Microsoft Ships KB5089466 Hotpatch for Windows 11 24H2 and 25H2
A no-reboot hotpatch delivers security fixes to x64 and ARM64 Windows 11 systems, but the vendor documentation does not list specific CVEs.
On this page
Key takeaways
- KB5089466 is a restart-free hotpatch released May 12, 2026 for Windows 11 24H2 and 25H2.
- It applies to x64 and ARM64, updating builds to 26100.8390 and 26200.8390.
- Fixes span kernel privilege escalation, network RCE, authentication bypass, driver memory corruption and information disclosure.
- Delivery channels include Windows Update, Microsoft Update Catalog, WSUS and Intune.
- Vendor documentation does not enumerate specific CVE identifiers for this hotpatch.
What to do now
High urgency- Deploy KB5089466 to all Windows 11 24H2 and 25H2 systems via your update channel.
- Verify installation with Get-HotFix -Id KB5089466 across the fleet.
- Investigate systems logging Event ID 20 for failed installations.
Microsoft released KB5089466, a security hotpatch for Windows 11 versions 24H2 and 25H2, on May 12, 2026. The update applies to both x64 and ARM64 systems and raises OS builds to 26100.8390 (24H2) and 26200.8390 (25H2), delivering security fixes without requiring a system restart.
The hotpatch addresses multiple high-severity vulnerabilities spanning the Windows kernel, networking stack, authentication mechanisms, system drivers and services — while allowing organizations to patch without a maintenance-window reboot.
Microsoft's KB5089466 hotpatch fixes multiple high-severity Windows 11 flaws on 24H2 and 25H2 without requiring a restart.
Deploy KB5089466 across Windows 11 24H2/25H2 fleets via Windows Update, WSUS or Intune. Verify with Get-HotFix -Id KB5089466. No reboot needed.
Affected & context
Microsoft released KB5089466, a security hotpatch for Windows 11 versions 24H2 and 25H2 on x64 and ARM64, on May 12, 2026, updating builds to 26100.8390 and 26200.8390 without requiring a restart.
The update addresses multiple high-severity vulnerabilities across core Windows components, and its hotpatch delivery lets enterprises apply fixes without downtime.
All editions of Windows 11 24H2 and 25H2 — Home, Pro, Enterprise, Education and Enterprise LTSC — on both x64 and ARM64, whether domain-joined or standalone.
- Vendors
- Microsoft
- Products
- Windows 11 Version 24H2Windows 11 Version 25H2
- Geography
- Global
What happened
Microsoft released KB5089466 on May 12, 2026 as a security hotpatch for Windows 11 versions 24H2 and 25H2. The update applies to systems running both x64 and ARM64 architectures and moves affected builds to 26100.8390 for 24H2 and 26200.8390 for 25H2.
As a hotpatch, KB5089466 uses Microsoft's in-memory patching technology to apply security fixes without a system restart. Microsoft's documentation describes the download as roughly 45–65 MB depending on architecture, with installation completing in about two to five minutes.
- Released May 12, 2026
- Builds: 26100.8390 (24H2) and 26200.8390 (25H2)
- No restart required (hotpatch)
Vulnerabilities addressed
According to Microsoft's documentation, the hotpatch resolves several categories of high-severity issues across core Windows components. Specific CVE identifiers and CVSS scores are not listed in the source material.
- Windows Kernel privilege escalation flaws in the process/thread manager, memory manager and object manager subsystems.
- Remote code execution flaws in networking components, including TCP/IP processing and SMB implementations.
- Authentication bypass issues affecting NTLM, Kerberos and local authentication mechanisms.
- Memory corruption vulnerabilities in graphics, storage and network adapter drivers.
- Information disclosure vulnerabilities in Windows services and inter-process communication channels.
No CVEs listed
The provided documentation describes vulnerability categories but does not enumerate individual CVE numbers, CVSS scores or exploitation status. Treat severity as high based on the described impact until Microsoft's security update guide is cross-checked.
Affected systems
The update applies to all editions of Windows 11 24H2 and 25H2 — Home, Pro, Enterprise, Education and Enterprise LTSC — across x64 and ARM64. Both domain-joined and standalone systems require the update for full protection.
- Windows 11 24H2 (x64 and ARM64) — build 26100.8390 after update
- Windows 11 25H2 (x64 and ARM64) — build 26200.8390 after update
Deployment and verification
Microsoft distributes KB5089466 through Windows Update, the Microsoft Update Catalog, WSUS and Intune. Prerequisites include Windows 11 24H2 (build 26100) or 25H2 (build 26200), at least 500 MB of free disk space and an active Windows Update service.
Administrators can confirm installation with PowerShell:
Get-HotFix -Id KB5089466
Get-ComputerInfo | Select-Object WindowsBuildLabExSuccessful installation is logged in Microsoft-Windows-WindowsUpdateClient/Operational with Event ID 19; failures log Event ID 20. Package state is also recorded under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages.
Known issues
Microsoft documents a small set of known issues:
- Error 0x80070643 on systems with insufficient disk space — free at least 500 MB before retrying.
- Error 0x8007000D from corrupted Windows Update components — run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth before retrying.
- Some third-party antivirus tools may temporarily flag modified system files after installation.
- Systems with 4 GB RAM or less may see temporary performance degradation in the first hour.
Timeline
KB5089466 released
Microsoft begins distributing KB5089466 through Windows Update for Windows 11 24H2 and 25H2.
Source: Microsoft update documentation
Confidence: High
Impact
Windows 11 24H2 and 25H2 systems without the hotpatch remain exposed to privilege escalation, remote code execution, authentication bypass and information disclosure risks.
Business impact
Unpatched enterprise fleets with network exposure remain vulnerable; the hotpatch enables patching without downtime.
Technical impact
Fixes core kernel, networking, authentication, driver and service vulnerabilities without requiring a restart.
Security impact
Addresses multiple high-severity flaws that could enable local and remote exploitation, including SYSTEM-level compromise and RCE via malformed network traffic.
Privacy impact
Patches information disclosure flaws that could expose sensitive system data and credentials.
Affected audience: IT admins, MSPs, Enterprise security teams
Action required.
Technical details
- Affected versions
- Windows 11 24H2 (pre-26100.8390), Windows 11 25H2 (pre-26200.8390)
- Patched versions
- 26100.8390, 26200.8390
Detection methods
- Get-HotFix -Id KB5089466
- WindowsUpdateClient/Operational Event ID 19 (success) / 20 (failure)
Mitigations
- Install KB5089466 via Windows Update, Microsoft Update Catalog, WSUS or Intune.
Response
Customer guidance
Microsoft advises installing the hotpatch through standard update channels; the update installs without a restart and can be removed via Settings > Update & Security > Windows Update > View update history > Uninstall updates if instability occurs.
Response status: Patched
Patch available: Yes
Workaround available: No
FAQ
What does KB5089466 fix?
It is a security hotpatch for Windows 11 24H2 and 25H2 that addresses multiple high-severity vulnerabilities in the Windows kernel, networking stack, authentication mechanisms, system drivers and services.
Does KB5089466 require a restart?
No. It is delivered as a hotpatch that applies security fixes in memory without requiring a system restart.
Which Windows 11 versions and builds are affected?
Windows 11 24H2 and 25H2 on x64 and ARM64. After installation, builds move to 26100.8390 (24H2) and 26200.8390 (25H2).
How do I verify KB5089466 is installed?
Run Get-HotFix -Id KB5089466 in PowerShell. You can also check WindowsUpdateClient/Operational for Event ID 19 (success) or 20 (failure).
The bottom line
KB5089466 is a May 12, 2026 hotpatch for Windows 11 24H2 and 25H2 that fixes multiple high-severity vulnerabilities without requiring a restart.
A no-reboot hotpatch lets enterprises close serious Windows 11 flaws without maintenance-window downtime.
What happens next
Administrators should confirm rollout completeness and cross-reference Microsoft's security update guide for specific CVEs once available.
What to do
Deploy KB5089466 and verify with Get-HotFix -Id KB5089466.
Sources
Microsoft · May 12, 2026 · Primary source
Claims supported
- KB5089466 released May 12, 2026 for Windows 11 24H2 and 25H2 as a restart-free hotpatch.
- Builds updated to 26100.8390 and 26200.8390 on x64 and ARM64.
- Fixes span kernel, networking, authentication, drivers and services.