Windows 11 24H2 August 2025 KB5063878: SSU+LCU, AI updates, and Secure Boot expiry

Microsoft has released the August 12, 2025 cumulative update for Windows 11, version 24H2 — KB5063878 (OS Build 26100.4946) — delivered as a combined Servicing Stack Update (SSU) plus Latest Cumulative Update (LCU). The package bundles security and quality fixes, small AI component updates targeted to Copilot+ hardware, and an SSU refresh intended to improve update reliability, while renewing Microsoft’s public warning about an imminent Secure Boot certificate lifecycle change that begins in June 2026.

---

Background / Overview​

Windows cumulative updates continue to follow Microsoft’s combined SSU+LCU model, where the servicing stack (the component that installs updates) is included with the monthly cumulative package to reduce failed installations and make rollouts simpler for administrators. The August 12 package identifies as KB5063878 and advances Windows 11, version 24H2 devices to OS Build 26100.4946; it also packages a servicing stack refresh identified as KB5065381 (OS Build 26100.4933).
Microsoft’s public KB entry and associated guidance position this release as a routine monthly security and quality rollup, but one with operationally consequential reminders — most notably the Secure Boot certificate replacement timeline that organizations must treat as a multi‑quarter program of work. The Secure Boot advisory is not new: Microsoft published its lifecycle guidance and technical rollout plan earlier in 2025 and has reiterated the June/October 2026 certificate expiration windows that will affect devices that do not acquire the replacement 2023 CA chain. (techcommunity.microsoft.com, support.microsoft.com)
Why this matters now: the update itself does not change the certificate rollout schedule, but the August KB repeats Microsoft’s readiness guidance and reinforces the need for firmware coordination and testing before the first expiration deadline. For most consumer PCs that receive updates directly from Microsoft and OEMs, the process will be largely automatic; for managed or air‑gapped fleets, the work is explicitly operational and requires inventory, OEM coordination, and sometimes manual firmware or variable updates.

---

What’s in KB5063878 (OS Build 26100.4946)​

High-level summary​

• Target: Windows 11, version 24H2 (all editions).
• Release date: August 12, 2025.
• Combined package: LCU + SSU (includes KB5065381).
• Build after install: 26100.4946.

Microsoft’s public notes emphasize three categories of changes in the combined package: security fixes, quality/reliability improvements rolled forward from prior previews, and AI component updates that are selectively applied to Copilot+ hardware. The KB provides a concise list rather than a CVE-by-CVE enumeration — administrators needing CVE detail should consult the Security Update Guide and map CVEs to their environment.

Security and quality fixes​

The release contains the usual set of monthly security mitigations for Windows internals and platform components. In addition to generalized vulnerability mitigation, Microsoft specifically calls out functional reliability fixes — for example, a sign‑in delay experienced on newly provisioned devices caused by certain preinstalled packages. The KB notes that devices which already installed recent July preview fixes will only download the delta presented in this cumulative package.

AI component updates (Copilot+ devices only)​

KB5063878 packages updated AI component binaries (listed in the release) to version 1.2507.793.0 for multiple subsystems such as:

• Image Search
• Content Extraction
• Semantic Analysis
• Settings Model

Microsoft explicitly states these binaries are distributed in the cumulative package but only install on Windows Copilot+ PCs — hardware that meets specific NPU and OEM enablement criteria. Standard Windows 11 clients and Windows Server SKUs will not receive these AI component payloads. This selective delivery minimizes risk to non‑NPU endpoints while allowing feature progress on qualified hardware.

Servicing Stack Update (SSU)​

Bundled SSU: KB5065381 (OS Build 26100.4933). SSUs are critical to the update pipeline — they address the component responsible for applying updates and reduce a class of installation failures. When SSUs are bundled with an LCU, Microsoft handles ordering during install, but administrators should remember that SSUs are effectively non‑removable once applied and that rollback options for combined packages are limited.

Known issues and troubleshooting​

At publication Microsoft stated it was “not currently aware of any issues” with KB5063878. That initial status is encouraging but not dispositive; the Windows update ecosystem often surfaces edge cases after broad rollouts, particularly on heterogeneous fleets with older firmware or niche drivers. Administrators should still stage testing and pilot rings before mass deployment.

---

How to get and install KB5063878​

Microsoft documents multiple installation vectors; choose the path appropriate to your environment:

• Windows Update / Windows Update for Business — automatic distribution.
• Microsoft Update Catalog — download MSU files for offline or manual installs.
• WSUS/SCCM — ensure Products = "Windows 11" and Classification = "Security Updates" to synchronise the update.
• DISM / Add‑WindowsPackage or Add‑Package for offline images.

Representative on‑device commands (elevated prompt) referenced in the KB:

• Using DISM (online):
  DISM /Online /Add-Package /PackagePath:C:\packages\Windows11.0-KB5063878-x64.msu
• Using PowerShell:
  Add-WindowsPackage -Online -PackagePath "C:\packages\Windows11.0-KB5063878-x64.msu"

For image servicing and offline media, use DISM /Image:mountdir /Add-Package and ensure Dynamic Update packages align with the same month as the KB. Test Dynamic Update and up-to-date WinRE images when updating provisioning media.
Deployment note: if you manually remove only the LCU after installing a combined SSU+LCU package, the SSU remains applied; removing the LCU in that situation may require DISM operations and image rework rather than a simple wusa.exe uninstall. Plan rollback and recovery steps accordingly.

---

Deep dive: Secure Boot certificate rollover — the operational imperative​

The most consequential non‑bug item associated with this release is Microsoft’s repeated reminder about Secure Boot certificate expirations. Several Microsoft certificates that underpin UEFI Secure Boot — originally issued in 2011 — will begin expiring in June 2026, with additional expirations in October 2026. Without replacement certificates installed in the device KEK/DB, affected Windows devices could lose the ability to receive security fixes for pre‑boot components and could, in certain cases, fail to trust legitimately signed boot components. (support.microsoft.com, techcommunity.microsoft.com)
Why this is not a pure software update problem

• Secure Boot trust anchors live partly in firmware (UEFI variables) and partly in OS‑managed update flows. The rollout therefore depends on both Microsoft and OEM firmware support.
• Some existing firmware implementations contain subtle bugs that can prevent DB/KEK updates from applying safely; Microsoft is coordinating phased rollouts and will suspend updates on devices with known firmware issues to avoid bricking scenarios.

Key dates and certificates (high level)

• Microsoft Corporation KEK CA 2011 — expiration: June 2026 — replacement: Microsoft Corporation KEK CA 2023.
• Microsoft UEFI CA 2011 / Option ROM CA 2011 — June 2026 — replacements: Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023.
• Microsoft Windows Production PCA 2011 — October 2026 — replacement: Windows UEFI CA 2023.

Microsoft’s recommendation: let Microsoft manage Secure Boot updates where possible (Windows Update) and coordinate OEM firmware updates to ensure devices can accept the new certificates. For enterprise environments that do not allow Microsoft-managed flows, administrators must implement a manual update process and agree on telemetry and policy tradeoffs. The company also published an opt‑in registry workflow for managed environments to permit Microsoft to coordinate certificate rollout when diagnostic data is available. Registry opt‑in (as documented by Microsoft)

• Registry path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
• Key name: MicrosoftUpdateManagedOptIn
• Type: DWORD
• DWORD value: 0x5944 (opt in to Windows Secure Boot updates managed by Microsoft)

Setting this value signals that the device will allow Microsoft to manage Secure Boot updates as part of monitoring and staged rollout behavior; for organizations that cannot enable the required diagnostic data, Microsoft offers alternate manual guidance and a readiness survey. Cross‑platform and Linux implications
Third‑party OSes and Linux distributions that rely on Microsoft-signed components (shim) may face compatibility problems if firmware lacks the updated CA entries. Coverage from multiple outlets has already warned that Linux users and dual‑boot systems may need manual workarounds if OEM firmware updates are not available for their hardware. That reality increases the operational burden for mixed‑OS shops and for enthusiasts using older equipment. (techradar.com, tomshardware.com)

---

Deployment guidance — practical checklist​

Whether you manage a single laptop or tens of thousands of endpoints, approach this month’s release—and the certificate program—methodically.
Immediate (first 72 hours)

• Apply KB5063878 to a small representative test ring (one to several devices covering major OEMs, chipsets, and peripheral drivers). Validate boot, sign‑in, and critical LOB applications.
• Confirm SSU presence (KB5065381) in test images and understand roll‑forward behavior; document rollback constraints.
• For WSUS/SCCM-managed environments, ensure products/classifications are set to sync Windows 11 security updates.

Short‑term (next 30–90 days)

• Conduct a firmware inventory: catalog BIOS/UEFI versions and check OEM sites for firmware that supports DB/KEK updates. Prioritise devices that are business critical.
• Engage OEMs for a firmware roadmap; where updates are unavailable, document compensating controls or replacement plans.
• For dual‑boot and Linux hosts, validate shims and bootloaders on representative hardware to avoid unbootable configurations after the certificate rollout.

Longer term (by Q2 2026)

• Ensure remaining devices either have the updated certificates or are scheduled for replacement/retirement. Maintain an exception register for devices that cannot be updated and plan compensating controls (network isolation, restricted physical access).

Testing and observability

• Monitor Windows Health Dashboard and Microsoft’s Secure Boot certificate rollout landing pages for updates and OEM compatibility signals.
• Use telemetry and pilot feedback to verify that devices receive both the OS patch and the DB/KEK updates, and track any rejections or firmware rejections for remediation.

---

Risk analysis — strengths, gaps, and real‑world hazards​

Strengths

• The combined SSU+LCU model reduces a common class of update installation failures and simplifies operational sequencing for administrators. KB5063878 follows that model.
• Microsoft’s public timeline for Secure Boot certificates gives organizations lead time to plan and execute firmware coordination, which is preferable to a last‑minute scramble.

Gaps and hazards

• OEM firmware readiness remains the single largest unknown. Even with clear Microsoft guidance, devices that lack firmware updates or that have buggy implementations may be unable to accept new DB/KEK entries. Those devices will require special remediation or replacement.
• For mixed‑OS/dual‑boot environments, the replacement CA chain could disrupt Linux shim trust and cause boot failures unless the firmware is updated or alternative trust arrangements are implemented. Tech press has already flagged this as a real risk for Linux users. (techradar.com, tomshardware.com)
• Telemetry and privacy tradeoffs: allowing Microsoft to manage Secure Boot updates in production requires enabling certain diagnostic data. Organizations must weigh privacy regulations and internal policy against the operational advantage of Microsoft-managed rollout.

Unknowns and unverifiable claims

• Any claim about per‑device OEM readiness or whether a given firmware image will accept DB/KEK updates cannot be universally verified through a KB — it must be validated per device model and firmware revision with OEM-provided guidance. Treat such vendor‑specific assertions as environment‑specific and verify locally.

---

Recommendations — concise, actionable steps​

For enterprise IT teams

• Inventory Secure Boot‑enabled devices and categorize by OEM/BIOS version. Prioritize business‑critical systems for firmware testing.
• Pilot KB5063878 plus the firmware update process on a cross‑section of devices. Validate the update path for both OS install and the DB/KEK change.
• Coordinate a firmware release calendar with major OEM vendors and set expectations for devices that will need replacement.

For small businesses and home users

• Keep automatic updates enabled and apply OEM firmware updates when offered. Microsoft plans to manage the update for most consumer devices, but older or rare devices may require manual firmware intervention. Back up important data before major updates.

For Linux and dual‑boot users

• Monitor distribution guidance and OEM firmware announcements. Test boot media and, if necessary, prepare fallback plans (manual shim updates, creation of signed shims, or controlled disabling of Secure Boot where acceptable and safe). Recognize that some fixes may be technical and not accessible to casual users. (techradar.com, tomshardware.com)

---

Final assessment​

KB5063878 is a routine‑appearing August cumulative update in form — it bundles security patches, quality fixes, and targeted AI component updates into a combined SSU+LCU package that should install cleanly for most devices. What elevates its operational priority is the continued emphasis on the Secure Boot certificate lifecycle: the June and October 2026 expirations create an ecosystem problem that stretches beyond operating system updates into firmware, OEM support channels, and mixed‑OS considerations. Microsoft’s documentation and the staged rollout approach reduce the risk, but they do not eliminate the dependency on OEM firmware readiness or on organizational change management.
Practical truth: for the majority of consumers who allow automatic updates, the August package will arrive and install with minimal action required. For IT administrators, the real work for 2025–2026 is not a single patch — it’s inventorying firmware, coordinating with OEMs, testing in representative rings, and applying disciplined rollout procedures so that certificate updates do not cascade into a fleet‑wide availability incident. Start that program now; the deadlines are fixed, and the remediation work is operationally nontrivial.

---

KB5063878 is available now through Windows Update, Windows Update for Business, WSUS, and the Microsoft Update Catalog; administrators should stage the update in test rings this week and fold Secure Boot readiness checks into their Q4 patch cycles.

---

Source: Microsoft Support August 12, 2025—KB5063878 (OS Build 26100.4946) - Microsoft Support