Microsoft has released the May 2026 Patch Tuesday cumulative update for Windows 10, with KB5087544 now available for supported systems covered by Extended Security Updates and related long-term servicing channels.
The update moves Windows 10 version 22H2 to build 19045.7291 and Windows 10 version 21H2 to build 19044.7291. As usual for a monthly security release, KB5087544 bundles security fixes with a smaller set of quality changes, including a Remote Desktop fix and Secure Boot-related update behavior.
What KB5087544 changes
The most visible fix in this release addresses a Remote Desktop Connection warning dialog problem. Microsoft says the security warning dialog could render incorrectly on multi-monitor setups when the displays used different scaling settings. The issue could appear after installing the April 14, 2026 Windows security update, KB5082200.
KB5087544 also changes how Windows reports Secure Boot status inside the Windows Security app. That matters because Microsoft is preparing devices for updated Secure Boot certificates, with existing certificates on many Windows devices set to begin expiring from June 2026.
The rollout remains staged. Windows quality updates now include additional device targeting data so eligible systems can automatically receive new Secure Boot certificates. Microsoft says devices receive those certificates only after showing enough successful update signals, which keeps the process controlled rather than pushing the change to every device at once.
The update also includes daylight saving time support for the Arab Republic of Egypt to reflect the government DST change order from 2023.
| Area | Change in KB5087544 |
|---|---|
| Remote Desktop | Fixes an incorrectly rendered security warning dialog on some mixed-scaling multi-monitor systems. |
| Secure Boot | Adds dynamic Secure Boot status reporting in the Windows Security app. |
| Secure Boot certificates | Expands device targeting data for a phased rollout of new certificates to eligible devices. |
| Time zone and DST | Adds Egypt daylight saving time support tied to the 2023 government change. |
Known issue to watch for
Microsoft lists one known issue with this release involving BitLocker recovery prompts. Some devices may ask for the BitLocker recovery key on the first restart after installing the update, but the conditions are narrow.
According to Microsoft, the issue applies to a limited number of systems where BitLocker is enabled on the operating system drive, a specific TPM platform validation Group Policy configuration includes PCR7, System Information reports Secure Boot State PCR7 Binding as “Not Possible,” and the Windows UEFI CA 2023 certificate is present in the device’s Secure Boot signature database.
That combination is unlikely on typical personal PCs, but it is worth flagging for IT-managed environments. Admins should confirm recovery key availability before broadly deploying the update to systems that may match those conditions.
How to get the update
KB5087544 is distributed through the normal Windows Update channels for eligible Windows 10 installations. Standalone packages are also available through the Microsoft Update Catalog for organizations or users who need manual deployment.
If earlier cumulative updates are already installed, Windows should download and install only the new changes contained in this package. Devices that are not enrolled in an eligible support path should not expect the same post-end-of-support update flow as systems covered by ESU or long-term servicing support.
For most users who still rely on Windows 10 in a supported configuration, the main reason to install KB5087544 is straightforward: it includes the month’s security fixes, cleans up a Remote Desktop display problem, and continues Microsoft’s phased work around Secure Boot certificate readiness.