microsoft Support.

Highlights

• This update addresses security issues for your Windows operating system.

Improvements and fixes

• Browser: Resolves an issue that caused the print preview screen to stop responding in Chromium-based browsers.
• Gaming: Fixes a problem where apps and games stopped responding to input after a user signed in at the lock screen using only a Gamepad, with no other input method such as touch or fingerprint involved during sign-in.
• PowerShell - Remoting/WinRM timeout: Resolves an issue in PowerShell Remoting and Windows Remote Management (WinRM) where commands could time out after 10 minutes.
• PowerShell - Audit event logging: Fixes an issue that prevented certain audit events from being written to the event log.
• Windows Hello: Addresses a setup failure for Windows Hello face recognition when using USB infrared camera modules, where users encountered a persistent error such as "Make sure your face is centered in the frame" and could not complete configuration.
• Compatibility - ltmdm64.sys removal: This update removes the ltmdm64.sys driver. Fax modem hardware that depends on this specific driver will no longer function in Windows.
• Cryptography - smart card hardening: Enforces a security hardening change that requires the use of Key Storage Provider (KSP) rather than Cryptographic Service Provider (CSP) for RSA-based smart card certificates, addressing CVE-2024-30098. Administrators who encounter smart card authentication problems after this change should consult the Windows Release Health site for resolution steps.
• File Explorer - preview security change: File Explorer now automatically disables the preview feature for files downloaded from the internet, blocking a vulnerability that could be triggered when users preview potentially unsafe files. Microsoft has published separate guidance covering how to unblock files when needed.
• AI component updates: Image Search, Content Extraction, Semantic Analysis, and Settings Model are all updated to version 1.2509.1022.0. These components apply only to Copilot+ PCs and will not install on standard Windows PCs or Windows Server.
• Servicing stack: Includes servicing stack update KB5067360 at build version 26100.6893 to improve the reliability of the update installation component.

Known issues

Problems playing protected content in some Blu-ray, DVD, and Digital TV apps

Symptom: Some Digital TV and Blu-ray/DVD apps may fail to play protected content after installing the August 29, 2025 non-security preview update (KB5064081) or any later update. Apps using Enhanced Video Renderer with HDCP enforcement or Digital Rights Management (DRM) for digital audio may display copyright protection errors, frequent playback interruptions, unexpected stops, or black screens. Streaming services are not affected.

Workaround: The non-security September 2025 preview update (KB5065789) and later updates address problems affecting applications using Enhanced Video Renderer with HDCP enforcement. The non-security October 2025 preview update (KB5067036) includes additional fixes for applications using DRM for digital audio.

USB mouse and keyboard not working in Windows Recovery Environment

Symptom: After installing this update (KB5066835), USB devices such as keyboards and mice do not function inside the Windows Recovery Environment (WinRE), preventing navigation of any recovery options. USB keyboard and mouse continue to work normally within the Windows operating system itself.

Workaround: This issue is addressed in KB5070773.

IIS websites might fail to load

Symptom: After installing KB5065789 for Windows 11 version 25H2, or KB5066835 for Windows 11 version 24H2, server-side applications that rely on HTTP.sys may experience problems with incoming connections. IIS websites may fail to load and display an error such as "Connection reset - error (ERR_CONNECTION_RESET)" or a similar message, including sites hosted on http://localhost/. This issue does not occur in all environments and may depend on internet connectivity, update installation timing, and device restarts. As a temporary measure, open Settings, go to Windows Update, check for updates, install any available updates, and restart the device even if no updates are found.

Workaround: This issue is addressed in KB5067036.

Password icon might be missing or invisible on the lock screen

Symptom: After installing the August 2025 non-security preview update (KB5064081) or later updates, the password icon may not be visible in the sign-in options on the lock screen. Hovering over the area where the icon should appear confirms the password button is still present; selecting that space opens the password text box and sign-in proceeds normally. This issue primarily affects enterprise or managed IT environments. Users on Windows Home or Pro editions on personal devices are very unlikely to experience it.

Workaround: This issue is addressed in KB5074105.

How to get this update

Microsoft bundles the latest servicing stack update (SSU) with this cumulative update, so no separate SSU installation is required beforehand.

• Windows Update / Microsoft Update: The update downloads and installs automatically.
• Windows Update for Business: Deploys automatically according to configured policies.
• Microsoft Update Catalog: Download the standalone MSU files directly. You can install all MSU files together by placing them in a single folder and running DISM with the /Add-Package flag pointing to the main MSU, or install them individually in order - first windows11.0-kb5043080-x64 and then windows11.0-kb5066835-x64. Full DISM and PowerShell commands are documented on the Microsoft Support page.
• Windows Server Update Services (WSUS): Set Product to Windows 11 and Classification to Security Updates to sync automatically.

To remove only the LCU after installation, use the DISM /online /remove-package command. Running wusa.exe /uninstall against the combined package will not work because the SSU is embedded and cannot be removed after installation.

Frequently asked questions

Does this update affect all Windows 11 editions?

Yes. KB5066835 applies to all editions of Windows 11 version 24H2 and Windows 11 version 25H2. It produces build 26100.6899 for version 24H2 and 26200.6899 for version 25H2. Devices that already have earlier updates installed will download only the new components included in this package rather than the full payload.

What should administrators know about the smart card cryptography change?

This update enforces use of Key Storage Provider (KSP) instead of Cryptographic Service Provider (CSP) for RSA-based smart card certificates, addressing CVE-2024-30098. Environments relying on CSP-based smart card authentication may see authentication failures. Microsoft advises checking the Windows Release Health site for specific resolution steps before broad deployment.

Will removing the ltmdm64.sys driver break existing hardware?

Yes, potentially. The update removes the ltmdm64.sys driver entirely, meaning fax modem hardware that depends specifically on that driver will stop working after this update is installed. Administrators should identify any fax modem devices in their environment that rely on ltmdm64.sys and plan accordingly before deploying this update at scale.

Do the AI component updates apply to all Windows 11 devices?

No. Although the AI component updates for Image Search, Content Extraction, Semantic Analysis, and Settings Model (all at version 1.2509.1022.0) are bundled inside KB5066835, Microsoft states they will only install on Copilot+ PCs. Standard Windows PCs and Windows Server systems will receive the update package but the AI components will not be installed on those devices.