Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday Zero-day

KB5126657

KB5126657: Cumulative update for Windows 10, versions 21H2 and 22H2, October 2026. Windows Shell flaw under active attack gets patched

In short

An actively exploited Windows Shell security-feature bypass gets patched, alongside changes to time zones, ReFS security, storage, and File History.

Does it affect you? Applies to: Windows 10 version 22H2 devices enrolled in Extended Security Updates, and Windows 10 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 devices running version 21H2.

Builds
19044.7807 · 19045.7807
Security
954 fixed · 22 critical · 1 exploited
Restart
Required

What changes

Improvements 3 changes

Date and Time

For: devices using these time zones

  • Windows adds permanent daylight saving time support for British Columbia and Alberta starting in November 2026.1

Secure Boot

Gradual rollout Verified in package
  • Eligible devices continue to receive updated Secure Boot certificates through Windows Update over time.2
    Deployment uses the latest high-confidence targeting data to identify eligible devices ready to receive the new certificates automatically.

Servicing stack

  • The servicing stack can better check whether a device is hosted on Azure when validating certificates.3
    The bundled servicing stack update adds logic to verify Azure hosting status using an updated certificate chain for validation.

Fixes 2 changes

Storage Spaces

Verified in package
  • Some Storage Spaces Direct virtual disks might stay offline after a Windows update. This update addresses the issue.4
    Valid tiered storage metadata might be incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online.

File History (known issue)

  • File History might fail to back up or restore files to an external drive or network location. This update addresses the issue.5
    Affected devices might incorrectly display a "Reconnect your drive" message even when a compatible backup drive is connected and working.

New features 2 changes

Date and Time

  • A new Manitoba time zone is available.6
    The new time zone is Manitoba Standard Time, (UTC-05:00) Manitoba.

ReFS security

  • ReFS auditing is on by default for externally attached storage. Optional security controls are available but stay off by default.7
    Adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Enforcement controls remain disabled by default.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5129236

    USB Audio Class 1.0 devices with error Code 10 or no output

    After the September 8 security update, some USB Audio Class 1.0 devices might fail to start or produce audio. The September 14 out-of-band update fixes symptoms with 8-channel or 3D audio, but other symptoms remain.8

    How to apply the workaround Workaround

    Some customers report restoring audio by switching to 2-channel mode. For symptoms not fixed by the out-of-band update, administrators can contact Microsoft Support for Business.8

    Step-by-step workaround instructions
    2 steps
    Show steps Hide steps
    Step-by-step procedure
    1. If using multichannel audio, try switching to 2-channel mode; some customers report this restores audio.
    2. For symptoms not addressed by the September 14 out-of-band update, contact Microsoft Support for Business.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5129236, KB5122878, KB5120249, KB5099539
+40 earlier KB5094127, KB5087544, KB5082200, KB5078885, KB5075912, KB5078129, KB5077796, KB5073724, KB5074976, KB5071546, KB5068781, KB5066791, KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by
KB5134125
VersionBuildChannel
21H2 19044.7807 General availability
22H2 19045.7807 General availability

Security

954 vulnerabilities fixed
1 exploited 22 critical 932 important
VulnerabilitySeverityCVSS
CVE-2026-96951 Exploited
Windows Shell Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-100202
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70147
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70153
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-97814
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-100220
Windows Media Video Decoder Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102214
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102225
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-105733
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108467
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-83934
Windows GDI+ Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-88073
Windows Graphics Kernel Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96913
Windows Kernel Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96914
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96952
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108457
Microsoft Windows PDF Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-108460
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-70229
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-100215
Microsoft Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-108131
Active Directory Federation Services (AD FS) Spoofing Vulnerability
 Critical 7.5
CVE-2026-108399
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.2
CVE-2026-102211
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-83917
Windows ALPC Elevation of Privilege Vulnerability
 Critical 7.0

The table lists the 23 exploited, publicly disclosed or critical vulnerabilities. See all 954 vulnerabilities →

Updated components

4,443 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio59
Graphics and display54
Bluetooth47
Networking47
Remote Desktop44
Security and sign-in36
Secure Boot27
Windows Update27
Hyper-V and virtualization25
Search23
Storage and file systems23
Kernel20

Verified in package: changed files confirm Secure Boot, Storage Spaces.

Page history

  1. Known issue resolved: USB Audio Class 1.0 devices with error Code 10 or no output (KB5129236)

  2. Added 55 vulnerabilities (55 important)

  3. Superseded by KB5134125

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. This update enables permanent Daylight Saving Time (DST) support for British Columbia and Alberta starting in November 2026. support.microsoft.com
  2. 2. This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. support.microsoft.com
  3. 3. This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. support.microsoft.com
  4. 4. Addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. support.microsoft.com
  5. 5. Fixed: This update addresses an issue where File History might fail to back up or restore files to an external drive or network location. support.microsoft.com
  6. 6. This update introduces the new time zone Manitoba Standard Time, "(UTC-05:00) Manitoba." support.microsoft.com
  7. 7. This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default support.microsoft.com
  8. 8. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake