Microsoft released a new preview cumulative update for Windows 11 on May 26, 2026, delivering a mix of consumer-friendly features, structural changes to security components, and specialized AI updates for Copilot+ PCs. The update, KB5089570, moves Windows 11 version 26H1 to OS Build 28000.2179 and is available now as an optional download through Windows Update.

It’s a lot more than a routine patch collection. Alongside the flashier additions — a full-screen Xbox mode for controller-based gaming and Bluetooth LE Audio sharing — Microsoft is quietly overhauling how Secure Boot certificates are targeted and delivered. The update also expands File Explorer’s archive format support and pushes version 1.2604.515.0 of AI components exclusively to Copilot+ devices. The changes are rolling out gradually, meaning not every compatible PC will see them immediately, even after installing the update.

What KB5089570 actually changes

Microsoft’s release notes detail a wide sweep of improvements and additions. Here are the highlights that matter most to users and administrators:

  • Shared Audio: Two people can listen from the same Windows 11 PC using Bluetooth LE Audio broadcast technology, provided they have compatible paired devices.
  • Xbox mode: A new full-screen, controller-friendly gaming interface available on laptops, desktops, and tablets.
  • File Explorer: Support for additional archive formats (uu, cpio, xar, NuGet packages); improvements to how View and Sort preferences are remembered when apps open File Explorer; dark-mode visual fixes; and broader reliability improvements for explorer.exe, including snappier behavior after sign-in, in Task View, and with Quick Access.
  • Secure Boot: Windows quality updates will now include high-confidence device targeting data to increase coverage for machines eligible to automatically receive new Secure Boot certificates. A new policy, LimitSecureBootRequiredServiceData, allows administrators to suppress certain Secure Boot service data sent to Microsoft, useful for privacy-sensitive or restricted-traffic environments.
  • Copilot+ AI components: Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2604.515.0. These components install only on Windows Copilot+ PCs; they are ignored on standard Windows PCs and Windows Server.
  • Other fixes: Microsoft Store download errors (including codes 0x80070057, 0x80240008, and 0x80073d28) are reduced; Delivery Optimization memory usage is improved; kiosk mode configuration is simplified when Microsoft Edge is an allowed app; startup app launch performance gets a boost; Thai, Lao, Khmer, and Lontara script rendering in Leelawadee UI font is corrected; a driver compatibility fix for third-party MIDI software (midisrv.exe) is included; and color profile persistence for supported monitors has been improved.

Microsoft reports no known issues with this update at the time of publication. However, feature availability may vary due to phased rollout: some changes are deployed through “gradual rollout” and might not appear on every device right away.

What it means for you

The impact of KB5089570 depends on whether you’re a home user, a power user, or an IT administrator.

For everyday Windows users

Shared Audio and Xbox mode are the most visible additions, but don’t be surprised if they don’t show up immediately. Microsoft’s staged rollout means these features may trickle out over weeks. If they matter to you, keep an eye on Windows Update and the Feature Experience Pack.

File Explorer’s expanded archive support is a quiet but welcome upgrade. You can now peek inside cpio, xar, and NuGet packages without third-party tools, and your folder view preferences should stick more reliably. The dark-mode fixes chip away at one of Windows 11’s lingering cosmetic inconsistencies.

Secure Boot changes happen behind the scenes. For most users, the certificate-targeting improvements simply mean their device’s boot security stays current without any manual intervention. There’s nothing to configure.

For power users and enthusiasts

If you like to tinker, you might be tempted to force-enable features that aren’t yet visible. The preview update brings the necessary code, but activation is controlled by Microsoft’s cloud-based rollout. Tools like ViveTool can sometimes flip the switches, but doing so carries risk. A safer approach is to wait or to test in a virtual machine.

The MSU installation instructions are important if you prefer offline deployment. Download all MSU files for KB5089570 from the Microsoft Update Catalog, place them in a single folder, and let DISM handle prerequisites. Don’t double-click them individually unless you’ve verified the correct order.

For IT administrators

This preview demands a close read. Three areas need your attention:

  • Secure Boot policy: If your organization operates in a restricted environment, evaluate the new LimitSecureBootRequiredServiceData policy. It gives you a way to limit specific telemetry without blocking certificate updates entirely. Test it in your preview ring.
  • Copilot+ fleet separation: AI component updates apply only to Copilot+ PCs. When you deploy this update across a mixed estate, Copilot+ devices will receive additional payload. Confirm their compliance and update status separately from standard Windows 11 hardware.
  • Kiosk and startup fixes: The simplified Microsoft Edge kiosk configuration and startup performance improvements directly address helpdesk friction. Validate these changes with your deployment images.

Also, the combined servicing stack update (SSU) and cumulative update (LCU) cannot be uninstalled with wusa.exe. If you need to remove the update, use DISM and target the LCU package name specifically.

How we got here

Windows 11 version 26H1 continues the servicing rhythm Microsoft established with Windows 10. Non-security preview updates like KB5089570 serve as dry runs for the following month’s mandatory Patch Tuesday release. They let willing users and IT shops see what’s coming and validate compatibility.

Over the past year, Microsoft has been weaving more Security infrastructure into these previews. Secure Boot certificate rotation, once a rare and highly controlled event, is becoming a servicing-driven operation. The new targeting data and policy controls in KB5089570 reflect a deliberate effort to automate certificate delivery while giving admins a kill switch they can understand.

Simultaneously, the Copilot+ AI stack is maturing. Earlier updates tested basic AI components; now we see a cohesive bundle of Image Search, Content Extraction, Semantic Analysis, and Settings Model reaching version 1.2604.515.0. Microsoft is signaling that AI isn’t an app — it’s an operating system layer, serviced on its own cadence but delivered through the same cumulative update pipeline.

What to do now

The steps you take depend on your role:

General users: If you’re curious about Shared Audio or Xbox mode, you can manually check for updates in Settings > Windows Update and install the preview. Understand that not all features may light up right away. If stability is your priority, wait for the June security update.

Administrators:
- Download the MSU files from the Microsoft Update Catalog.
- Use DISM with the PackagePath pointing to the folder containing all MSUs. DISM will automatically handle dependencies.
- For offline image servicing, ensure Dynamic Update packages (SafeOS, Setup) match the same month or use the latest available.
- Test the update on a representative sample of your hardware — especially Copilot+ devices and any kiosk or public-facing terminals.
- Evaluate the new Secure Boot policy in a staging ring before deploying broadly.

Copilot+ PC owners: After installing KB5089570, confirm the AI components updated. You can check version numbers in Settings > Apps > Installed apps or via PowerShell. The components should show 1.2604.515.0. If they don’t, the phased rollout may not have reached you yet.

Outlook

KB5089570 will likely be absorbed into the June Patch Tuesday cumulative update, at which point the features and fixes will become mandatory for all Windows 11 26H1 users. Expect Secure Boot certificate targeting to expand further, and more AI component updates to land in future previews.

Microsoft’s servicing model is becoming more conditional: same OS version, same build number, different feature sets depending on hardware class, rollout stage, and policy choices. For those who manage Windows fleets, that means inventory tools will need to track not just build numbers but feature availability, AI component versions, and Secure Boot eligibility. The era of uniform Windows patches is over.