The December Windows 11 Patch Still Has a Live Certificate Clock

KB5072033 shipped on December 9, 2025 as the Windows 11 25H2 and 24H2 security rollup, at builds 26200.7462 and 26100.7462. It looked like a quiet Patch Tuesday. The lasting work sat in the announcements block: a 2011 Secure Boot certificate swap timed through 2026, and a PowerShell 5.1 warning that stops unattended web requests.

Two of those 2011 certificates have already expired. The one that signs the Windows boot loader still expires on October 19, 2026. Microsoft is still pushing the 2023 replacements in monthly quality updates, including the September 8, 2026 Windows 11 security release.

The December Rollup That Kept Shipping Into 2026

The December 9, 2025 Windows 11 rollup folded in quality fixes from the December 1, 2025 preview (KB5070311) and the month’s security patches. Microsoft skipped the late-December non-security preview because of the Western holidays, and said regular servicing, including those optional previews, would resume in January 2026.

On the same notes, Microsoft began stripping architecture strings from Windows Update titles so Settings shows a date prefix, a KB number, and a build. Catalog and WSUS titles stayed in the older form, such as 2025-10 Security Update (KB5066835) (26200.6899) in the consumer view versus the long x64 catalog line. The December Windows 11 security package also carried an exploited Cloud Files Mini Filter flaw, CVE-2025-62221, rated 7.8, that Microsoft said can give SYSTEM rights.

Quality items in the same payload were smaller and easier to miss. Ask Copilot had failed to bring the Click to Do window to the front. File Explorer could flash white between pages after KB5070311. The AppX Deployment Service (Appxsvc) was switched to Automatic startup on December 15, 2025, after the security package had already gone out, to steady a handful of isolated installs.

WHAT SHIPPED IN KB5072033

• The builds: 26200.7462 on Windows 11 25H2 and 26100.7462 on 24H2.
• The stack: Servicing stack update KB5071142 at 26100.7295, combined with the cumulative package so Windows Update can keep installing later fixes.
• The AI bits: Image Search, Content Extraction, Semantic Analysis, and Settings Model all moved to 1.2511.1224.0.
• The catalog note: Microsoft was still editing the standalone MSU file list on May 26, 2026, which is how long a “December” package can stay in circulation.

Store apps were not in the payload. Microsoft told consumers to update those in the Microsoft Store, and told IT to use Configuration Manager if they manage the Store that way.

Two 2011 Keys Already Missed Their Dates

Secure Boot, added with Windows 8, checks firmware, option ROMs, and the boot loader against certificates stored in UEFI. Microsoft’s original 2011 set has been the common trust root on Windows PCs and on Linux shims that Microsoft also signs. The new security protections for the early boot process now depend on 2023 replacements that Windows Update has been staging onto consumer and unmanaged business PCs.

Microsoft Corporation KEK CA 2011 expired on June 24, 2026. Microsoft UEFI CA 2011 expired on June 27, 2026. PCs that missed the swap still start, and ordinary Windows updates still install. What they lose is the ability to take new Boot Manager protections, Secure Boot database and revocation (DBX) updates, and fixes for fresh boot-level bugs, including some BitLocker hardening.

Devices that haven’t received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install. However, these devices will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot level vulnerabilities.

Microsoft, Windows Secure Boot certificate expiration and CA updates, KB 5062710

That wording is why the June dates did not brick machines, and why IT still has work. Once the old KEK can no longer sign new DBX payloads, a PC stuck on 2011 trust cannot take Microsoft’s next boot-level revocation. Fedora maintainers made the same point for Linux shims: existing signed binaries keep booting, but new shims after the 2011 key dies are signed only with the 2023 key.

THE CLOCKS KB5072033 PUT ON THE CALENDAR

1. December 9, 2025: Ships KB5072033 for Windows 11 25H2 and 24H2 and puts the Secure Boot expiry notice in the announcements block.
2. January 13, 2026: Ships KB5074109, which Microsoft later cites as the fix for the WSL VPN break and AVD RemoteApp failures that the December notes still listed as open.
3. January 29, 2026: Ships optional KB5074105, which restores the missing lock-screen password icon.
4. June 24, 2026: Microsoft Corporation KEK CA 2011 expires, ending new signatures with that key.
5. June 27, 2026: Microsoft UEFI CA 2011 expires; Microsoft splits its job across two 2023 certificates.
6. September 8, 2026: Windows Update says the September 2026 security update (KB5124008 on 24H2 and 25H2) expands high-confidence targeting so more PCs can get the 2023 certificates automatically.
7. October 19, 2026: Microsoft Windows Production PCA 2011, the cert that signs the Windows boot loader, is due to expire.

Some gaming PCs with kernel-level anti-cheat also lose launch trust when firmware still holds only the 2011 chain, a side effect the consumer notes never name. That is a firmware and certificate problem, not a game-store problem, and it shows up on machines that skipped OEM BIOS updates or never received the Windows Update staging task.

What Expires on October 19

Microsoft Windows Production PCA 2011, stored in the UEFI signature database (DB), is the remaining 2011 Microsoft cert. It is replaced by Windows UEFI CA 2023. The June 27 expiry of Microsoft UEFI CA 2011 was split on purpose: Microsoft UEFI CA 2023 signs third-party boot loaders and EFI apps, and Microsoft Option ROM UEFI CA 2023 signs option ROMs, so a vendor can trust one class without the other.

THE 2011 CERTIFICATES AND THEIR 2023 REPLACEMENTS

Microsoft’s own rule is that devices receive the new certificates only after they show enough successful update signals. That phased targeting is why a PC can sit on a yellow Secure Boot status for months after the June dates, and why the September 2026 notes still talk about widening coverage rather than declaring the job done. IT administrators are pointed at the Secure Boot playbook for Windows clients and a separate Server playbook, not at a one-click consumer toggle.

PowerShell 5.1 Asks Before It Parses the Web

The other December 9 change that still bites shops is in Windows PowerShell 5.1, the copy that ships in the box. CVE-2025-54100 is a PowerShell remote code execution vulnerability Microsoft rated Important at CVSS 7.8. It was publicly disclosed and, at release, not listed as exploited. The attack is local with user interaction: Invoke-WebRequest (the curl alias in 5.1) used Internet Explorer’s mshtml engine to parse HTML, which could run script from the page in the caller’s context.

Microsoft did not rip that parser out of 5.1. After updates dated December 9, 2025 or later, a prompt appears when the cmdlet is called without a safer switch. Pressing Enter, or choosing No, cancels the request. Choosing Yes restores the old full parse, scripts included.

Security Warning: Script Execution Risk Invoke-WebRequest parses the content of the web page. Script code in the web page might be run when the page is parsed. RECOMMENDED ACTION: Use the -UseBasicParsing switch to avoid script code execution. Do you want to continue?

Microsoft, KB5074596, PowerShell 5.1 guidance, December 9, 2025

HOW MICROSOFT SAYS TO KEEP SCRIPTS MOVING

• Safe fetch: Add -UseBasicParsing on Invoke-WebRequest so scheduled tasks and CI jobs never wait on a human.
• Many calls: Set $PSDefaultParameterValues[‘Invoke-WebRequest:UseBasicParsing’] = $true at the top of a -NoProfile script.
• Longer path: Move the work to PowerShell 7, which already fetches without the Internet Explorer DOM and will not run page script as 5.1 did.

Scripts that only download a file or read a body as text keep working. Scripts that scrape forms or walk a live HTML DOM hang until someone answers the prompt, or they return raw text instead of objects. Microsoft said there is no supported way for a non-interactive job to click Yes. ServiceNow later told customers that its own out-of-box jobs were fine as of January 2026, and that custom and third-party scripts were the ones to audit. The same Patch Tuesday also disclosed CVE-2025-64671 in GitHub Copilot for JetBrains, a separate public RCE that is not part of the Windows 11 cumulative itself.

Lost NIC Bindings on Hyper-V Hosts

One December fix was aimed at people who never see a lock screen. After a host restart, external Hyper-V virtual switches could drop their physical NIC bindings and fall back to internal mode. Virtual machines then lost network access, and the host could not run as a normal server until an admin rebuilt the switch.

KB5072033 is the security package that Microsoft lists as fixing that bind. It is the kind of regression that never shows up on a home laptop and wrecks a cluster that reboots on Patch Tuesday. Combined with the PowerShell prompt, it is why this rollup still reads as an operations patch more than a consumer one, even though it installed automatically from Windows Update.

Microsoft also reminded admins that the combined servicing stack plus cumulative package cannot be removed with wusa.exe /uninstall. Taking the LCU off later means DISM /Remove-Package with the LCU name from DISM /online /get-packages. The SSU stays.

Microsoft Closed the Lock-Screen Bug in January

The December notes still listed three known issues, all tagged as rare on Windows Home and Pro personal PCs and common in managed estates. None of them originated in KB5072033 itself. Each had been dragged forward from an earlier preview, and each needed a later package.

THE THREE BUGS THE DECEMBER NOTES LEFT OPEN

The password control was still there if you hovered the empty slot and clicked the placeholder. Microsoft said it mainly hit machines with more than one sign-in method. That bug sat in the wild for five months, from the August 29, 2025 preview through optional KB5074105 on January 29, 2026.

The WSL break hit mirrored-mode networking when a VPN virtual interface ignored ARP. Microsoft named Cisco Secure Client (formerly Cisco AnyConnect) and OpenVPN. Home users on Home or Pro were unlikely to see it. RemoteApp on Azure Virtual Desktop failed after the November preview landed in the December security package; full desktop sessions were not affected. KB5074109, the January 13, 2026 security update at builds 26200.7623 and 26100.7623, is the package Microsoft now points to for both the VPN and RemoteApp items, though that January rollup later needed its own out-of-band follow-ups for other AVD sign-in failures.

How to Check Secure Boot Status on Windows 11

Microsoft put a status readout in Windows Security. Open Windows Security, choose Device Security, and read the Secure Boot line. A green check means the 2023 certificates are in place. Yellow usually means Windows is waiting on firmware or has not finished applying the certs. Red points at a firmware problem the OEM has to fix first.

On September 8, 2026, the Windows Update account was still repeating the June expiry warning as a standing item in the monthly security-update thread, and it still sent admins to the playbook rather than calling the rollout finished.

IMPORTANT: Secure Boot certificates used by most Windows devices started to expire on June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time. To avoid disruption, we recommend reviewing the guidance and taking…

— Windows Update (@WindowsUpdate) September 8, 2026

A PowerShell check on an admin prompt is the other test Microsoft has published: ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’). True means the 2023 Windows boot-loader cert is in the DB. False means the PC is still on the 2011 production cert that expires October 19, 2026. OEM BIOS or UEFI updates still come first on a lot of commercial hardware; Windows Update will not write a 2023 KEK into firmware that the vendor has not opened for it.

KB5072033 is no longer the current cumulative, and it never was a one-and-done Secure Boot installer. It is the December 9, 2025 package that put the certificate warning on the same page as a 7.8 exploited driver bug and a PowerShell prompt that still stops a script that calls the web the old way. The last 2011 Microsoft boot-loader certificate expires October 19, 2026, and Microsoft is still widening the set of PCs it trusts to receive the replacement.