Windows 10 KB5078885 ESU update: March 2026 fixes and the Secure Launch shutdown bug
KB5078885 takes Windows 10 to build 19045.7058 and fixes VSM/Secure Launch PCs restarting instead of shutting down. Why .NET and SQL Server need own patches.
Microsoft released KB5078885 for Windows 10 as part of March 2026 Patch Tuesday. It's the monthly Extended Security Update (ESU) for machines still on Windows 10, and it also fixes an annoying bug where PCs with Virtual Secure Mode restarted instead of shutting down. Developers should note one detail that much of the coverage glossed over: the month's two publicly disclosed zero-days were in SQL Server and .NET, not Windows itself, so installing this Windows update alone doesn't close them.
What happened
On 10 March 2026 Microsoft released KB5078885. It takes Windows 10 22H2 to build 19045.7058 and Windows 10 Enterprise LTSC 2021 to build 19044.7058. Microsoft's March Patch Tuesday covered 79 vulnerabilities across its products. Two were listed as zero-days because they were publicly disclosed before a fix existed. Microsoft did not report either as exploited in the wild:
- CVE-2026-21262, a SQL Server elevation of privilege vulnerability.
- CVE-2026-26127, a .NET denial of service vulnerability.
Windows 10 now only gets security and quality fixes. This month's non-security changes include:
- A fix for some PCs with Virtual Secure Mode (including System Guard Secure Launch) that restarted instead of shutting down or hibernating, a problem that started with updates released on or after 13 January 2026.
- A File Explorer fix so custom folder names from
LocalizedResourceNameindesktop.inidisplay again. - Better stability on some GPU configurations, a new trust warning for catalog files in Windows System Image Manager, File History fixes for some Chinese and Private Use Area characters, GB18030-2022A font updates, and new Secure Boot targeting data.
Microsoft listed no known issues with this update when it was released.
Who is affected
- Windows 10 22H2 devices enrolled in ESU and Windows 10 Enterprise LTSC 2021. Other Windows 10 devices stopped receiving security updates in October 2025.
- Security-hardened machines using VSM, Credential Guard or Secure Launch that showed the restart-instead-of-shutdown behaviour.
- Developers and servers running SQL Server or .NET, which need their own updates for CVE-2026-21262 and CVE-2026-26127.
What it means for developers and engineering teams
Patch Tuesday headlines combine every Microsoft product into one count, but your patches arrive through different channels. The Windows cumulative update covers the OS. SQL Server security updates are separate packages for each version. .NET runtime and SDK updates come through Microsoft Update (if enabled), Visual Studio, package managers or your container base images. A Windows 10 build agent that installed KB5078885 can still run an unpatched .NET runtime, and your Docker images definitely do until you rebuild them.
For a .NET denial-of-service bug, the practical risk is in internet-facing services. That means rebuilding and redeploying with the patched runtime, not just updating developer laptops. For the SQL Server privilege escalation, look first at shared database servers where many accounts have low-privilege logins.
The Secure Boot work is also important. Microsoft is replacing the 2011 Secure Boot certificates, which began expiring in June 2026, through a phased rollout that only reaches devices after enough successful update signals. Machines that miss it could eventually fail to receive boot-component and revocation updates.
What to do now
- Confirm the build on ESU and LTSC machines with
winver, or in PowerShell:
A UBR of 7058 or higher means this update (or a later one) is installed.Get-HotFix -Id KB5078885 (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR - Patch .NET separately. Run
dotnet --list-runtimesanddotnet --list-sdks, update to the March 2026 servicing releases, and rebuild container images from patched base images. - Patch SQL Server with the security update for your version and cumulative-update branch.
- Re-test shutdown and hibernate on VSM or Secure Launch devices that showed the restart bug.
- Check Secure Boot certificate status across the fleet, and follow Microsoft's guidance for devices that haven't received the new certificates.
- If a device isn't getting updates, confirm its ESU enrolment. Without ESU, Windows 10 22H2 gets no security fixes.