Microsoft Ships KB5089549 May 2026 Update Fixing Three Windows 11 CVEs
The monthly cumulative update addresses CVE-2026-0234, CVE-2026-0235 and CVE-2026-0236, plus stability and Windows Search performance fixes, and requires a restart to complete.
On this page
Key takeaways
- KB5089549 was released May 12, 2026 for Windows 11 24H2 and 25H2.
- It patches CVE-2026-0234 (kernel EoP), CVE-2026-0235 (DirectX memory corruption) and CVE-2026-0236 (networking authentication bypass).
- New builds are 26100.8457 (24H2) and 26200.8457 (25H2).
- A system restart is required; installation typically takes 15-30 minutes.
- Known issues include a temporary Windows Search service restart and legacy third-party driver compatibility concerns.
What to do now
High urgency- Test KB5089549 in a controlled environment before broad deployment
- Deploy via Windows Update, WSUS, SCCM or Intune during a maintenance window
- Plan for a required restart and monitor for the documented known issues
Microsoft released KB5089549 on May 12, 2026, a cumulative security update for Windows 11 that patches three vulnerabilities across the Windows kernel, DirectX graphics subsystem and networking stack. The update raises Windows 11 Version 24H2 to build 26100.8457 and Version 25H2 to build 26200.8457 on both x64 and ARM64.
Because two of the three flaws can lead to code execution or SYSTEM-level access, administrators should test and deploy the update through their normal patch channels, factoring in a required restart and a small set of known post-install issues.
Microsoft's KB5089549 cumulative update patches three Windows 11 CVEs and adds stability and Search performance fixes for 24H2 and 25H2.
Install KB5089549 via Windows Update, WSUS, Intune or the Microsoft Update Catalog; it patches three CVEs and requires a restart.
Affected & context
KB5089549 is a cumulative security update released May 12, 2026 for Windows 11 24H2 and 25H2 that addresses three CVEs and includes stability and performance fixes.
The update patches a kernel elevation-of-privilege, a DirectX graphics memory corruption, and a networking authentication bypass affecting widely deployed Windows 11 versions.
Windows 11 Version 24H2 and 25H2 systems on x64 and ARM64.
- Vendors
- Microsoft
- Products
- Windows 11 Version 24H2Windows 11 Version 25H2
- Geography
- Global
- CVEs
- CVE-2026-0234CVE-2026-0235CVE-2026-0236
What's in the update
KB5089549 is a monthly cumulative security update for Windows 11 released on May 12, 2026. It bundles security fixes with stability and performance improvements and applies to Version 24H2 and Version 25H2 on x64 and ARM64.
After installation, 24H2 systems report build 26100.8457 and 25H2 systems report build 26200.8457. A restart is required to complete installation and activate the security fixes.
- 24H2 build after install: 26100.8457
- 25H2 build after install: 26200.8457
Vulnerabilities addressed
The update resolves three vulnerabilities described in Microsoft's documentation:
- CVE-2026-0234 — a Windows kernel elevation-of-privilege flaw in kernel-mode driver communication that could allow SYSTEM-level access; components include ntoskrnl.exe and related kernel drivers.
- CVE-2026-0235 — memory corruption in the DirectX graphics kernel subsystem that could allow arbitrary code execution with kernel privileges; components include dxgkrnl.sys and win32k.sys.
- CVE-2026-0236 — an authentication bypass in the Windows networking stack affecting protocol handlers and credential validation; components include tcpip.sys and netio.sys.
Beyond the security fixes, KB5089549 improves memory management under high-load conditions, optimizes Windows Search indexing on large file sets, and enhances compatibility with third-party security software and drivers.
Affected systems
The update applies to the following Windows 11 editions and architectures:
- Windows 11 Version 25H2 — x64 and ARM64 (build 26200.8457)
- Windows 11 Version 24H2 — x64 and ARM64 (build 26100.8457)
Deployment and installation
KB5089549 ships through Windows Update, the Microsoft Update Catalog, and enterprise channels including WSUS, Configuration Manager (SCCM) and Intune. It is classified as a high-priority security update.
- Package size is roughly 890 MB for x64 and 720 MB for ARM64.
- Requires at least 2 GB of free disk space and administrative privileges for manual installation.
- Installation typically takes 15-30 minutes and requires a restart.
Verify installation
Confirm the update with PowerShell using Get-HotFix -Id KB5089549, or check the OS Build number against 26100.8457 (24H2) or 26200.8457 (25H2).
Known issues
Microsoft's documentation lists a few known issues after installing KB5089549:
- The Windows Search service may restart temporarily on the first boot after install, typically recovering within 2-3 minutes.
- Some older third-party drivers — primarily legacy graphics and network adapter drivers — may need vendor updates for full compatibility.
- Hyper-V virtual machines may see temporary performance degradation during the first 24 hours while background optimization completes.
Installation failures
If installation fails, confirm at least 2 GB of free disk space is available and consider temporarily disabling third-party antivirus during the update process.
Timeline
KB5089549 released
Microsoft publishes KB5089549 via Windows Update and the Microsoft Update Catalog, raising builds to 26100.8457 (24H2) and 26200.8457 (25H2).
Source: Microsoft update documentation
Confidence: Medium
Impact
KB5089549 closes three vulnerabilities on Windows 11 24H2 and 25H2 and adds stability and Search performance fixes; deployment requires a restart and post-install monitoring.
Business impact
Patching requires a maintenance window with a mandatory restart; testing is advised where specialized hardware or security software is in use.
Technical impact
Updates kernel, graphics and networking components (ntoskrnl.exe, dxgkrnl.sys, win32k.sys, tcpip.sys, netio.sys) and changes memory-manager and Search indexing behavior.
Security impact
Addresses a kernel elevation-of-privilege, a graphics memory corruption enabling code execution, and a networking authentication bypass.
Affected audience: IT admins, MSPs, Windows 11 end users
Action required.
Technical details
- CVEs
- CVE-2026-0234, CVE-2026-0235, CVE-2026-0236
- Affected versions
- Windows 11 24H2 (pre-26100.8457), Windows 11 25H2 (pre-26200.8457)
- Patched versions
- 26100.8457, 26200.8457
Detection methods
- Get-HotFix -Id KB5089549
- Check OS Build number in System Information
- Settings > Update & Security > Windows Update > View update history
Mitigations
- Install KB5089549 and restart to activate the fixes
Response
Customer guidance
Microsoft advises installing the update through standard channels and notes a required restart; enterprise admins should test the update, plan a maintenance window, and monitor for the documented known issues.
Response status: Patched
Patch available: Yes
Workaround available: No
FAQ
What does KB5089549 fix?
It patches CVE-2026-0234 (Windows kernel elevation of privilege), CVE-2026-0235 (DirectX graphics memory corruption) and CVE-2026-0236 (networking authentication bypass), and includes stability, Windows Search and driver-compatibility improvements.
Which Windows versions does KB5089549 apply to?
Windows 11 Version 24H2 and 25H2 on x64 and ARM64. It raises builds to 26100.8457 (24H2) and 26200.8457 (25H2).
How do I verify KB5089549 is installed?
Run Get-HotFix -Id KB5089549 in PowerShell, check update history in Windows Update, or confirm the OS Build number matches 26100.8457 or 26200.8457.
Are there known issues with KB5089549?
Yes — a temporary Windows Search service restart on first boot, possible compatibility issues with older third-party drivers, and temporary Hyper-V VM performance degradation during the first 24 hours.
The bottom line
KB5089549, released May 12, 2026, patches three Windows 11 CVEs and adds stability and Search performance fixes for 24H2 and 25H2, raising builds to 26100.8457 and 26200.8457.
Deploy KB5089549 promptly given the kernel and graphics fixes, but plan for the required restart and known post-install issues.
What happens next
Administrators should validate the update in test rings before broad rollout and monitor endpoints for the documented Search, driver and Hyper-V issues.
What to do
Test and deploy KB5089549 through your standard update channels.
Sources
Microsoft · May 12, 2026 · Primary source
Claims supported
- KB5089549 released May 12, 2026 for Windows 11 24H2 and 25H2
- Patches CVE-2026-0234, CVE-2026-0235 and CVE-2026-0236
- New builds 26100.8457 and 26200.8457