Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday Zero-day

KB5126646

KB5126646: Cumulative update for Windows Server, version 2025, October 2026. Exploited Windows Shell flaw patched; server recovery feature added

In short

An actively exploited Windows Shell security-feature bypass is patched. Windows Server 2025 also gains Quick machine recovery, which is off by default.

Does it affect you? Applies to: This update is for x64 devices running Windows Server 2025. The KB also describes a separate servicing stack update, KB5126645.

Build
26100.33650
Security
1,098 fixed · 35 critical · 1 exploited
Restart
Required

What changes

Improvements 11 changes

ReFS security

  • ReFS volumes on externally attached storage can now be audited, with optional security enforcement controls.1
    Auditing is enabled by default. Enforcement controls are disabled by default.

Date and Time

For: Devices using these time zones

  • British Columbia and Alberta get permanent daylight saving time support starting in November 2026.2

Security

  • The included cURL version is updated to 8.21.0.3

Networking

Verified in package

For: Devices making these connections

  • SMB network connections are more likely to succeed during NULL session attempts.4
    Improves the NetUseAdd function.

Authentication

3 items
  • Member servers can connect more reliably to domain controllers set up before Windows Server 2025.5
    Improves Netlogon secure channel connections.
  • Domain controllers check that incoming LDAP connections use the required Kerberos ticket. Some Azure NetApp Files and NetApp ONTAP setups might lose access to SMB shares or fail to create SMB volumes.6
    Verifies that incoming LDAP binds use a Kerberos service ticket issued for the LDAP service principal name (SPN). The change can affect configurations using LDAP client session security set to none.
  • On devices without Credential Guard and with no BlockNtlmv1SSO value set, Windows now blocks the generation of NTLMv1-derived credentials for SSO by default.11
    Changes the internal default from Audit mode (0) to Enforce mode (1). It might affect Wi-Fi, Ethernet, and VPN connections using MS-CHAPv2-based authentication.

Emoji

Verified in package
  • Emoji search gets a security update.7
    Updates the libraries used by EmojiSearchData in the Expressive Input Panel.

Hyper-V

For: Devices running these virtual machines

  • Intel TDX confidential virtual machines work more reliably in Hyper-V.8
    Improves reliability issues affecting Intel Trusted Domain Extensions (TDX) operation.

Distributed Key Manager (DKM)

  • AD FS now automatically corrects insecure DKM container permissions by default.9
    Administrators can opt out by setting RemediateDkmAcl to 0. The change addresses an elevation-of-privilege risk from overly permissive DKM container ACLs.

Secure Boot

Gradual rollout Verified in package
  • Delivery of newer Secure Boot certificates continues for eligible devices.10
    Deployment through Windows Update uses updated high-confidence targeting data and remains ongoing across supported devices.

New features 3 changes

Quick machine recovery

  • Quick machine recovery is now supported on Windows Server 2025, but it is off by default.12
    Administrators can enable the feature through Group Policy. Recovery depends on an applicable remediation being available.

Security

  • Encrypted TLS 1.3 connections can use ML-KEM key exchange to help protect against future quantum-computing threats.13
    Adds support for ML-KEM post-quantum key exchange in Transport Layer Security (TLS) 1.3.

Date and Time

For: Devices using this time zone

  • A new Manitoba Standard Time zone is available.14
    The new time zone is “(UTC-05:00) Manitoba.”

Fix 1 change

Storage Spaces

Verified in package
  • Addresses an issue that might leave some Storage Spaces Direct virtual disks offline after a Windows update.15
    Valid tiered storage metadata could be identified as invalid during recovery, keeping affected virtual disks and dependent workloads offline.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5131080

    Users might be unable to sign in to OWA or send emails on Exchange Server

    Some on-premises Exchange servers might have OWA sign-in, email sending, or mailbox replication problems after the October 2026 update. The issue is resolved by KB5131080 and later updates.16

    How to apply the workaround Registry / GPO

    For updates released before November 10, 2026, a registry change can temporarily raise the Endpoint Mapper limit. The mitigation is not needed with KB5131080 or later.16

  2. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not show synchronization error details after KB5070881 or later updates. This functionality was temporarily removed to address CVE-2025-59287.17

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Resolved Affects: Everyone Resolved by KB5129235

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might fail to start, produce no audio, or have unresponsive volume or sound settings. KB5129235 addressed symptoms with 8-channel or 3D audio; KB5131080 addressed the remaining symptoms.18

    How to apply the workaround Workaround

    Some customers reported restoring audio for multichannel modes by switching to 2-channel mode.18

  4. Open Affects: Organizations and IT administrators

    SQL Server linked server connections might remain open

    SQL Server linked-server queries using OLE DB providers might leave connections to external databases open after queries finish. Connections can build up and slow server performance over time; Oracle and PostgreSQL are among the known affected connections.19

    How to apply the workaround Workaround

    For an enterprise mitigation, contact Microsoft Support for business. Closing identified idle connections or restarting the SQL service can temporarily ease the load, but might interrupt active work and the issue can return.19

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5129235, KB5122871, KB5120233, KB5099536
+30 earlier KB5094125, KB5087539, KB5091157, KB5082063, KB5078740, KB5075899, KB5078135, KB5077793, KB5073379, KB5072033, KB5072359, KB5068861, KB5070881, KB5070773, KB5066835, KB5068221, KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5044284, KB5043080
Replaced by
KB5134137
VersionBuildChannel
2025 26100.33650 General availability

Security

1,098 vulnerabilities fixed
1 exploited 35 critical 1062 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-96951 Exploited
Windows Shell Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-100202
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-100219
Microsoft QUIC Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-105016
Microsoft QUIC Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70147
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70153
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-96934
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-97814
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-100220
Windows Media Video Decoder Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102214
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102225
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-105733
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108467
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70250
Windows DHCP Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-83934
Windows GDI+ Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-88073
Windows Graphics Kernel Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96913
Windows Kernel Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96914
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96952
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108457
Microsoft Windows PDF Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-108460
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69802
Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-70187
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-70229
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88117
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88119
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88120
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88171
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88174
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-100215
Microsoft Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-108130
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-108131
Active Directory Federation Services (AD FS) Spoofing Vulnerability
 Critical 7.5
CVE-2026-96222
Active Directory Federation Services (AD FS) Spoofing Vulnerability
 Critical 7.4
CVE-2026-108399
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.2
CVE-2026-102211
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-83917
Windows ALPC Elevation of Privilege Vulnerability
 Critical 7.0

The table lists the 36 exploited, publicly disclosed or critical vulnerabilities. See all 1,098 vulnerabilities →

Updated components

6,346 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings107
Graphics and display54
Audio50
Bluetooth46
Networking43
Security and sign-in40
Remote Desktop38
Storage and file systems36
Hyper-V and virtualization34
Printing34
Windows Update34
File Explorer and shell25

Verified in package: changed files confirm Networking, Emoji, Secure Boot, Storage Spaces.

Page history

  1. Added CVE-2026-69802

  2. Known issue resolved: Users might be unable to sign in to OWA or send emails on Exchange Server (KB5131080)

    New known issue: USB Audio Class 1.0 devices with error Code 10 or no output

  3. Added 56 vulnerabilities (56 important)

  4. Superseded by KB5134137

Sources

Updated
Cited passages from Microsoft's official notes (19)
  1. 1. Auditing is enabled by default, while enforcement controls remain disabled by default support.microsoft.com
  2. 2. This update enables permanent Daylight Saving Time (DST) support for British Columbia and Alberta starting in November 2026. support.microsoft.com
  3. 3. This update upgrades the version of cURL included with Windows to version 8.21.0. support.microsoft.com
  4. 4. This update improves the NetUseAdd function, helping it establish SMB network connections successfully during NULL session attempts. support.microsoft.com
  5. 5. This update improves Netlogon secure channel connections, helping member servers connect successfully to domain controllers that were set up before Windows Server 2025. support.microsoft.com
  6. 6. This update strengthens security on domain controllers by verifying that incoming Lightweight Directory Access Protocol (LDAP) binds use a Kerberos service ticket issued for the LDAP service principal name (SPN). support.microsoft.com
  7. 7. This update improves security for emoji search in the Expressive Input Panel by updating the libraries used by EmojiSearchData. support.microsoft.com
  8. 8. This update improves the reliability of Intel Trusted Domain Extensions (TDX) confidential virtual machines in Hyper-V reliability issues affecting TDX operation. support.microsoft.com
  9. 9. This update automatically remediates insecure DKM container ACL configurations in AD FS by default. support.microsoft.com
  10. 10. Deployment through Windows Update remains ongoing across supported devices. support.microsoft.com
  11. 11. Windows now uses Enforce mode (1) instead of Audit mode (0), blocking the generation of NTLMv1-derived credentials for Single Sign-On (SSO). support.microsoft.com
  12. 12. The feature is disabled by default on Windows Server 2025 editions. Administrators can enable the feature through Group Policy support.microsoft.com
  13. 13. This update adds support for ML-KEM post-quantum key exchange in Transport Layer Security (TLS) 1.3, helping protect encrypted connections against future quantum-computing threats. support.microsoft.com
  14. 14. This update introduces the new time zone Manitoba Standard Time, "(UTC-05:00) Manitoba." support.microsoft.com
  15. 15. This issue occurs when valid tiered storage metadata is incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online. support.microsoft.com
  16. 16. The October 2026 update introduced a default limit on the amount of memory used by Endpoint Mapper when handling Endpoint Lookup calls. learn.microsoft.com
  17. 17. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
  18. 18. Some customers have reported that they're able to restore audio in these cases by switching to 2-channel mode. support.microsoft.com
  19. 19. If idle connections can be identified, it is possible to manually close them in order to temporarily relieve server load. It is also possible to temporarily restore system stability by restarting the SQL service. learn.microsoft.com
Checked automatically: 7 of 8 checks passed, 19 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake