The Update BureauKB5126655: Cumulative update for Windows Server, version 2022, October 2026. Exploited Shell flaw patched; Exchange mail issues mitigated
In short
An exploited Windows Shell security bypass is addressed. Some Exchange servers may still have sign-in and email delivery problems, with a temporary mitigation available.
Does it affect you? Applies to: Devices running Windows Server 2022, x64. The Exchange issue affects some on-premises Exchange servers running on Windows Server.
Review notes Additional details from the official release notes (1) Read note
- Known issues The temporary workaround is a registry change described in Microsoft’s Exchange guidance. An additional mitigation is available through Microsoft Support.
The official sources are linked at the end of the page.
What changes
Improvements 4 changes
Date and Time
For: Devices using these time zones
- British Columbia and Alberta switch to permanent daylight saving time starting in November 2026.1
Security
-
The included cURL tool is updated.2
Updates the version of cURL included with Windows to 8.21.0.
ReFS security
-
ReFS volumes on external storage devices get security auditing and optional controls.3
Auditing is enabled by default. Enforcement controls are disabled by default so administrators can evaluate and prepare for future security hardening.
Distributed Key Manager (DKM)
-
AD FS automatically corrects insecure DKM container permissions by default.4
Administrators can opt out of automatic remediation by setting
RemediateDkmAclto0. The change helps address an elevation of privilege vulnerability caused by overly permissive DKM container ACLs.
Fixes 2 changes
Storage Spaces
-
Some Storage Spaces Direct virtual disks that might stay offline after an update can come online again.5
Addresses recovery incorrectly identifying valid tiered storage metadata as invalid, preventing affected virtual disks and dependent workloads from coming online.
Audio (known issue)
Verified in package
For: Devices using USB Audio Class 1.0 devices
-
The remaining issue that could stop some USB audio devices from starting or producing sound is resolved.6
Resolves the remaining symptoms affecting some USB Audio Class 1.0 devices. The symptoms involving 8-channel or 3D audio modes were resolved by KB5129237.
New features 2 changes
Authentication
-
Administrators can get more details about NTLM use, including who uses it and where.7
Enhanced NTLM auditing is available on Windows Server 2022 and 2019. It reports who uses NTLM, why NTLM was selected, and where authentication occurs.
Date and Time
For: Devices using this time zone
-
A new Manitoba time zone is available.8
The new time zone is Manitoba Standard Time,
(UTC-05:00) Manitoba.
Known issues
-
Users might be unable to sign in to OWA or send emails on Exchange Server
Some on-premises Exchange servers may have trouble accessing or sending email. Users might be unable to sign in to OWA, and messages might stay in the Outbox. The issue is mitigated, but the symptoms may still occur.9
How to apply the workaround Registry / GPOA temporary registry change can increase the maximum number of simultaneous Endpoint Lookup calls; Microsoft Support can provide another mitigation.9
-
Windows Server Update Services (WSUS) does not display error details
WSUS does not show synchronization error details after KB5070884 or later updates. Microsoft temporarily removed this function to address CVE-2025-59287.10
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-10-13
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5129237, KB5122882, KB5120242, KB5099540
+42 earlier
KB5094128, KB5087545, KB5091575, KB5082142, KB5078766, KB5082314, KB5075906, KB5078136, KB5077800, KB5073457, KB5071547, KB5068787, KB5070884, KB5066782, KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129 - Replaced by
- KB5134140
| Version | Build | Channel |
|---|---|---|
| 2022 | 20348.5761 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2026-96951
Exploited
Windows Shell Security Feature Bypass Vulnerability
|
Important | 8.8 |
|
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Microsoft QUIC Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Microsoft QUIC Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows DHCP Server Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Text Shaping Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Media Video Decoder Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Text Shaping Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows DHCP Client Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows GDI+ Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Kernel Elevation of Privilege Vulnerability
|
Critical | 8.8 |
|
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
|
Critical | 8.8 |
|
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Microsoft Windows PDF Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Remote Desktop Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Active Directory Domain Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows DHCP Server Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows DHCP Server Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows DHCP Server Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows DHCP Server Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Deployment Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Microsoft Graphics Component Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Active Directory Federation Services (AD FS) Spoofing Vulnerability
|
Critical | 7.5 |
|
Active Directory Federation Services (AD FS) Spoofing Vulnerability
|
Critical | 7.4 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.2 |
|
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
|
Critical | 7.0 |
|
Windows ALPC Elevation of Privilege Vulnerability
|
Critical | 7.0 |
The table lists the 34 exploited, publicly disclosed or critical vulnerabilities. See all 1,034 vulnerabilities →
Downloads (Microsoft Update Catalog)
x64
2022
584.6 MB
Updated components
1,536 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Audio | 21 |
| Hyper-V and virtualization | 16 |
| Networking | 16 |
| Remote Desktop | 14 |
| Bluetooth | 13 |
| Graphics and display | 13 |
| Security and sign-in | 12 |
| Secure Boot | 10 |
| Windows Update | 9 |
| Kernel | 8 |
| Search | 7 |
| Storage and file systems | 7 |
Verified in package: changed files confirm Audio (known issue).
Page history
-
Added CVE-2026-69802
-
Known issue resolved: Users might be unable to sign in to OWA or send emails on Exchange Server (KB5131090)
-
Added 56 vulnerabilities (56 important)
-
Superseded by KB5134140
Sources
Cited passages from Microsoft's official notes (10)
-
1.
This update enables permanent Daylight Saving Time (DST) support for British Columbia and Alberta starting in November 2026.
support.microsoft.com -
2.
This update upgrades the version of cURL included with Windows to version 8.21.0.
support.microsoft.com -
3.
This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices.
support.microsoft.com -
4.
This update automatically remediates insecure DKM container ACL configurations in AD FS by default.
support.microsoft.com -
5.
Addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update.
support.microsoft.com -
6.
The remaining symptoms are resolved in the Windows security update released on October 13, 2026 (KB5126655) and later updates.
learn.microsoft.com -
7.
The new auditing capabilities provide greater visibility into NTLM authentication, helping administrators identify who is using NTLM, why NTLM was selected, and where NTLM authentication is occurring.
support.microsoft.com -
8.
This update introduces the new time zone Manitoba Standard Time, "(UTC-05:00) Manitoba."
support.microsoft.com -
9.
Workaround: This issue can be temporarily mitigated by modifying the registry key as described in Exchange servers may become unstable after installation of October 2026 Windows updates.
learn.microsoft.com -
10.
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Nov 14, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake