KB5087544 — May 2026 Security Update for Windows 10

Overview

KB5087544 is a critical security update released on May 12, 2026, for Windows 10 systems running Version 21H2 and 22H2. This update addresses five critical vulnerabilities that could allow attackers to compromise system security through privilege escalation, remote code execution, and security feature bypass attacks.

The update brings affected systems to Build 19044.7291 for Windows 10 Version 21H2 and Build 19045.7291 for Windows 10 Version 22H2 across all supported architectures including x64, x86, and ARM64 platforms.

Security Vulnerabilities Addressed

This update resolves multiple high-severity vulnerabilities that pose significant security risks to Windows 10 environments:

Kernel Privilege Escalation (CVE-2026-0187, CVE-2026-0188)

Two critical vulnerabilities in the Windows kernel allow local attackers to escalate privileges from standard user to SYSTEM level. These vulnerabilities affect core kernel components responsible for memory management and system call handling. Exploitation requires local access but no user interaction, making these particularly dangerous in multi-user environments.

Network Authentication Bypass (CVE-2026-0189)

A critical vulnerability in Windows network authentication protocols allows remote attackers to bypass authentication mechanisms and gain unauthorized access to network resources. This vulnerability affects SMB, Kerberos, and other network authentication services, potentially allowing lateral movement in enterprise networks.

Graphics Memory Corruption (CVE-2026-0190)

Memory corruption vulnerabilities in the Windows Graphics Device Interface can be exploited through specially crafted image files to achieve remote code execution. This vulnerability is particularly concerning as it can be triggered through web browsers, email attachments, or any application that processes image files.

Application Control Bypass (CVE-2026-0191)

A security feature bypass vulnerability in Windows Defender Application Control allows attackers to execute unauthorized code on systems with strict application control policies. This undermines the security posture of organizations relying on application whitelisting for endpoint protection.

TCP/IP Remote Code Execution (CVE-2026-0192)

A remote code execution vulnerability in the Windows TCP/IP stack can be exploited through specially crafted network packets without user interaction. This vulnerability is particularly dangerous for systems exposed to untrusted networks or the internet.

Affected Systems

This update applies to the following Windows 10 configurations:

This update is also available for Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021 editions.

Installation Requirements

Before installing KB5087544, ensure your system meets the following requirements:

• Minimum 2 GB free disk space for installation
• Active internet connection for Windows Update delivery
• Administrative privileges for manual installation
• No pending restart requirements from previous updates

The installation process typically takes 15-30 minutes depending on system configuration and requires a restart to complete.

Verification of Installation

To verify successful installation of KB5087544, use one of the following methods:

Windows Settings

Navigate to Settings > Update & Security > Windows Update > View update history and confirm KB5087544 appears in the list of successfully installed updates.

PowerShell Command

Get-HotFix -Id KB5087544

System Information

Check the OS Build number in Settings > System > About. The build should show 19044.7291 for Windows 10 Version 21H2 or 19045.7291 for Windows 10 Version 22H2.

Enterprise Deployment Considerations

Organizations should prioritize deployment of this update due to the critical nature of the vulnerabilities addressed. Consider the following deployment strategies:

Phased Rollout

Deploy to test systems first, followed by critical infrastructure, and finally to general user populations. Monitor for compatibility issues during each phase.

Network Impact

The network authentication fixes may require coordination with network security teams to ensure proper functionality of domain authentication and file sharing services.

Application Testing

Test critical business applications, particularly those that interact with graphics components or use legacy Windows APIs, before widespread deployment.