Microsoft has confirmed that the KB5120998 August 2026 non-security preview update is reverting mouse settings on Windows 11 systems.
According to user reports, mouse cursor personalization settings are either being changed or reset automatically after installing the KB5120998 update.
More importantly, affected Windows 11 users will not be able to restore the previous mouse settings after they are reverted.
“Microsoft has received reports indicating that mouse cursor personalization settings are being changed or reverted to certain standard settings. This occurs following installation of Windows updates released August 27 2026 (KB5120998) and later,” Microsoft explained.
“The issue is described as resulting in appearance regressions and intermittent animation changes. Some reports mention that high-DPI mouse cursors are replaced with larger, white cursors, and custom cursor animations reverting to standard settings. Attempts to restore the previous cursor customization are reported to be unsuccessful.”
Microsoft said that it’s still investigating the root cause and asked affected customers to file a report via the Feedback Hub if they’re experiencing this issue.
KB5120998 was released on Thursday with improvements to the Start menu, taskbar, and Windows search for Windows 11 versions 25H2 and 24H2.
Since this is an optional, non-security update, users must click the “Download and install” link unless they already have the “Get the latest updates as soon as they’re they’re available” option enabled, which prompts the OS to install it automatically.
In recent months, Microsoft addressed several other issues causing mouse issues on some Windows devices,
For instance, in October, it pushed an emergency update to fix a known issue that disabled USB mice and keyboards in the Windows Recovery Environment (WinRE), making it unusable.
Microsoft is also investigating a bug that causes the mouse pointer to disappear for some classic Outlook users since February when moving it over the interface.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
