Category: Windows

If you’ve noticed a mysterious new SecureBoot folder sitting in your C:/Windows directory following the May 2026 Patch Tuesday, you are not alone.

The folder, which has a subfolder named ExampleRolloutScripts that contains several PowerShell scripts, is a harmless administrative helper introduced in the latest security updates for Windows 10 and Windows 11.

According to official Microsoft guidance, these scripts are designed primarily for enterprise IT administrators to monitor the status of the upcoming UEFI CA 2023 Secure Boot certificate updates and to safely automate their deployment across Active Directory environments.

While essential for corporate networks preparing for this critical security transition, average users can safely ignore this tiny 450 KB folder for now.

The transition to the new UEFI CA 2023 Secure Boot certificates mark a critical security change for the Windows ecosystem. It is made necessary by the impending expiration of current certificates that were issued a long time ago.

Secure Boot acts as the fundamental gatekeeper against bootkits and rootkits by ensuring that only trusted, digitally signed firmware and operating system loaders can execute during startup.

Microsoft is employing a highly controlled, phased rollout strategy—which is exactly why administrative validation tools and scripts are currently being deployed.

Why Microsoft is rolling out the folder to anyone is anyone’s guess. It seems that the folder is pushed to all devices running Windows 11, even unmanaged Windows 11 Home systems.

It only took half a decade for Microsoft to remember how to build a functional user interface. On May 15, 2026, the tech giant took to the Windows Insider Blog to announce Preview Build 26300, a supposedly major update designed to give users “more flexibility” over their Taskbar and Start menu.

However, beneath the marketing spin, these groundbreaking additions—like the ability to finally shrink the taskbar, move it to the side or top of the screen, and independently toggle off intrusive file recommendations—are nothing more than basic features Microsoft stripped out of Windows years ago.

Rather than pushing the operating system forward, this long-overdue update rolling out to the Experimental channel feels less like innovation and more like a reluctant apology to power users who have been fighting a restrictive, dumbed-down user interface since 2021.

This is what build 26300 brings back from the dead

Let’s look exactly at what Preview Build 26300 actually brings to the table. The headline “feature” of this update is the reinstatement of taskbar mobility. After years of being glued to the bottom of the screen, users can once again click and drag the taskbar to the left, right, or top edges of their monitors—a decades-old Windows function that was axed during the initial jump to Windows 11.

Accompanying this is the return of taskbar resizing, allowing users to finally shrink the increasingly bloated bar to save precious vertical screen real estate, or expand it for better touch visibility.

Meanwhile, the Start menu receives what is arguably the most highly requested fix: a dedicated, single-click toggle to permanently disable the “Recommended” section. Instead of being forced to look at a useless blank void or unwanted cloud documents, users can now reclaim that entire bottom half of the menu for their own pinned applications.

Pavan Davuluri, Microsoft’s head of Windows and Surface, championed these tweaks on X as a testament to the company “deeply listening to Insiders” and “empowering personalized workflows.”

Personalization and customization is in Windows' DNA. It always has been. Reading through your feedback and meeting with Windows Insiders over the past few months reminded us just how deeply people care about this. You wanted more control, more customization with taskbar and… https://t.co/YpexnoDyGD

— Pavan Davuluri (@pavandavuluri) May 16, 2026

But celebrating the restoration of basic functionality as a triumph of active listening is a massive stretch. While it is undoubtedly a relief to have these customization options back where they belong, packaging them as a bold new step forward highlights a recurring, frustrating cycle in Microsoft’s development ethos: breaking something that works perfectly fine, ignoring the immediate community outcry, and then expecting applause when they finally patch it back together five years later.

If April 2026 was an avalanche of patches, May brings a welcome breather from zero-days but keeps the critical severity count high.

Microsoft’s fifth Patch Tuesday of 2026 has arrived, addressing 120 vulnerabilities in total. While it breaks a long-standing streak by featuring zero publicly disclosed or actively exploited zero-day flaws, the sheer volume of severe remote code execution (RCE) bugs demands attention.

The update contains 17 critical flaws affecting a wide range of enterprise products, including Windows Netlogon, DNS Client, Azure DevOps, and Microsoft Word.

Here is the breakdown of what you need to know, what to patch first, and what might break.

You can download an Excel spreadsheet with information about the patches that Microsoft released:

The May 2026 Patch Day overview

Executive Summary

• Release Date: May 12, 2026
• Total Vulnerabilities: 120
• Critical Vulnerabilities: 17
• Zero-Days: 0

Key Action Item: Administrators must prioritize patching network-exposed infrastructure, specifically domain controllers affected by the Netlogon vulnerability (CVE-2026-41089) and systems running the Windows DNS Client. Simultaneously, Microsoft Office installations need immediate updates to mitigate several highly critical Remote Code Execution vulnerabilities that can be triggered simply via the Windows Preview Pane.

Important Patches

• CVE-2026-41089 — Windows Netlogon Remote Code Execution Vulnerability
• CVE-2026-41096 — Windows DNS Client Remote Code Execution Vulnerability
• CVE-2026-42826 — Azure DevOps Information Disclosure Vulnerability
• CVE-2026-40364 — Microsoft Office Word Remote Code Execution Vulnerability
• CVE-2026-40402 — Windows Hyper-V Elevation of Privilege Vulnerability
• CVE-2026-32185 — Microsoft Teams Spoofing Vulnerability

Cumulative Updates

Product, Version	Links	Notes
Windows 11 & Windows 10	KB5087544 (Windows 10) KB5089549 (Windows 11)	Security updates addressing OS-level RCEs in Netlogon, DNS Client, and Windows Graphics components (Win32k). Also resolves various Elevation of Privilege flaws across the Windows Kernel.

Deep Dive: The Critical Vulnerabilities

Microsoft confirmed that it patched zero 0-day vulnerabilities this Patch Day, but addressed a heavy enterprise focus of critical remote code execution and information disclosure flaws.

Here is the critical overview:

CVE-2026-41089 (Windows Netlogon Remote Code Execution Vulnerability)

A critical stack-based buffer overflow flaw (CVSS 9.8) affecting Windows Netlogon. A remote, unauthenticated attacker could exploit this by sending a crafted network request to a Windows server running as a domain controller. If successful, this causes the Netlogon service to improperly handle the request, allowing the attacker to execute malicious code without requiring any prior access or credentials.

CVE-2026-41096 (Windows DNS Client Remote Code Execution Vulnerability)

This critical heap-based buffer overflow vulnerability (CVSS 9.8) affects the Windows DNS service. It allows remote code execution over the network and can be exploited by sending a malicious DNS response, triggering memory corruption within the Windows DNS client. Depending on the configuration, an unauthenticated attacker can achieve full RCE.

CVE-2026-42826 (Azure DevOps Information Disclosure Vulnerability)

This is the highest-rated flaw this month, boasting a perfect CVSS score of 10.0. While Microsoft withheld specific exploitation details, a perfect severity score indicates that unauthenticated attackers could potentially access highly sensitive enterprise data, credentials, and source code stored or handled in Azure DevOps.

CVE-2026-40361, CVE-2026-40364, CVE-2026-40366, CVE-2026-40367 (Microsoft Word RCE Vulnerabilities)

A cluster of critical vulnerabilities in Microsoft Word (CVSS 8.4) that allow an unauthorized attacker to execute code locally. Notably, these flaws can be triggered through the Windows Preview Pane, meaning a user only needs to preview a specially crafted document to be compromised, without ever fully opening the file.

CVE-2026-40402 (Windows Hyper-V Elevation of Privilege Vulnerability)

A severe flaw (CVSS 9.3) allowing for a guest-to-host escape in Windows Hyper-V. By targeting certain hardware device registers, an attacker operating from within a guest virtual machine can escape the isolated environment and gain SYSTEM privileges on the underlying host system.

First Steps: Your Patch Tuesday Strategy

• Prioritize Domain Controllers (Netlogon) and DNS Client services
• Address high-risk Azure deployments (DevOps, Cloud Shell)
• Update Office installations immediately to mitigate Preview Pane risks

The time to go brew a coffee whenever you start a taxing program on Windows could soon be a thing of the past. Reports by Windows Central and other sources suggest that Microsoft is testing a new Low Latency Profile feature that could speed up the start of apps by up to 70 percent.

The idea behind the feature is straightforward: Boost the processors frequency for certain taxing tasks on the system to speed them up. Examples are the opening of apps, system flyouts, or the display of menus on the system.

According to Windows Central, app starts could be boosted by up to 40 percent while the launch times of interfaces could be boosted up to 70 percent.

Depending on the PC that you are using, these things may happen near instantly already all the time. Deskmodder tested the feature in an Insider build recently and concluded that it does not really help, if the PC in question is modern.

However, when a PC is older, it could indeed speed up certain options noticeably.

The new feature is part of Microsoft’s effort to improve the performance and stability of the operating system. It is but one of the changes that Microsoft is testing currently. Others include optimizing apps or code, or switching to modern interfaces.

The new Low Latency Profile feature runs in the background automatically. Whether there will be an option in Settings or elsewhere to disable the feature remains to be seen. It is likely that there will be at least a Group Policy and Regedit option to manage that.

If you want to try out Low Latency Profile in recent Insider builds and see if it makes any difference, enable these feature IDs:

LowLatencyProfile: 60716524
LowLatencyProfileForApplicationLaunch: 61391826 https://t.co/VW4xXmGdEa

— phantomofearth 🌳 (@phantomofearth) May 7, 2026

Phantom of Earth posted the relevant IDs for the feature on X.

If you want to try out Low Latency Profile in recent Insider builds and see if it makes any difference, enable these feature IDs:

LowLatencyProfile: 60716524
LowLatencyProfileForApplicationLaunch: 61391826

Run .\vivetool /enable /id:60716524,61391826 in Terminal (elevated) to enable these.

Imagine trying to secure your PC’s most important files, only to discover that your trusted backup software has been actively locked out by the operating system itself. That is exactly what is happening to Windows 11 users this week, as Microsoft has officially confirmed in a recently updated support document that its latest patches (KB5083769 and KB5083631) are intentionally blocking popular third-party backup applications like Macrium Reflect.

The Redmond giant explained that this disruptive change is the result of a strict new security hardening measure, which actively adds the psmounterex.sys kernel driver to the Microsoft Vulnerable Driver Blocklist to protect systems from known exploits—leaving affected users dealing with timeout errors and broken disk image mounting.

Microsoft confirms the change and that third-party backup software may be affected on a new support page. However, the company has not added any information about potential issues to the official KB release notes, making it difficult for affected users and also system administrators to investigate the issue.

According to the company, users and IT administrators may observe the following behavior after installing April 2026 or later updates for Windows 11:

What new behavior should I expect?
Users and IT administrators might observe the following behavior after installing the update:

Backup applications that rely on the kernel driver psmounterex.sys might fail to mount backup image files as virtual drives.

Attempting to browse or restore from a backup image might result in errors or timeouts.

Failures might be followed by error messages, such as “The backup has failed because Microsoft VSS has timed out during the snapshot creation” or VSS_E_BAD_STATE.

Event Viewer might show Code Integrity errors indicating that psmounterex.sys was blocked from loading.

Backup creation (full image backups) may still succeed, but image-mount operations will fail.

Microsoft claims that the change is “designed to protect devices against known vulnerabilities in the psmounterex.sys kernel driver. That is exactly the driver that some backup apps, including Macrium Reflect, use for managing and mounting disk images.

The vulnerability that Microsoft mentions was discovered in certain versions of the driver in late 2023 already. If exploited, bad actors can use this flaw to escalate their privileges and execute arbitrary malicious code at the kernel level, completely compromising the system.

The result for users who run backup apps that rely on the driver: When a user tries to mount a backup image, the backup app attempts to load the psmounterex.sys driver. Windows Code Integrity enforcement steps in and actively blocks the driver from loading because it’s on the blacklist. Without the driver, the backup app cannot complete its task, leading to Volume Shadow Copy Service (VSS) timeouts and mounting errors.

In short, Microsoft is deliberately breaking the functionality of these apps to stop a known security loophole from being exploited at the kernel level.

Another one? That could be the reaction of veteran Windows users who read the headline. Microsoft confirmed another BitLocker related issue in Windows 11. This one may be caused by installing the most recent cumulative update for the operating system.

In the Known issues section of the update, Microsoft confirms that devices might boot into the BitLocker Recovery screen and not the desktop.

According to the description, the issue is caused by an “unrecommended BitLocker Group Policy configuration”. Only a “limited number of systems” are affected according to Microsoft. The company says that the issue affects only systems for which all of the following conditions are true:

• BitLocker is enabled on the OS drive.
• The Group Policy “Configure TPM platform validation profile for native UEFI firmware configurations” is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually).
• System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as “Not Possible”.
• The Windows UEFI CA 2023 certificate is present in the device’s Secure Boot Signature Database (DB), making the device eligible for the 2023‑signed Windows Boot Manager to be made the default.
• The device is not already running the 2023-signed Windows Boot Manager.

Devices that meet the conditions may boot into recovery mode after installing the KB508376 for Windows 11, versions 24H2 or 25H2.

A workaround is available to remove the Group Policy configuration before installing the update.

1. Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console.
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
3. Set “Configure TPM platform validation profile for native UEFI firmware configurations” to “Not Configured“.
4. Run the following command on affected devices to propagate the policy change: gpupdate /force
5. Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: 
6. Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: 
7. ​​​​​​​This updates the BitLocker bindings to use the Windows-selected default PCR profile.

Microsoft plans to release a permanent fix in the future to address this. Windows users who use a Microsoft Account can look up the recovery key for BitLocker online.