Microsoft pushed KB5085516 as an out-of-band emergency update on March 21, 2026, and a chunk of Windows 11 machines are refusing to install it. If you're stuck at 90-100% with a failure, or the update isn't even showing up, here's what actually fixes it.

What's Happening

The update targets a critical vulnerability and ships outside the normal Patch Tuesday schedule. That urgency, combined with some component store corruption that's surprisingly common on 24H2 and 25H2 builds, is causing installs to fail repeatedly. The most common error codes people are hitting: 0x800f0991 and 0x80073712. Sometimes there's no code at all, just "We couldn't install this update."

The good news is there's a clear set of steps that resolves it for most machines. Work through them in order.

Step 1: Fix the Component Store First

Before anything else, run these two commands from an elevated command prompt. This is the fix for the majority of failures.

DISM /Online /Cleanup-Image /RestoreHealth

Wait for it to finish. It can take 10-20 minutes depending on your connection and machine speed. Then run:

sfc /scannow

Restart after both complete, then try Windows Update again.

Step 2: Clear Pending Actions (for 0x800f0991 Specifically)

If you're seeing 0x800f0991, there's likely a stuck pending action blocking the install. This clears it.

Boot into Windows Recovery Environment. The easiest way: hold Shift and click Restart from the Start menu, then navigate to Troubleshoot, Advanced Options, Command Prompt.

Once you're at the RE command prompt, run:

DISM /Image:C:\ /Cleanup-Image /RevertPendingActions

If Windows is on a different drive letter in RE, adjust accordingly. Exit, restart normally, then try the update again.

Step 3: Install It Manually

If Windows Update still won't cooperate, skip it entirely and install the MSU file directly.

Go to the Microsoft Update Catalog: https://www.catalog.update.microsoft.com

Search for KB5085516, download the version that matches your build (x64 for most systems), and run the MSU file directly. It bypasses the Windows Update client entirely and usually gets through when the automatic process won't.

To confirm your Windows build before downloading, run this:

winver

Match the architecture and version shown there to the correct catalog download.

Step 4: In-Place Repair Upgrade (Last Resort)

If none of the above works, an in-place repair upgrade will fix it without touching your files or apps. Download the Windows 11 ISO from Microsoft's site, mount it, and run setup.exe. Choose "Keep personal files and apps." It reinstalls Windows over itself, clears any deep corruption, and KB5085516 will install cleanly afterward.

This sounds scary. It isn't. It takes 30-45 minutes and leaves your machine exactly as it was.

The Update Isn't Showing Up At All

Some machines on 25H2 aren't getting the automatic push yet. If you've waited a day or two and it's not appearing, the manual catalog install from Step 3 is the right move. Don't wait for it to appear on its own if your machine is internet-facing.

You can also check if the update is already installed by running:

wmic qfe list brief | findstr KB5085516

If you see it in the output, you're already patched and can stop chasing it.

Need help getting KB5085516 installed across your fleet? Contact Rain City Techworks.