Microsoft released KB5079473 on March 10, 2026 — the March Patch Tuesday cumulative security update for Windows 11 versions 25H2 and 24H2. It moves systems to OS builds 26200.8037 and 26100.8037.
This is one of the more feature-rich monthly updates Windows 11 has received outside of major version releases. Nine new features rolled out alongside the security content — including Emoji 16.0 support, native Sysmon integration, a network speed test accessible directly from the taskbar, camera pan and tilt control, and WebP wallpaper support. The security component fixed between 58 and 80 vulnerabilities including active zero-days.
Here is every feature, every fix, every known issue, and how to install it.
What Is KB5079473?
KB5079473 is the March 2026 mandatory cumulative security update for Windows 11 versions 25H2 and 24H2, released on Patch Tuesday, March 10, 2026. It is titled “2026-03 Security Update (KB5079473) (26200.8037)” in Windows Update and installs automatically unless updates are paused.
This update includes improvements to File Explorer search reliability, handling of COM object allowlisting policies in WDAC, and increased coverage of devices eligible to automatically receive new Secure Boot certificates. The KB5079473 security update applies to OS Builds 26200.8037 and 26100.8037 and contains fixes and quality improvements from KB5077181 released February 10, 2026.
Windows 11 KB5079473 is now rolling out as part of Microsoft’s March 2026 Patch Tuesday, and it has up to nine new features, including Emoji 16, Internet Speed Test, Extract all options in Explorer, and more.
An important note on feature rollout: New features in Windows 11 March 2026 Update are rolling out gradually, and they won’t show up right away after the installation. Security fixes apply immediately. Features roll out over days to weeks depending on your device’s targeting data.
Security — How Many Vulnerabilities Does KB5079473 Fix?
The update KB5079473 provides security fixes for 58 to 79 different security vulnerabilities which include active Zero Day vulnerabilities.
The zero-days are the priority items. Zero-day vulnerabilities are ones that were already being exploited in active attacks or publicly disclosed before Microsoft’s patch was ready. On any unpatched Windows 11 system, those attacks remain viable until KB5079473 is installed.
Two specific vulnerabilities worth flagging:
CVE-2026-0847 — Windows Kernel Elevation of Privilege
A high-severity vulnerability in the Windows Kernel that could allow an attacker with limited user privileges to execute code with elevated system permissions. Elevation of privilege vulnerabilities are particularly dangerous because they allow attackers who already have limited access to a system to escalate to full administrative control.
CVE-2026-0851 — Windows Graphics Component
A vulnerability in the Windows Graphics Component affecting how Windows processes certain graphics operations.
The full CVE list for the March 2026 Patch Tuesday covers the remaining 56 to 77 vulnerabilities across various Windows components. Microsoft publishes the complete list on the Security Response Center.
Every New Feature in KB5079473
Emoji 16.0 Support
The system now supports the latest emoji library for modern communication standards.
KB5079473 adds full Unicode 16.0 emoji support to Windows 11. Emoji 16.0 is the latest Unicode standard release, adding new characters including a face with bags under eyes, a harp, a shovel, a leafless tree, and additional people emoji variations. The new emoji are available across the emoji panel (Win + .), messaging apps, and any input field that supports emoji.
For most users this is a cosmetic improvement, but it ensures Windows 11’s emoji set stays in sync with the latest characters appearing in messages from iPhone and Android users.
Built-In Sysmon — Native Security Monitoring
This is the most technically significant new addition for security administrators and IT professionals.
Until now, Sysmon was only available through Microsoft’s Sysinternals suite, which meant administrators had to manually download and configure it. With the March 2026 update, Windows now includes Sysmon as an optional built-in feature. However, the feature is disabled by default and must be manually enabled before it can be used.
Sysmon — System Monitor — is a Windows system service that logs detailed system activity to the Windows Event Log. It records process creation, network connections, file creation timestamps, registry modifications, and other system events that are critical for security incident detection and forensic analysis. Security teams use Sysmon logs to detect suspicious behavior that standard Windows event logging misses.
Making it a built-in Windows feature instead of a separate download standardizes its availability across all Windows 11 systems. Security teams no longer need to separately deploy and maintain the Sysinternals package.
To enable built-in Sysmon:
You can enable it through PowerShell or Command Prompt by running the following command.
Go to Settings, System, Optional Features, Add a feature, and search for Sysmon. Or via Command Prompt as administrator:
DISM /Online /Enable-Feature /FeatureName:SysmonIf you previously installed Sysmon through the Sysinternals package, Microsoft recommends removing that version first before enabling the new built-in version.
Taskbar Network Speed Test
The Taskbar Wi-Fi icon now provides users with a new Network Speed Test option. The feature lets users access Bing’s speed test through Edge.
A new speed test shortcut is accessible by clicking the Wi-Fi icon in the system tray. This opens a network speed test powered by Bing, running through Microsoft Edge. The test measures download and upload speeds and displays latency.
It does not work as a fully integrated system tool — it is a browser-based test rather than a native Windows speed measurement. For users who want a quick speed check without downloading a separate app or navigating to a browser, it is a convenient addition. For users who want accurate network measurements independent of browser overhead, dedicated tools remain more reliable.
Camera Pan and Tilt Support
KB5079473 adds native Windows support for PTZ — pan, tilt, and zoom — camera controls. Previously, controlling PTZ cameras from Windows required manufacturer-specific software. With this update, Windows 11 can directly control pan and tilt movements on compatible cameras through the built-in camera settings and the Windows camera API.
This is most relevant for users with external webcams, conference room cameras, and home security cameras that support PTZ. Applications that use the Windows camera API gain PTZ control capability without requiring separate camera management software.
Extract All — More Compressed Formats Supported
The Extract All feature now supports additional compressed formats which include more than just traditional .zip files.
File Explorer’s right-click Extract All context menu option previously applied only to ZIP archives. KB5079473 expands this to additional compressed file formats — including .tar, .tar.gz, and other common archive types. This reduces the need for third-party extraction tools for formats that were previously not natively supported.
File Explorer Search — Multi-Drive Reliability
This update improves File Explorer search reliability when searching across multiple drives or “This PC”.
Searching across “This PC” — which covers all connected drives simultaneously — previously produced inconsistent results depending on drive types, indexing state, and file access frequency. The March 2026 update addresses the underlying search indexer interaction issues that caused searches to feel slow, incomplete, or stuck when spanning multiple drives.
The change matters more than it sounds. File Explorer search has been a perennial pain point for many Windows users — searches that work instantly when scoped to a single drive can feel slow, incomplete, or stuck when you ask Windows to scan “This PC” which covers multiple physical drives and folders.
Widgets — Full Page Settings
Previously, Widget settings opened in a small dialog window. With this update, the settings now open as a full-page experience.
The Widgets panel settings interface is expanded from a small popup dialog to a full-page settings view. This provides more room for settings options, makes configuration easier to navigate, and aligns with the broader Windows 11 full-page settings design language.
WebP Wallpaper Support
Desktop backgrounds now support .webp images through direct user access. The format achieves high quality results with smaller file sizes which leads to lower RAM needs during system startup.
Windows 11 previously required converting WebP images to another format before they could be set as desktop wallpaper. KB5079473 adds native WebP support to the wallpaper picker — you can now directly select any .webp image file as a desktop background without conversion.
WebP is Google’s modern image format that delivers comparable quality to JPEG and PNG at significantly smaller file sizes. For users who collect wallpapers from the web — where WebP is increasingly the default format — this removes a friction point.
Quick Machine Recovery Improvements
Quick Machine Recovery — Microsoft’s feature for recovering Windows devices that cannot boot normally — receives improvements in KB5079473. The changes improve the reliability of the recovery process on devices where previous Quick Machine Recovery attempts were inconsistent, particularly on systems with unusual storage configurations or multiple drives.
Full Feature Summary Table
| Feature | Type | Details |
|---|---|---|
| Emoji 16.0 | New | Full Unicode 16.0 emoji set available system-wide |
| Built-in Sysmon | New | Optional feature — disabled by default, enable via DISM |
| Taskbar Speed Test | New | Wi-Fi icon shortcut to Bing speed test in Edge |
| Camera Pan and Tilt | New | Native PTZ camera control via Windows API |
| Extract All expansion | Improved | More compressed formats beyond ZIP |
| File Explorer Search | Improved | Multi-drive and This PC search reliability |
| Widgets settings | Improved | Full page instead of small dialog |
| WebP wallpaper | New | Direct .webp support in wallpaper picker |
| Quick Machine Recovery | Improved | More reliable recovery on varied hardware |
| WDAC COM allowlisting | Improved | Better handling of COM object policies |
| Secure Boot certificates | Ongoing | Continued phased rollout |
Known Issues and Problems
Gaming Performance Issues
The update will fix almost 80 security weaknesses but it will also cause several users to experience problems with both installation and gaming performance.
Some users reported frame rate drops and increased stuttering in games after installing KB5079473. This is a pattern that has appeared with several 2026 Patch Tuesday updates — the underlying cause varies by hardware configuration. If you experience gaming performance degradation after KB5079473, testing with the update uninstalled confirms whether it is the cause. Monitoring community forums for your specific hardware — GPU model, CPU, and game — helps identify whether the issue is widespread or configuration-specific.
Windows Hello Authentication Failures
Windows Hello facial recognition and fingerprint authentication may intermittently fail with error 0x80090016 on some devices with fingerprint readers after KB5079473. If you encounter this issue, the workaround is to sign in with your PIN or password, then re-enroll your fingerprint in Settings, Accounts, Sign-in options. Re-enrollment typically resolves the intermittent failure.
Printer Compatibility Issues
Certain printer issues with legacy print drivers released before 2020 have been reported. The workaround is to update printer drivers to the latest version from the manufacturer or temporarily uninstall KB5079473 until updated drivers are available.
How to Install KB5079473
Method 1 — Windows Update (Recommended)
Go to Settings, Windows Update, Check for updates. KB5079473 appears as “2026-03 Security Update (KB5079473) (26200.8037)” on Windows 11 25H2 or as “(26100.8037)” on 24H2. Click Download and install. Restart when prompted.
The installation process will update the build numbers to 26100.8037 for 24H2 and 26200.8037 for 25H2. The download size exceeds 4.5 GB.
Method 2 — Microsoft Update Catalog (Manual)
Go to catalog.update.microsoft.com. Search for KB5079473. Select the package matching your Windows version — 25H2 or 24H2 — and architecture — x64 or ARM64. Download the .MSU file and run it.
Note the large download size — over 4.5GB — which reflects cumulative update packaging and bundled AI component updates for Copilot+ PCs.
If you encounter error 0x80244022 during the download or Windows Update connection, our full fix guide covers every resolution step.
KB5043080 — the September 2024 checkpoint servicing stack update — is a required prerequisite for KB5079473. Most systems already have it installed if they have been receiving regular updates. If KB5079473 fails with error 0x800F0838, install KB5043080 first.
How to Verify KB5079473 Is Installed
Go to Settings, System, About. Under Windows specifications, check the OS build number.
Successful installation shows build 26200.8037 on Windows 11 25H2 or build 26100.8037 on Windows 11 24H2.
You can also go to Settings, Windows Update, Update History and look for KB5079473 with a Successfully installed status dated March 10, 2026.
KB5079473 and the 2026 Update Chain
KB5079473 is part of the continuous monthly update sequence for Windows 11 25H2 and 24H2 in 2026.
The sequence from March through July 2026 is:
KB5079473 — March 10, 2026. The update covered in this article — 9 features, 80 security fixes.
KB5083769 — April 14, 2026. The April Patch Tuesday for 25H2 and 24H2.
KB5094126 — June 9, 2026. The June Patch Tuesday — Shared Audio, Low Latency CPU Profile, OLE Automation bug.
KB5095093 — June 23, 2026. The June optional preview — Point-in-Time Restore debut, Bluetooth fixes.
KB5101650 — July 14, 2026. The July Patch Tuesday — 570 vulnerabilities, Point-in-Time Restore for all users.
Each update in this chain includes all security content from previous updates. A system that missed KB5079473 and installs KB5101650 directly receives all of March’s security patches as part of KB5101650’s cumulative content. However, some features from KB5079473 — particularly Sysmon, the speed test shortcut, and WebP wallpaper — may not activate until the system specifically applies the build where they were introduced.
KB2267602 — the daily Defender security intelligence update — continues running alongside all of these cumulative updates. The two types of updates serve different purposes and operate independently.
Frequently Asked Questions
What is KB5079473?
KB5079473 is the March 10, 2026 Patch Tuesday cumulative security update for Windows 11 versions 25H2 and 24H2. It moves systems to OS builds 26200.8037 and 26100.8037, fixes between 58 and 80 vulnerabilities including active zero-days, and adds nine new features including Emoji 16.0, built-in Sysmon, a Taskbar speed test, camera pan and tilt support, and WebP wallpaper support.
What new features does KB5079473 add?
KB5079473 adds Emoji 16.0 support, built-in Sysmon as an optional Windows feature, a network speed test shortcut in the Taskbar Wi-Fi icon, native PTZ camera control, expanded Extract All for more archive formats, improved File Explorer multi-drive search, full-page Widgets settings, WebP wallpaper support, and Quick Machine Recovery improvements.
What is built-in Sysmon in KB5079473?
Sysmon is a security monitoring tool that logs detailed system activity — process creation, network connections, registry changes — to the Windows Event Log. Previously it required manual download from Microsoft Sysinternals. KB5079473 makes it an optional Windows feature that can be enabled via Settings or DISM. It is disabled by default.
How many vulnerabilities does KB5079473 fix?
KB5079473 fixes between 58 and 80 security vulnerabilities in Windows components, including active zero-days. The complete CVE list is published on the Microsoft Security Response Center.
What OS build does KB5079473 install?
KB5079473 installs OS build 26200.8037 on Windows 11 25H2 and build 26100.8037 on Windows 11 24H2.
How large is the KB5079473 download?
KB5079473 exceeds 4.5GB in download size. This reflects the cumulative update packaging model and bundled AI component updates for Copilot+ PCs.
Why are new features not showing after installing KB5079473?
New features in KB5079473 roll out gradually using Microsoft’s Controlled Feature Rollout mechanism. Security fixes apply immediately upon installation. Features like the Taskbar speed test and WebP wallpaper support may not appear immediately after installation — they roll out over days to weeks based on device eligibility and targeting data.
Does KB5079473 cause gaming performance issues?
Some users reported frame rate drops and stuttering after installing KB5079473. The issue is not universal — it depends on hardware configuration. If you experience gaming performance degradation after this update, testing with the update uninstalled can confirm whether it is the cause.
