The Update BureauKB5126653: Cumulative update for Windows 11, version 23H2, October 2026. Exploited Windows Shell bypass flaw addressed; File History issue addressed
In short
An actively exploited Windows Shell security-feature bypass is addressed. The update also addresses File History backup and restore failures.
Does it affect you? Applies to: Devices running Windows 11, version 23H2. Enterprise and Education editions reach the end of updates on November 10, 2026.
Review notes Additional details from the official release notes (2) Read notes
- What changes Devices that have not yet received the newer Secure Boot certificates can still start and receive standard Windows updates.
- What changes The update fixes an issue that could leave some tiered Storage Spaces Direct virtual disks offline after certain security updates, making dependent clustered workloads unavailable.
The official sources are linked at the end of the page.
What changes
Improvements 4 changes
Security updates
-
The update provides security improvements, including a fix for an actively exploited Windows Shell security-feature bypass.1
Addresses CVE-2026-96951, a Windows Shell Security Feature Bypass Vulnerability.
Secure Boot
Gradual rollout
Verified in package
-
Updated Secure Boot certificates continue to reach eligible devices through Windows Update.2
Deployment uses the latest high-confidence targeting data to identify eligible devices ready to receive the new certificates automatically.
Date and Time
For: devices set to British Columbia or Alberta time
- British Columbia and Alberta get permanent daylight saving time support starting in November 2026.3
ReFS security
-
ReFS volumes on externally attached storage get auditing and optional security controls. Auditing is on by default; enforcement is off by default.4
Adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Enforcement controls remain disabled by default so administrators can evaluate and prepare for future security hardening changes.
Fixes 2 changes
File History
-
The update addresses an issue that might stop File History from backing up or restoring files to an external drive or network location.5
Affected devices might incorrectly show a “Reconnect your drive” message even when a compatible backup drive is connected and working properly.
Storage Spaces
- Tiered Storage Spaces Direct virtual disks that might fail to come online after certain security updates are fixed, restoring dependent clustered workloads.6
New feature 1 change
Date and Time
-
A new Manitoba time zone is available.7
Manitoba Standard Time is “(UTC-5:00) Manitoba”.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-10-13
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5129242, KB5122880, KB5120240, KB5099414
+57 earlier
KB5093998, KB5087420, KB5082052, KB5078883, KB5075941, KB5078132, KB5077797, KB5073455, KB5071417, KB5070312, KB5068865, KB5067112, KB5066793, KB5065790, KB5065431, KB5064080, KB5066189, KB5063875, KB5062663, KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123 - Replaced by
- KB5134130
| Version | Build | Channel |
|---|---|---|
| 23H2 | 22631.7652 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2026-96951
Exploited
Windows Shell Security Feature Bypass Vulnerability
|
Important | 8.8 |
|
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Microsoft QUIC Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Microsoft QUIC Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Text Shaping Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Media Video Decoder Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Text Shaping Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows GDI+ Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Graphics Kernel Elevation of Privilege Vulnerability
|
Critical | 8.8 |
|
Windows Kernel Elevation of Privilege Vulnerability
|
Critical | 8.8 |
|
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
|
Critical | 8.8 |
|
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Microsoft Windows PDF Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Active Directory Domain Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Microsoft Graphics Component Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Active Directory Federation Services (AD FS) Spoofing Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.2 |
|
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
|
Critical | 7.0 |
|
Windows ALPC Elevation of Privilege Vulnerability
|
Critical | 7.0 |
The table lists the 26 exploited, publicly disclosed or critical vulnerabilities. See all 1,021 vulnerabilities →
Downloads (Microsoft Update Catalog)
x64
23H2
1.1 GB
Arm64
23H2
1.3 GB
Updated components
3,625 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Audio | 47 |
| Graphics and display | 34 |
| Windows Update | 34 |
| Networking | 32 |
| Remote Desktop | 31 |
| Bluetooth | 30 |
| Hyper-V and virtualization | 28 |
| Security and sign-in | 26 |
| Storage and file systems | 19 |
| Search | 16 |
| Secure Boot | 16 |
| Kernel | 15 |
Verified in package: changed files confirm Secure Boot.
Page history
-
Added 56 vulnerabilities (56 important)
-
Superseded by KB5134130
Sources
Updated
Cited passages from Microsoft's official notes (7)
-
1.
This update provides security improvements.
support.microsoft.com -
2.
This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates.
support.microsoft.com -
3.
This update enables permanent Daylight Savings Time (DST) support for British Columbia and Alberta starting in November 2026.
support.microsoft.com -
4.
This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices.
support.microsoft.com -
5.
This update addresses an issue where File History might fail to back up or restore files to an external drive or network location.
support.microsoft.com -
6.
This update fixes an issue that affects tiered Storage Spaces Direct virtual disks. Some virtual disks might fail to come online after installing certain security updates, making dependent clustered workloads unavailable.
support.microsoft.com -
7.
This update introduces the new time zone Manitoba Standard Time "(UTC-5:00) Manitoba".
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Nov 9, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 3/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake