KB5068781 is the first cumulative security update delivered under Windows 10’s Extended Security Updates (ESU) program after the end of support. It installs on eligible devices via Windows Update and moves Windows 10 version 22H2 to build 19045.6575 (Windows 10 Enterprise LTSC 2021 moves to 19044.6575). Microsoft lists the build details and contents on its support page for the release.
Read the official KB5068781 documentation
KB5068781: what’s in the update
- Security fixes: 63 vulnerabilities addressed this month, including one actively exploited elevation‑of‑privilege vulnerability tracked as CVE‑2025‑62215.
- Quality fix: resolves a regression that could incorrectly show “Your version of Windows has reached the end of support” in Windows Update settings after the October 14, 2025, update (KB5066791).
- No new features: ESU updates are security and servicing only. Microsoft reports no known issues with this release.
Who can install KB5068781 (ESU eligibility)
This update is available only to devices enrolled in Windows 10 ESU. Consumer ESU supports Windows 10 version 22H2 Home, Pro, Pro Education, and Pro for Workstations. Enrollment ties to your Microsoft account with three options: no‑cost enrollment by syncing PC settings, redeeming 1,000 Microsoft Rewards points, or a one‑time $30 purchase. A single ESU entitlement can cover up to 10 devices tied to the same account. Devices must be administrator‑owned and not joined to Active Directory or MDM for consumer ESU.
Enroll from Settings > Update & Security > Windows Update > Enroll now, or review requirements on Microsoft’s ESU page.
Check ESU eligibility and enrollment options
Get the KB5068781 offline installer (.msu)
Administrators can download the standalone .msu for offline or managed deployments from the Microsoft Update Catalog. Choose the package that matches your edition and architecture (x64, x86, ARM64). Expect the catalog package to be significantly larger than the express payload delivered by Windows Update.
Download KB5068781 from Microsoft Update Catalog
How to install the .msu offline (WUSA or DISM)
Before you start:
- Confirm Windows 10 version 22H2 (winver) and architecture (Settings > System > About).
- Ensure the device is entitled to ESU or is Windows 10 Enterprise LTSC, where applicable.
- Keep a recent backup and have BitLocker recovery keys handy if used.
Interactive install with Windows Update Standalone Installer:
Right‑click the downloaded KB5068781 .msu > Run as administrator
Follow prompts and restart when requested
Silent install with WUSA:
wusa.exe "C:\Path\to\windows10.0-kb5068781-<arch>.msu" /quiet /norestart
Online servicing with DISM:
DISM /Online /Add-Package /PackagePath:"C:\Path\to\windows10.0-kb5068781-<arch>.msu"
After installation, verify the build:
winver
Note: KB5068781 is distributed as a combined Servicing Stack Update (SSU) + Latest Cumulative Update (LCU). The SSU portion cannot be removed once installed. Use DISM to remove only the LCU if rollback is necessary.
Download size and servicing notes
- Windows Update payload: typically around a few hundred megabytes, depending on device state; many systems see ~200 MB.
- Catalog .msu payload: substantially larger due to full content and combined SSU+LCU, commonly around 720–780 MB depending on SKU and architecture.
- Prerequisites: offline images missing older LCUs may require specific standalone SSUs before applying the combined package. For managed environments (WSUS/ConfigMgr/Intune), stage prerequisites as documented in Microsoft’s KB guidance.
If KB5068781 doesn’t appear or won’t install
- Confirm ESU license status: in an elevated Command Prompt,
slmgr /dlvshould show the ESU add‑on as Licensed; if not, activate withslmgr /ato. - Check policy controls: devices “managed by your organization” may have update deferrals or blocks via Group Policy/MDM; adjust as needed.
- Install any required SSU prerequisites for your deployment scenario (especially for offline images).
- Enrollment issues: Microsoft issued an out‑of‑band fix for an ESU enrollment bug that blocked some devices. Apply the OOB update if the enrollment wizard doesn’t appear or fails, then retry enrollment.
Get the out‑of‑band ESU enrollment fix (KB5071959)
KB5068781 quick reference
| Item | Details |
|---|---|
| Applies to | Windows 10 version 22H2 (ESU); Windows 10 Enterprise LTSC 2021 |
| Post‑install build | 19045.6575 (22H2), 19044.6575 (LTSC 2021) |
| Delivery | Windows Update (ESU‑enrolled devices), Microsoft Update Catalog (.msu) |
| Notable fixes | CVE‑2025‑62215 (actively exploited EoP); end‑of‑support banner regression |
| Known issues | None reported by Microsoft for this release |
| Package makeup | Combined SSU + LCU; SSU portion is not removable |
| Size (typical) | ~200 MB via Windows Update; ~720–780 MB via Update Catalog |
| ESU consumer enrollment | PC settings sync (no cost), 1,000 Rewards points, or $30 one‑time purchase (up to 10 devices per account) |
For devices that must stay on Windows 10, KB5068781 restores a predictable monthly patch cadence under ESU and closes an actively exploited elevation path. Treat this update as a priority for any ESU‑enrolled PC, then keep deployments on a pilot‑first cadence and plan the broader move to a supported Windows release before ESU ends on October 13, 2026.
