Skip to the content
The Update Bureau
Windows 10 1809 Windows 10 1809 Security update
Patch Tuesday Zero-day

KB5126651

KB5126651: Cumulative update for Windows 10, version 1809, October 2026. Windows Shell exploit covered; BitLocker access restored

In short

An exploited Windows Shell security bypass is covered, and older systems can access drives encrypted on newer systems again. The update also addresses File History and Storage Spaces problems.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSC 2019, version 1809, on x86 or x64 systems.

Build
17763.9376
Security
946 fixed · 24 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • What changes This update fixes the File History issue that could prevent backups or restores to external drives or network locations, including a false “Reconnect your drive” message.
  • What changes The bundled servicing stack update adds enhanced logic to verify whether a device is hosted on Azure, using an updated certificate chain.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fixes 3 changes

BitLocker

For: Devices using BitLocker To Go drives

  • Older systems can access data on drives encrypted with BitLocker To Go on newer systems.1

File History

  • File History might fail to back up or restore files to an external drive or network location. Affected devices might show “Reconnect your drive” even when a working backup drive is connected.2

Storage Spaces

Verified in package
  • Some Storage Spaces Direct virtual disks might remain offline after a Windows update. This update addresses the problem.3
    Valid tiered storage metadata might be identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online.

Improvements 2 changes

Date and Time

  • Devices using British Columbia or Alberta time zones get permanent daylight saving time support starting in November 2026.4

Secure Boot

Gradual rollout Verified in package
  • Eligible devices continue to receive updated Secure Boot certificates through Windows Update.5
    Updated high-confidence targeting data identifies eligible devices ready to receive the certificates automatically.

New features 2 changes

Date and Time

For: Devices using Manitoba time

  • A new Manitoba Standard Time zone is available.4
    The time zone is named “(UTC-05:00) Manitoba.”

ReFS security

  • ReFS volumes on external storage get auditing and optional security controls. Auditing is on by default, while enforcement is off by default.6
    Adds auditing and optional policy controls for ReFS volumes on externally attached storage devices.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5129238

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might fail to start or produce sound after the September 8, 2026 security update. They might show Code 10, have no audio output, or have unresponsive volume or sound controls. The September 14 out-of-band update partly resolved the issue for devices using 8-channel or 3D audio modes; other symptoms remain.7

    How to apply the workaround Workaround

    For multichannel audio problems, some customers have restored sound by switching to 2-channel mode. For symptoms not resolved by the out-of-band update, IT administrators who need an immediate workaround should contact Microsoft Support for Business.7

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5129238, KB5122876, KB5120238, KB5099538
+24 earlier KB5094123, KB5087538, KB5091573, KB5082123, KB5078752, KB5075904, KB5078131, KB5077795, KB5073723, KB5074975, KB5071544, KB5068791, KB5066586, KB5065428, KB5066187, KB5063877, KB5062557, KB5060531, KB5061978, KB5058392, KB5059091, KB5058922, KB5050008, KB5037425
Replaced by
KB5134124
VersionBuildChannel
1809 17763.9376 General availability

Security

946 vulnerabilities fixed
1 exploited 24 critical 922 important
VulnerabilitySeverityCVSS
CVE-2026-96951 Exploited
Windows Shell Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-100202
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70147
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70153
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-96934
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-97814
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-100220
Windows Media Video Decoder Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102214
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102225
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108467
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108471
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-83934
Windows GDI+ Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-96913
Windows Kernel Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96914
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96952
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108460
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-70229
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88171
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88174
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-100215
Microsoft Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-108131
Active Directory Federation Services (AD FS) Spoofing Vulnerability
 Critical 7.5
CVE-2026-96222
Active Directory Federation Services (AD FS) Spoofing Vulnerability
 Critical 7.4
CVE-2026-108399
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.2
CVE-2026-102211
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-83917
Windows ALPC Elevation of Privilege Vulnerability
 Critical 7.0

The table lists the 25 exploited, publicly disclosed or critical vulnerabilities. See all 946 vulnerabilities →

Updated components

4,363 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings48
Graphics and display42
Audio39
Bluetooth38
Networking34
Remote Desktop26
Security and sign-in25
Storage and file systems21
Secure Boot19
Hyper-V and virtualization15
Printing14
Search12

Verified in package: changed files confirm Storage Spaces, Secure Boot.

Page history

  1. Known issue resolved: USB Audio Class 1.0 devices with error Code 10 or no output (KB5129238)

  2. Added 55 vulnerabilities (55 important)

  3. Superseded by KB5134124

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. This update fixes an issue in which drives encrypted by BitLocker To Go on newer systems were not recognized by older systems. support.microsoft.com
  2. 2. Fixed: This update addresses an issue where File History might fail to back up or restore files to an external drive or network location. support.microsoft.com
  3. 3. This update addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. support.microsoft.com
  4. 4. This update enables permanent Daylight Saving Time (DST) support for British Columbia and Alberta starting in November 2026. support.microsoft.com
  5. 5. This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. support.microsoft.com
  6. 6. This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. support.microsoft.com
  7. 7. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake