Microsoft issues emergency Windows updates: what to know and how to patch (March 2026)

Microsoft ships emergency Windows updates: what changed, who’s affected, and how to patch

Microsoft has pushed a string of out‑of‑band (OOB) “emergency” Windows updates in March 2026 to fix sign‑in errors, Bluetooth device visibility problems, and a security risk in the RRAS management tool. The most recent, released on March 21, 2026, is KB5085516 for Windows 11 25H2 and 24H2, which resolves a Microsoft account sign‑in failure that produced a “no internet” error despite an active connection. It’s available via Windows Update and the Microsoft Update Catalog. Business logins using Microsoft Entra ID were not affected. (learn.microsoft.com )

The latest critical fix: March 21 OOB for Microsoft account sign‑ins

• What happened: After installing March’s security update (released March 10), some users couldn’t sign in to Microsoft‑account‑backed apps and services (for example, Teams Free and OneDrive), receiving an erroneous connectivity error. (learn.microsoft.com )
• The fix: Microsoft issued KB5085516 on March 21 as a cumulative OOB update for Windows 11 25H2/24H2. Devices with “Get the latest updates as soon as they’re available” enabled will receive it automatically; others can install it from Settings > Windows Update or from the Update Catalog. (support.microsoft.com )

Earlier March hotpatch OOBs: RRAS security and Bluetooth visibility

Microsoft also delivered two hotpatch OOB updates earlier in the month for Enterprise devices enrolled in hotpatching (no reboot required):

• March 13: KB5084597 mitigates a security issue in the Windows Routing and Remote Access Service (RRAS) management tool that could allow code execution when connecting to a malicious server. CVEs referenced include CVE‑2026‑25172, CVE‑2026‑25173, and CVE‑2026‑26111. This build installed automatically on hotpatch‑enabled Windows 11 25H2/24H2 Enterprise devices. (learn.microsoft.com )
• March 16: KB5084897 fixes a bug that hid connected Bluetooth devices from Settings and Quick Settings and could block adding new devices. Like the RRAS fix, it targeted hotpatch‑enabled Enterprise clients and applied without a restart. (learn.microsoft.com )

Server administrators: March 2 OOB for Windows Hello for Business certificate renewal

On March 2, Microsoft published KB5082314 for Windows Server 2022 to address certificate renewal problems for Windows Hello for Business in certain ADFS‑based deployments. This OOB was catalog‑only and cumulative over February’s security update. (support.microsoft.com )

January’s emergency Windows fixes set the tone for 2026

In January, Microsoft issued multiple OOB updates (January 17 and January 24) after the monthly security release triggered two widespread problems: failed authentication prompts in remote connection apps (affecting Windows 365/Azure Virtual Desktop and the Windows App) and Windows 11 23H2 devices with Secure Launch enabled rebooting instead of shutting down or hibernating. Microsoft shipped catalog‑only OOB cumulative updates per version and also provided enterprise KIR (Known Issue Rollback) Group Policies for environments unable to patch immediately. (bleepingcomputer.com )

Why this matters: March Patch Tuesday raised urgency

March’s regular Patch Tuesday already demanded swift action: Microsoft fixed more than 80 vulnerabilities across Windows, Office, SQL Server, Azure and other components, with several zero‑days noted by security vendors and media. The subsequent stream of OOB releases underscores how quickly Microsoft is iterating to stabilize affected scenarios. (pcworld.com )

Who’s affected

• Home users on Windows 11 25H2/24H2 experiencing Microsoft account sign‑in failures after installing the March 10 update should install KB5085516 immediately. Entra ID (work/school) sign‑ins were not impacted. (support.microsoft.com )
• Enterprise environments using hotpatch on eligible Windows 11 Enterprise devices received the March 13 and March 16 OOB updates automatically without reboot. Standard (non‑hotpatch) devices are not offered these hotpatch OOBs. (support.microsoft.com )
• Windows Server 2022 admins running ADFS for Windows Hello for Business scenarios should apply the March 2 OOB if they encounter certificate renewal issues. (support.microsoft.com )

How to get the emergency updates

• KB5085516 (Windows 11 25H2/24H2)

  • Settings > Windows Update > Check for updates > Download & install, or download from the Microsoft Update Catalog. Applies to devices that already installed the March 10 cumulative update (KB5079473). (support.microsoft.com )

• KB5084597 and KB5084897 (hotpatch OOBs for Enterprise)

  • Delivered automatically to hotpatch‑enabled 25H2/24H2 Enterprise devices via Windows Update; no restart required. Standard‑update devices do not receive these. (support.microsoft.com )

• KB5082314 (Windows Server 2022)

  • Download from the Microsoft Update Catalog; it’s not offered via standard Windows Update channels. (support.microsoft.com )

• January 2026 OOBs (multiple KBs by version)

  • Catalog‑only at release; organizations could alternatively deploy Microsoft’s KIR Group Policies as a temporary mitigation for remote sign‑in failures. (bleepingcomputer.com )

What IT should do now

• Prioritize the March 21 client OOB (KB5085516) for any help desk tickets tied to Microsoft account sign‑ins in Teams Free, OneDrive, or other consumer experiences on corporate‑managed endpoints. Expedite via Microsoft Intune or Windows Autopatch where appropriate. (support.microsoft.com )
• Confirm whether any Windows 11 Enterprise devices are enrolled in hotpatch. If so, validate that the March 13 (RRAS) and March 16 (Bluetooth visibility) OOBs have been applied automatically and that no reboots were required. (support.microsoft.com )
• For Windows Server 2022 ADFS environments using Windows Hello for Business, review certificate renewal status and apply KB5082314 if you see renewal failures. (support.microsoft.com )
• Document exceptions: If a device cannot be updated immediately, record the business justification and apply interim mitigations (for example, KIR GPOs used in January’s remote sign‑in issue) until patching is completed. (bleepingcomputer.com )

Quick reference: recent Windows emergency updates (2026)

• March 21: KB5085516 (Windows 11 25H2/24H2) — fixes Microsoft account sign‑in failures; offered via Windows Update and Catalog. (support.microsoft.com )
• March 16: KB5084897 (Windows 11 25H2/24H2 Enterprise, hotpatch) — resolves missing Bluetooth device listings in Settings/Quick Settings; no restart. (support.microsoft.com )
• March 13: KB5084597 (Windows 11 25H2/24H2 Enterprise, hotpatch) — mitigates RRAS management tool security risk; no restart. (support.microsoft.com )
• March 2: KB5082314 (Windows Server 2022) — fixes Windows Hello for Business certificate renewal in certain ADFS deployments; catalog‑only. (support.microsoft.com )
• January 17/24: Multiple OOB CUs per version (Windows 11/10/Server) — address Remote Desktop sign‑in failures to Cloud PCs and Secure Launch shutdown/hibernation restarts on 23H2; KIR GPOs available. (bleepingcomputer.com )

The big picture

Microsoft’s cadence this month illustrates the expanding role of out‑of‑band and hotpatch updates: shipping narrowly scoped fixes quickly, minimizing downtime (especially with hotpatch), and closing regressions that surface after broad Patch Tuesday deployments. With more than 80 vulnerabilities already handled in March’s main release and several zero‑days in the mix, organizations should keep their telemetry and update pipelines tuned for both scheduled and emergency drops. (pcworld.com )

How to tell if you’re protected

• Windows 11 25H2/24H2: After installing KB5085516, your OS build should advance to 26200.8039 (25H2) or 26100.8039 (24H2). (support.microsoft.com )
• Windows 11 Enterprise (hotpatch): Devices receiving the March hotpatch OOBs should report builds 26200.7982/26100.7982 (RRAS) and 26200.7984/26100.7984 (Bluetooth) with no reboot history associated with those installations. (support.microsoft.com )
• Windows Server 2022: For ADFS/Windows Hello for Business deployments, confirm KB5082314 is installed if you previously saw renewal errors. (support.microsoft.com )

Bottom line

If users are reporting Microsoft account sign‑in failures this week, prioritize the March 21 emergency update (KB5085516). Enterprises on hotpatch should also verify the March 13 and March 16 OOBs are in place. Server admins facing Windows Hello for Business certificate renewal issues on Windows Server 2022 should apply the March 2 OOB. Staying current with these emergency fixes will close the most disruptive and risky gaps introduced or revealed this cycle. (support.microsoft.com )