# Microsoft Patches 120 Vulnerabilities in Windows 10 KB5087544 Extended Security Update
Microsoft released the Windows 10 KB5087544 extended security update on May 12, 2026, addressing the complete slate of May 2026 Patch Tuesday vulnerabilities while simultaneously fixing a critical Remote Desktop display issue and enhancing Secure Boot certificate management. The update, available to Windows 10 Enterprise LTSC and Extended Security Update (ESU) program subscribers, brings systems to build 19045.7291 (standard) or 19044.7291 (LTSC 2021 variant) and represents Microsoft's continued commitment to supporting Windows 10 beyond its mainstream support lifecycle.
## Background and Context
Windows 10, released in 2015, reached its mainstream support end-of-life on October 13, 2020, yet remains one of the most widely deployed operating systems globally. For organizations unwilling or unable to migrate to Windows 11, Microsoft offers the Extended Security Update (ESU) program—a paid extension that continues to receive critical and important security patches for an additional five years beyond mainstream support. Windows 10 Enterprise LTSC (Long-Term Servicing Channel) editions similarly receive extended support windows, making them attractive to enterprise and government environments requiring stability and predictability over new features.
The KB5087544 update underscores this ongoing support commitment. As Microsoft no longer develops new features for Windows 10, every update focuses exclusively on security fixes and critical stability improvements—a pragmatic approach given the operating system's age and entrenched market position.
## May 2026 Patch Tuesday: 120 Vulnerabilities Addressed
The May 2026 Patch Tuesday cycle addressed 120 vulnerabilities across Microsoft's product portfolio, with KB5087544 patching a significant subset affecting Windows 10 users. Notably, this month's update contained no zero-day vulnerabilities—a welcome break from the pattern of the previous two months, which saw zero-days in March and April 2026. This steady flow of vulnerabilities, even without public exploits, underscores the importance of maintaining a rigorous patching discipline.
The breadth of fixes—120 vulnerabilities in a single cycle—reflects the scale of the attack surface across modern Windows environments and the persistence of application, driver, and system-level weaknesses discovered by researchers, security vendors, and occasionally adversaries.
## Technical Details and Specific Fixes
### Remote Desktop Security Warning Fix
One of the most visible improvements addresses a regression introduced by the April 2026 security update (KB5087544's predecessor). The earlier patch introduced new security warnings when opening Remote Desktop Connection (.rdp) files, but these warnings rendered incorrectly on multi-monitor setups with differing display scaling settings. This had created a poor user experience and forced IT administrators to manage frustrated users unable to properly see or interact with security dialogs—an ironic outcome for a security improvement.
The May update corrects this rendering issue, ensuring that Remote Desktop security warnings display properly regardless of display configuration.
### Secure Boot Dynamic Status Reporting
KB5087544 enables dynamic status reporting for Secure Boot states within the Windows Security App, improving visibility into firmware security posture. More significantly, the update implements enhanced device targeting for new Secure Boot certificates. Rather than pushing certificates to all devices indiscriminately, Microsoft now employs a phased, confidence-based rollout—devices receive new Windows UEFI CA 2023 certificates only after demonstrating sufficient successful update signals.
This measured approach reduces the risk of certificate deployment issues bricking systems or breaking boot sequences, a recognized concern in large-scale enterprise deployments.
### Daylight Saving Time Update
The update includes a minor but necessary adjustment: support for the Arab Republic of Egypt's government-mandated DST change order issued in 2023. While seemingly trivial, DST updates prevent scheduling anomalies, authentication failures, and time-dependent security controls from misbehaving across affected regions.
## Known Issues and Workarounds
Microsoft has flagged a significant known issue affecting BitLocker-encrypted systems with specific Group Policy configurations. After installing recent updates, some systems prompt users to enter their BitLocker recovery key on boot—a severe operational disruption in large deployments.
Root cause: The issue affects systems using a specific BitLocker Group Policy configuration that includes PCR7 (Platform Configuration Register 7) in the TPM validation profile, combined with Secure Boot and boot manager conditions tied to the newer Windows UEFI CA 2023 certificate.
Temporary workaround (as advised by Microsoft):
1. Remove the affected Group Policy setting
2. Suspend BitLocker
3. Resume BitLocker to regenerate default PCR bindings
Microsoft indicates a permanent fix is in development but has not announced a timeline. Organizations should avoid deploying this update to systems with the affected BitLocker configuration until the permanent fix is released.
## Implications for Enterprise Organizations
For the millions of organizations still operating Windows 10 systems, KB5087544 represents a critical maintenance milestone. The combination of 120 patched vulnerabilities, Secure Boot improvements, and Remote Desktop fixes addresses real-world attack vectors:
However, the BitLocker issue presents a deployment challenge requiring IT teams to audit their Group Policy configurations before rolling out the update broadly.
## Recommendations
For Windows 10 ESU and LTSC subscribers:
| Priority | Action |
|----------|--------|
| Immediate | Audit BitLocker Group Policy configurations containing PCR7 settings |
| High | Test KB5087544 in a non-production environment, particularly on multi-monitor RDP setups and BitLocker-enabled devices |
| Standard | Deploy to production systems after validation, prioritizing systems with the fewest BitLocker constraints |
| Ongoing | Plan Windows 11 migration for systems approaching ESU expiration |
Organizations without BitLocker configurations using PCR7 can proceed with standard monthly patching schedules.
---
## HackWire Analysis
The KB5087544 update exemplifies a critical tension in modern security: Windows 10's extended support lifecycle creates both opportunity and risk. On one hand, 120 patched vulnerabilities in a single month demonstrates Microsoft's sustained engineering effort. On the other hand, the volume itself reflects the reality that Windows 10 was designed in an era with fundamentally different threat assumptions—before advanced persistent threats routinely leveraged firmware-level attacks, before container escape techniques matured, before the intersection of IoT and cloud infrastructure created novel lateral movement paths.
The Secure Boot certificate evolution is particularly telling. The need for phased rollouts and "high confidence device targeting" suggests that even routine firmware updates now carry deployment risk at scale. This is not a Windows 10 problem specifically; it reflects industry-wide challenges in managing heterogeneous hardware, BIOS variants, and the intricate dance between operating systems and firmware that has grown exponentially more complex since 2015.
The BitLocker regression—where a security update creates recovery key prompts—illustrates another pattern: the cascading complexity of nested security mechanisms. PCR7 bindings, Secure Boot conditions, UEFI certificates, and TPM policies are individually sound but interact in ways that even Microsoft's testing can miss. Organizations with both BitLocker and strict Secure Boot policies occupy an edge case that doesn't fail gracefully.
For defenders, KB5087544 reinforces a fundamental principle: patching is necessary but not sufficient. A device protected by every monthly security update but misconfigured for BitLocker or exposed via poorly segmented Remote Desktop access remains vulnerable. The 120 vulnerabilities fixed this month will be joined by 120+ more next month. The real security posture question isn't whether to patch—it's whether patches are part of a coherent, layered defense strategy.
Organizations still on Windows 10 in 2026 are typically there for specific business reasons: legacy application compatibility, regulatory lock-in, or resource constraints. Regardless of the reason, this extended support window is not indefinite. Planning the exit from Windows 10 should begin immediately for any organization not yet in active migration. — HackWire Editorial
---
## Related Coverage