This is the living page for the Secure Boot 2023 and ConfigMgr Boot Images series. It holds the boot manager SVN history, every Security Version Number (SVN) that the Windows 11 24H2, 25H2, and 26H2 cumulative updates have shipped since June 2024, in one table. It also keeps the floors that Steps 3 and 4 set and the other values that change every month. Microsoft doesn’t publish the SVN, so I read it from each update’s own files.
Last checked: October 21st, 2026 · Last changed: October 21st, 2026
Current SVN, floors, and versions
| Item | Current |
|---|---|
| Newest boot manager | 10.0.28000.376, SVN 12.0, from the October 2026 update (KB5127648) |
| Floor after Step 3 | SVN 5.0, on a device with an April 2026 or later update (KB5025885) |
| Floor after Step 4 | The SVN of the boot manager installed when Step 4 last ran. Later updates don’t raise it. Re-run Step 4 once boot images, media, and OS images carry the new SVN (lab test) |
| Windows ADK | 10.1.26100.9457 (September 2026). Its WinPE is unpatched, at SVN 2.0 |
| Configuration Manager | 2509 or later for the boot loader checkbox. Newest: 2609, in the early update ring |
| KB5025885 enforcement | Not announced. Last revised September 30th, 2026 |
| Windows Deployment Services | Deprecated from the next Windows Server release. No removal date yet |
Ship the newest SVN in your boot images, media, and the OS images your task sequences apply. It boots every device, because no device’s floor can be higher than the newest boot manager Microsoft has shipped.
Boot manager SVN history
This table lists every 2023-signed boot manager that the Windows 11 24H2, 25H2, and 26H2 cumulative updates have shipped since June 2024, newest first, with the 24H2 release build at the bottom. That is 66 updates and 18 builds. The three versions share the same update each month. 26H2 was released on September 29th, 2026, with September’s boot manager (SVN 11.0).
Each row is the first update with that build, and later updates carry it until the next row. Bold marks the update where the SVN rose. The size is the 2023-signed bootmgfw.efi that the update puts into WinPE, and the 2011-signed copy is the same program with the same SVN.
| Update | Released | Version | SVN | Size (bytes) |
|---|---|---|---|---|
| KB5127648 | October 13th, 2026 | 10.0.28000.376 | 12.0 | 3,086,680 |
| KB5124008 | September 8th, 2026 | 10.0.28000.367 | 11.0 | 3,087,200 |
| KB5120998 (preview) | August 27th, 2026 | 10.0.28000.355 | 9.0 | 3,087,752 |
| KB5101650 | July 14th, 2026 | 10.0.28000.352 | 9.0 | 3,086,728 |
| KB5094126 | June 9th, 2026 | 10.0.28000.342 | 9.0 | 3,055,456 |
| KB5089573 (preview) | May 26th, 2026 | 10.0.28000.327 | 8.0 | 3,023,712 |
| KB5083631 (preview) | April 30th, 2026 | 10.0.28000.326 | 8.0 | 3,010,440 |
| KB5083769 | April 14th, 2026 | 10.0.28000.322 | 8.0 | 3,010,352 |
| KB5077241 (preview) | February 24th, 2026 | 10.0.28000.317 | 7.0 | 3,008,824 |
| KB5064081 (preview) | August 29th, 2025 | 10.0.26100.30227 | 7.0 | 2,855,192 |
| KB5062660 (preview) | July 22nd, 2025 | 10.0.26100.30215 | 7.0 | 2,830,088 |
| KB5062553 | July 8th, 2025 | 10.0.26100.30212 | 7.0 | 2,830,632 |
| KB5058499 (preview) | May 28th, 2025 | 10.0.26100.30191 | 6.0 | 2,779,448 |
| KB5050009 | January 14th, 2025 | 10.0.26100.30169 | 5.0 | 2,774,808 |
| KB5046740 (preview) | November 21st, 2024 | 10.0.26100.1085 | 3.0 | 2,772,760 |
| KB5044384 (preview) | October 24th, 2024 | 10.0.26100.1061 | 3.0 | 2,759,432 |
| KB5041571 | August 13th, 2024 | 10.0.26100.1041 | 3.0 | 2,759,448 |
| KB5040435 | July 9th, 2024 | 10.0.26100.1004 | 3.0 | 2,758,928 |
| The Windows 11 24H2 release build, also in the ADK’s WinPE | 10.0.26089.1001 | 2.0 | 2,756,232 |
No update shipped 4.0 or 10.0. To check media or an image against a device, look up the device’s floor in the SVN column. The boot manager has to come from the bold row with that SVN or a later one. Step 3’s floor of 5.0 is January 2025’s boot manager, which is why the ADK’s unpatched WinPE (SVN 2.0) doesn’t start on a Step 3 device.
Each update’s bootmgr.efi, the file at the root of an ISO, and its 2011-signed boot manager carry the row’s SVN too. There is one exception to “Step 4 writes the row’s SVN”. The 6.0 builds of May and June 2025 shipped with the SVN payload still at 5.0, so a device that ran Step 4 on them has a 5.0 floor.
The 2023-signed PXE loader (wdsmgfw.efi, 1,171,224 bytes) hasn’t changed since August 2025, and September’s out-of-band update (KB5129195) carries the same boot manager as KB5124008. The reference post has the commands and the unpatched ADK files to compare against.
Install and recovery media on a Step 3 device
| Media | Status |
|---|---|
| Windows 11 install ISO | The 26H2 ISO (September 2026) is PCA 2011-signed throughout and doesn’t start |
| HP Sure Recover and Cloud Recovery | PCA 2011-signed. 2023-signed 26H2 images targeted by April 2027, only for models still in production and with a BIOS update. HP does not recommend Step 3 (page of July 10th, 2026, read October 16th, 2026) |
| Dell SupportAssist OS Recovery, USB media, BIOSConnect | Stop booting after Step 3. Updated images not released yet |
| Lenovo | No published position on Step 3 |
| Microsoft Surface | Updated recovery images that require the 2023 certificates, for the models listed |
Changelog
| Date | Change |
|---|---|
| October 21st, 2026 | First version |