Version: Windows 2026.6.850.0$$$Date: 2026-07-07$$$Size: 59 MB$$$Download$$$$$$$$$Release notes$$$This hotfix addresses a Windows authentication issue in the embedded WebView2 browser. Single sign-on could fail to use the Windows primary account; causing users to be prompted for an interactive sign-in. The embedded authentication browser now allows SSO providers to use the OS primary account when available.

Version: Windows 2026.6.822.0$$$Date: 2026-06-29$$$Size: 59 MB$$$Download$$$$$$$$$Release notes$$$This release introduces multiple features from our previous beta release into stable release; including:$$$$$$The client now applies DNS search suffixes configured in your device profile / network policy. Administrators can push a list of DNS search domains that the client appends to single-label queries; alongside any system-configured suffixes. See DNS search suffixes for details.$$$Added mandatory authentication. When enabled via MDM; the Cloudflare One Client blocks all Internet traffic from the moment the machine boots until the user authenticates; closing the visibility gap on newly deployed devices and during re-authentication. See the announcement blog and documentation for details.$$$Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the TPM (with TPM 2.0+) whenever it is available to provide stronger protection against device impersonation. See Hardware-backed registration for details.$$$Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism; administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume.$$$Added new warp-cli debug commands for interactive connection diagnosis. See Extra debug logging for details.$$$The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records); so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client.$$$Added a new MDM format for organization-wide settings; including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works; but the new format is now recommended. See the updated Cloudflare One MDM documentation for details.$$$Added support for dashboard-managed client version deployments. Administrators can now upgrade or downgrade the client version on enrolled devices directly from the Zero Trust dashboard. See Client version assignments for details.$$$Additional Changes and improvements$$$$$$Starting with 2026.6.822.0; the client unifies all API requests under the api.devices.cloudflare.com SNI; where previously both zero-trust-client.cloudflareclient.com and notifications.cloudflareclient.com were used. Review Cloudflare One Client with firewall to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected.$$$Client Certificate device-posture checks now support template variables (e.g. ${serial_number}; ${device_uuid}) in the Subject Alternative Name field. Previously only the Common Name field accepted variables; which broke posture rules that pinned identity to a SAN entry.$$$Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in Windows Accessibility settings.$$$Path MTU Discovery (PMTUD) is now enabled by default.$$$The UseWebView2 registry value (HKLM\SOFTWARE\Cloudflare\CloudflareWARP\UseWebView2 = y) is once again honored by the new GUI for authentication; so administrators who prefer the embedded WebView2 browser for sign-in can opt back in. This setting was effectively ignored in the previous release; the default browser was always used. This key is now also honored for re-authentications.$$$Fixed a crash in the authentication browser when navigating to a site that prompts for browser permissions (microphone; camera; notifications; etc.). The same fix had previously landed for the captive-portal browser; this extends it to the auth browser.$$$Fixed an issue in proxy mode where hostnames contain

Release notes$$$This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:$$$$$$Right click context menu to access the most common client actions quickly$$$Built-in captive portal login experience$$$Additional Changes and improvements$$$$$$Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file.$$$Fixed a proxy mode connection stall issue.$$$Known issues$$$$$$Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result; the client will utilize the default browser on the device to complete the authentication process.$$$An error indicating that Microsoft Edge cant read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed.$$$Registration may hang at Checking your organization configuration due to IPC errors. A system reboot should resolve the error; allowing registration to proceed.$$$Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release.$$$Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option.$$$DNS resolution may be broken when the following conditions are all true:$$$The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while the client is connected.$$$To work around this issue; please reconnect the client by selecting disconnect and then connect in the client user interface.

Release notes$$$This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:$$$$$$Right click context menu to access the most common client actions quickly$$$Built-in captive portal login experience$$$Additional Changes and improvements$$$$$$Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file.$$$Fixed a proxy mode connection stall issue.$$$Known issues$$$$$$Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result; the client will utilize the default browser on the device to complete the authentication process.$$$An error indicating that Microsoft Edge cant read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed.$$$Registration may hang at Checking your organization configuration due to IPC errors. A system reboot should resolve the error; allowing registration to proceed.$$$Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release.$$$Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option.$$$DNS resolution may be broken when the following conditions are all true:$$$The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while the client is connected.$$$To work around this issue; please reconnect the client by selecting disconnect and then connect in the client user interface.

Release notes$$$This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:$$$$$$Right click context menu to access the most common client actions quickly$$$Built-in captive portal login experience$$$Additional Changes and improvements$$$$$$Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file.$$$Known issues$$$$$$Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result; the client will utilize the default browser on the device to complete the authentication process.$$$An error indicating that Microsoft Edge cant read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed.$$$Registration may hang at Checking your organization configuration due to IPC errors. A system reboot should resolve the error; allowing registration to proceed.$$$Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release.$$$Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option.$$$DNS resolution may be broken when the following conditions are all true:$$$The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while the client is connected.$$$To work around this issue; please reconnect the client by selecting disconnect and then connect in the client user interface.

Release notes$$$This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:$$$$$$Right click context menu to access the most common client actions quickly$$$Built-in captive portal login experience$$$Additional Changes and improvements$$$$$$Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file.$$$Known issues$$$$$$Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result; the client will utilize the default browser on the device to complete the authentication process.$$$An error indicating that Microsoft Edge cant read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed.$$$Registration may hang at Checking your organization configuration due to IPC errors. A system reboot should resolve the error; allowing registration to proceed.$$$Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release.$$$Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option.$$$DNS resolution may be broken when the following conditions are all true:$$$The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while the client is connected.$$$To work around this issue; please reconnect the client by selecting disconnect and then connect in the client user interface.