Quick fix: Download the KB’s standalone .msu file from catalog.update.microsoft.com and install it manually with wusa.exe — bypasses the Windows Update cache and service issues that cause repeated install failures.

The Windows Update screen shows a specific KB (e.g., KB5034123) stuck at “Download error” or “Install failed”. You retry, it fails again. Other updates install fine. The cumulative update keeps trying every time you check for updates and never gets through. The issue is in the staging or download path for that specific KB — not in Windows Update generally.

Symptom: A specific KB cumulative or security update fails to install repeatedly through Windows Update.
Affects: Windows 11 (and Windows 10) when one specific KB is the issue, while other updates install correctly.
Fix time: ~15 minutes.

What causes this

Windows Update has several layers where a specific KB can fail. Download corruption: a partial or corrupted download in C:\Windows\SoftwareDistribution\Download. Component store mismatch: the KB’s payload expects certain pre-state in WinSxS that’s out of sync. Pending operations: a previous failed update left pending file replacements that block the new install. License or signature check: a TLS handshake or signature validation error specific to certain Microsoft CDN endpoints.

The Microsoft Update Catalog hosts the same .msu file directly. Downloading and installing it manually bypasses most of those failure paths.

Method 1: Download from Microsoft Update Catalog and install with wusa

The most reliable manual installation route.

Note the exact KB number from Settings → Windows Update → Update history (e.g., KB5034123).
Visit catalog.update.microsoft.com in your browser.
Enter the KB number in the search box and press Enter.
The results show several variants. Pick the one matching your system architecture (typically x64-based Systems) and your Windows 11 version (e.g., Windows 11 23H2).
Click Download. In the popup, click the .msu link to save the file locally.
Right-click the downloaded .msu and choose Open. The Windows Update Standalone Installer (WUSA) runs.
Confirm the installation. WUSA stages and applies the update, then prompts to reboot.
Reboot to complete.

The manual install bypasses Windows Update’s download cache entirely. Successful installs even when Windows Update has been failing for the same KB for weeks.

Method 2: Repair Windows Update components, then retry

Use when even the manual install fails — the WinSxS component store needs repair before any cumulative update will succeed.

Open Terminal (Admin).

Run DISM to scan and repair the component store:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

The RestoreHealth step takes 10-20 minutes.

Run System File Checker:
```
sfc /scannow
```

Reset Windows Update components:

net stop wuauserv
net stop bits
net stop cryptsvc
Rename-Item C:\Windows\SoftwareDistribution C:\Windows\SoftwareDistribution.old
Rename-Item C:\Windows\System32\catroot2 C:\Windows\System32\catroot2.old
net start wuauserv
net start bits
net start cryptsvc

Reboot.
Retry the KB installation — either through Windows Update or the manual .msu from Method 1.

This sequence catches the case where the component store is the root cause. The two renamed folders rebuild themselves on next Windows Update access.

Method 3: Use the Windows Update Troubleshooter and check pending operations

Use this for the rare case where pending file operations are blocking the install.

Open Settings → System → Troubleshoot → Other troubleshooters.
Click Run next to Windows Update. Let it complete — it resolves common service-state issues.

Open Terminal (Admin) and check for pending operations:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" -Name PendingRequired -ErrorAction SilentlyContinue
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired" -ErrorAction SilentlyContinue

If either returns values, a previous update is awaiting reboot.

If pending reboot is detected, reboot first. Then retry the KB install.
If WinSxS shows persistent pending operations (the SessionsPending registry key under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing), run DISM /Online /Cleanup-Image /RevertPendingActions — but only as a last resort, since this aborts in-progress updates.

This addresses the conflict cases where a half-complete previous update blocks the new one.

How to verify the fix worked

Run Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 5 in PowerShell. The KB should appear with today’s date.
Open Settings → Windows Update → Update history. The KB shows status Successfully installed.
Open System Information (msinfo32). OS Build should match the build number Microsoft lists for that KB on their release notes page.

If none of these work

If a KB still won’t install after all three methods, four edge cases remain. Wrong architecture or version: download the exact match for your Windows 11 edition and build number — checking winver shows your current version. Antivirus interference: temporarily disable third-party AV (Norton, McAfee, Bitdefender) and retry — they sometimes block update binaries. OEM block: some laptop manufacturers (Dell, Lenovo) include their own update management that conflicts with Windows Update — check the manufacturer’s utility for a pending company-managed update or known incompatibility. Microsoft delayed rollout: occasionally Microsoft pulls a KB from the rollout for specific hardware (TPM bugs, driver conflicts). Search the Microsoft Release Health dashboard (aka.ms/releasehealth) for the KB — known issues are listed there.

Bottom line: A single failing KB is usually a stuck staging issue — download the .msu directly from the Microsoft Update Catalog and install with WUSA. That handles 80% of cases without touching anything else.