Windows 11 KB5026368 KB5026372 May Patches

Microsoft has released the patches for May 2023. They released Windows 11 KB5026368 and KB5026372 cumulative updates to fix known issues, security vulnerabilities, and performance issues. Windows 10 KB5026361 and KB5026362 patches were also released.

The latest Windows 11 KB5026368 and KB5026372 security updates address and include improvements. A new toggle control UI is available, “Get Windows updates as soon as they’re available for your device,” on the Settings > Windows Update page. For managed devices, the toggle is disabled by default.

This Windows 11 May patches update addresses a race condition in Windows Local Administrator Password Solution (LAPS). The Local Security Authority Subsystem Service (LSASS) might stop responding. This occurs when the system processes multiple local account operations at the same time. The access violation error code is 0xc0000005.

Another vulnerability fixed by Microsoft is FIX Windows Boot Manager Vulnerability CVE-2023-24932 BlackLotus UEFI Bootkit. To upgrade to Windows 11 22H2, you can use either SCCM or Intune methods. Microsoft releases different KB articles for Windows 11 May 2023 Cumulative Updates (CUs), with KB5026368 and KB5026372 designated for Windows 11 21H2 and 22H2, respectively.

Patch My PC

Video – May Patch Tuesday | 3 Zero-day Vulnerabilities

Let’s check out 2023 May Patch Tuesday | 3 Zero-day Vulnerabilities | KB5026372, KB5026368, KB5026361, and KB5026362.

Video – May Patch Tuesday | 3 Zero-day Vulnerabilities

Zero Day Security Vulnerability

3 Zero-Day Security Vulnerabilities with Windows OLE Remote Code Execution Vulnerability CVE-2023-29325. Also, Secure Boot Security Feature Bypass Vulnerability CVE-2023-24932 and Win32k Elevation of Privilege Vulnerability CVE-2023-29336.

CVE-2023-29325 – The exploitation of the vulnerability might involve either a victim opening a specially crafted email with an affected version of Microsoft Outlook software or a victim’s Outlook application displaying a preview of a specially crafted email. This could result in the attacker executing remote code on the victim’s machine.

CVE-2023-24932 – The security update addresses the vulnerability by updating the Windows Boot Manager, but it is not enabled by default. Additional steps are required at this time to mitigate the vulnerability. Please refer to the following for steps to determine the impact on your environment: KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932.

Adaptiva
  • CVE-2023-29336 – An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Release DateCVE NumberCVE TitlePublicly DisclosedExploitability AssessmentExploitedImpactMax SeverityTag
May 9, 2023CVE-2023-29325Windows OLE Remote Code Execution VulnerabilityYesExploitation More LikelyNoRemote Code ExecutionCriticalWindows OLE
May 9, 2023CVE-2023-24932Secure Boot Security Feature Bypass VulnerabilityYesExploitation DetectedYesSecurity Feature BypassImportantWindows Secure Boot
May 9, 2023CVE-2023-29336Win32k Elevation of Privilege VulnerabilityNoExploitation DetectedYesElevation of PrivilegeImportantWindows Win32K
Windows 11 KB5026368 KB5026372 May Patches
Windows 11 KB5026368 KB5026372 May Patches Fig.1
Windows 11 KB5026368 KB5026372 May Patches Fig.1

How to Seek Windows Updates?

Windows 11 allows you to choose when and how to receive the latest updates to ensure your device runs efficiently and securely. To manage your update preferences and view available updates, select “Check for Windows updates.”

  • Alternatively, you can seek the latest Windows update by selecting Start > Settings > Windows Update by accessing the update settings.

Microsoft releases security updates on “Patch Tuesday,” the second Tuesday of each month at 10:00 AM PST. IT professionals should plan their deployment schedules according to their time zone(s).

Windows 11 KB5026368 KB5026372 May Patches Fig.2
Windows 11 KB5026368 KB5026372 May Patches Fig.2

New Features of Windows 11 Released with May Patches

HTMD community covered all the new features of the Windows 11 22H2 release in the following blog post. All these features are included in the latest Cumulative Update released on the patch Tuesday, 9th May 2023. Here are the improvements for Windows 11, version 22H2.

New! This update adds a new toggle control on the Settings > Windows Update page. When you turn it on, we will prioritize your device to get the latest non-security updates and enhancements when they are available for your device. 

New FeaturesDetails
Firewall Settings ChangesYou can now configure application group rules.
Adds animations to a few icons on the Widgets taskbar buttonA new announcement appears on the Widgets taskbar button. You hover over or click the Widgets taskbar button.
New toggle control “Get Windows updates as soon as they’re available for your device” on the Settings > Windows Update page.When you turn it on, Microsoft will prioritize your device to get the latest non-security updates and enhancements when they are available for your device. For managed devices, the toggle is disabled by default.
Table 1 – Windows 11 KB5026368 KB5026372 May Patches

Let’s learn some interesting Latest Features of Windows 11 22H2 and its Advanced Features. The 22H2 features update for Windows 11, the Latest Features Of Windows 11 22H2, and Advanced Features.

Issues Fixed with Windows 11 May Patches

Let’s look at the issues fixed with Windows 11 May patch Tuesday KBs (KB5026368 and KB5026372). The following table covers both Windows 11 22H2 and 21H2 fixes.

Fixes with Windows 11 May PatchesDetails
Intune (MDM) Stack Printing Issue is fixed.This update addresses an issue that affects mobile device management (MDM) customers. This occurs because of execution.
Microsoft Edge IE mode Issus is fixed with May 2023 patch Tuesday updatesIE Mode Pop-up windows open in the background instead of in the foreground.
The LAPS legacy client conflict issue is fixed with May Patch Tuesday updatesFailed to manage the configured local account password. This occurs when you install the legacy LAPS.msi file after you have installed the April 11, 2023, Windows update on the machines that have a legacy LAPS policy.
Secure Boot enablement related issues are fixed with the May Patch Tuesday updateThis update addresses an issue that affects signed Windows Defender Application Control (WDAC) policies. They are not applied to the Secure Kernel.
The error is 0xc0000005 (STATUS_Access_VIOLATION) LSASS issue is fixedThe Local Security Authority Subsystem Service (LSASS) process might stop responding. Because of this, the machine restarts.
Fixed Windows PIN Sign-in Error “The request is not supported”When you use a PIN to sign in to Windows Hello for Business. Signing in to Remote Desktop Services might fail.
The resilient File System (ReFS) related issue is fixed.The resilient File System (ReFS) related issue is fixed.
The Administrator Account Lockout policies issues is fixed.GPResult and Resultant Set of policy did not report them.
SMB Direct issue fixed with this error.Endpoint might not be available on the systems that use multi-byte character sets.
Active Directory Users & Computers DSA.msc stops responding issues is fixedWhen you use TaskPad view to enable or disable many objects simultaneously.
Windows Remote Management (WinRM) client issue is resolved with May patchesThe client returns an HTTP server error status (500). This error occurs when it runs a transfer job in the storage migration service.
Issues Fixed with Windows 11 May Patches

Known Issues from Windows 11 KB5026368 and KB5026372

Let’s look at the issues fixed with Windows 11 May patch Tuesday KBs (KB5026368 and KB5026372). The following table covers both Windows 11 22H2 and 21H2 fixes.

SummaryOriginating updateStatusLast updated
“Local Security Authority protection is off.” with persistent restart
Once enabled, your Windows device might persistently notify you that it is vulnerable, and a restart is required.
N/A
Resolved2023-05-03
13:27 PT
Third-party UI customization apps might cause Windows to not start up
Apps to change behaviors or UI in Windows 11 might cause issues with updates released February 28, 2023 or later.
OS Build 22000.30000
KB5023774
2023-03-28
Resolved External2023-05-08
18:24 PT
Table 2 – Windows 11 KB5026368 KB5026372 May Patches

SCCM Windows 11 KB5026368 and KB5026372 Deployment

Learn how to Deploy Windows 11 KB5026368 and KB5026372 May 2023 Cumulative Updates using SCCM/WSUS. You can deploy Windows 11 May 2023 CU KBs using Intune or SCCM.

Using the following methods, you can create a monthly patch package for May 2023. You can also search with Windows 11 LCU for May 2023 KB5026368 and KB5026372. The easiest way is to check from the SCCM admin console.

NOTE! You can verify the Windows 11 versions (OS Builds, 22000.1936, and 22621.1702) by installing May 2023 Latest Cumulative Updates.

  • In SCCM Console, Navigate to \Software Library\Overview\Software Updates\All Software Updates.
  • You must initiate a WSUS Sync from the All Software Updates node (Right-click on the node and initiate the sync).
  • Search with the following KB5026368 and KB5026372 Numbers.
  • Or you can search with 23-04 Cumulative Update for Windows 11, as shown in the below screenshot.
Name of Windows 11 patches for May 2023Release Date
2023-05 Cumulative Update for Windows 11 Version 22H2 for ARM64-based Systems (KB5026372)5/09/2023 5:00:00 PM
2023-05 Cumulative Update for Windows 11 Version 22H2 for x64-based Systems (KB5026372)5/09/2023 5:00:00 PM
2023-05 Cumulative Update for Windows 11 for ARM64-based Systems (KB5026368)5/09/2023 5:00:00 PM
2023-05 Cumulative Update for Windows 11 for x64-based Systems (KB5026368)5/09/2023 5:00:00 PM
Table 3 -Windows 11 KB5026368 KB5026372 May Patches

Intune Windows 11 KB5026368 and KB5026372 Deployment

Let’s check how to deploy the Windows 11 KB5026368 and KB5026372 May 2023 Patch Tuesday (LCU) Deployment using Intune. You can deploy Windows 11 May CU using Microsoft Intune. The patch deployment process in Microsoft Intune is different from that of SCCM.

I don’t think creating a new patch deployment policy to cater to monthly CU deployments for Windows 11 is mandatory, but you can use the following method to expedite. The existing patch deployment policy will deliver the patches using WUfB (Windows Update for Business).

Read More – Software Update Patching Options with Intune Setup Guide.

You can expedite the Installation of May 2023 quality updates if the device OS version is less than 2023.04. Create expedited update profiles for Quality updates using the following steps.

You can expedite the Installation of May 2023 quality updates if the device OS version is less than 2023.04. Create expedited update profiles for Quality updates using the following steps.

  • Sign in to the Microsoft Intune admin center https://Intune.microsoft.com/
  • Navigate Device -> Windows 10 quality Updates.
  • Click on + Create Profile.

The following are the Settings for Intune quality update profile for the Windows 11 monthly patching process if you want to expedite the deployment of patches. Otherwise, you can use the standard quality updates policy from Intune.

  • Name – Windows 11 May 2023 LCU
  • Description— I would recommend adding a detailed description.
  • Expedite installation of quality updates if the device OS version is less than 9th May 2023 – 2023.05 B Security Updates for Windows 10 and later
  • Number of days to wait before the restart is enforced – 1 Day

More Details on Zero Day Out Of Band Patch Deployment Using Intune MEM Expedite Best Option and Intune Reporting Issue: Expedite Windows Security Patch Deployment.

Windows 11 KB5026368 KB5026372 May Patches Fig.3
Windows 11 KB5026368 KB5026372 May Patches Fig.3

Automated Patch Management with Windows Autopatch

Autopatch helps streamline updating operations and create new opportunities for IT pros. The Windows Autopatch Release Management provides you with more clarity on the Quality, Feature updates, and install schedules in Intune portal, Here you can get more information Windows Autopatch Implementation Setup Guide.

In Intune Portal, Navigate to Devices, Under Windows Autopatch. Select Release Management, which displays the updates and releases scheduled.

  • May 09, 2023—KB5026368 (OS Build 22000.1936)
  • May 14, 2023—KB5026372 (OS Build 22621.1702)

Windows 11 KB5026368 and KB5026372 Direct Download Links

Let’s manually download the 2023 May Cumulative Update for Windows 11 KB5026368 and KB5026372 from the Microsoft Update Catalog website. The following tables provide the direct links to download the May 2023 Cumulative Updates for Windows 11.

You can check the Microsoft Update Catalog portal to get the Windows 11 LCUs direct download links to the hotfixes for May 2023 LCU. Check this out Microsoft Update Catalog –https://www.catalog.update.microsoft.com/

Search for updates from the Windows Update Catalog – To download the latest cumulative update (LCU) for your operating system that you want to apply manually. Put the KB article number and click the Search icon.

Windows 11 KB5026368 KB5026372 May Patches 1
Windows 11 KB5026368 KB5026372 May Patches Fig.4
TitleProductsSizeDirect Download
2023-05 Cumulative Update for Windows 11 Version 22H2 for x64-based Systems (KB5026372)Windows 11 22H2275 MBDownload
2023-05 Cumulative Update for Windows 11 for x64-based Systems (KB5026368)Windows 11 21H2336.5 MBDownload
Table 4 – Windows 11 KB5026368 KB5026372 May Patches

Author

Jitesh has over 5 years of working experience in the IT Industry. He writes and shares his experiences related to Microsoft device management technologies and IT Infrastructure management. His primary focus area is Windows 10 Deployment solution with Configuration Manager, Microsoft Deployment Toolkit (MDT), and Microsoft Intune.

1 thought on “Windows 11 KB5026368 KB5026372 May Patches”

  1. Anyone having issues with2023-05 Cumulative Update for Windows 11 Version 22H2 for x64-based Systems (KB5026372) on Windows 11 machines ?

    Keep running in to errors in Software Center, The update downloads however fails when tries to install..

    0x80246FFF(-2145095681)

    Reply

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.