Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday

KB5131080

KB5131080: Cumulative update for Windows Server, version 2025, November 2026. NTLM signing defaults strengthened; Exchange mail issues remain

In short

NTLM clients now offer message signing by default for non-anonymous connections, helping limit relay attacks. Some on-premises Exchange servers might still have email access or delivery problems.

Does it affect you? Applies to: Devices running Windows Server 2025. The update is build 26100.33822.

Build
26100.33822
Security
628 fixed · 33 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • What changes Cuba remains on UTC-04:00 and does not observe the November 2026 or March 2027 daylight-saving transitions.
  • What changes The page lists servicing stack update KB5131079, version 26100.33822, as making quality improvements to the component that installs Windows updates.

The official sources are linked at the end of the page.

What changes

Fixes 7 changes

Certificates

  • Device certificate enrollment works when certificate details and key settings are handled correctly.1
    Fixes certificate handles that did not persist and incorrect key-type flags that caused keys to be managed improperly.

Printing

For: devices adding Active Directory printers

  • Adding an Active Directory printer from Settings no longer fails with error 87. Existing printers and printing were not generally affected.2
    Fixes adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device. The issue began with the October 2026 update.

Remote Desktop

  • The trusted Remote Desktop publisher certificate policy can be set through Microsoft Intune.3
    Fixes configuration of the “Specify thumbprints of certificates representing trusted .rdp publishers” policy through Microsoft Intune.

Remote Desktop Web Access

For: users of Remote Desktop Web Access

  • Remote Desktop Web Access pages load in Edge and Chrome when browser policy disables XSLT.4
    RD Web Access pages are rendered on the server and no longer depend on browser XSLT support.

Windows Deployment Services

  • The Import-WdsInstallImage cmdlet now requires administrator rights; non-administrator attempts fail with an access denied error.5
    After this update, running Import-WdsInstallImage as a non-administrator returns ACCESS_DENIED.

Windows Setup

For: IT administrators upgrading servers

  • An in-place upgrade from Windows Server 2016 to Windows Server 2025 no longer fails during the compatibility check with the October 2026 installation media.6
    Fixes the compatibility check failure displaying “Sorry, we’re having trouble determining if your PC can run Windows Server” and error code 0x80070003 - 0x40008.

Exchange Server

For: IT administrators managing on-premises Exchange

  • An Exchange issue is addressed, but some on-premises servers might still have trouble with OWA sign-in, email delivery, or mailbox replication after installation.7
    The update fixes an issue affecting on-premises Exchange servers. The separate open issue reported after installation can involve OWA, Outlook Outbox delivery, or mailbox replication.

Improvements 4 changes

Date and Time

For: devices using Cuba time settings

  • Cuba’s clock stays on UTC-04:00 through the November 2026 and March 2027 time changes. It returns to UTC-05:00 in November 2027.8
    The rules cover the extended 2026–2027 daylight saving time period; Cuba resumes its regular seasonal schedule in 2028.

Security

  • NTLM signing helps reduce the risk of relay attacks and helps identify connections that do not use signing.9
    Clients offer NTLM message signing by default for non-anonymous connections, with auditing for connections that are not using signing.

Start menu

  • The policy that hides the Recommended section now works in Windows 11 Enterprise multi-session environments.10
    The HideRecommendedSection policy now applies to Windows 11 Enterprise multi-session, including Azure Virtual Desktop and ServerRDSH environments.

Windows PowerShell

For: IT administrators and PowerShell script authors

  • PowerShell checks signed scripts more strictly. Scripts with invalid UTF-8 encoding might fail signature checks even if they passed before.11
    Review affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5131085

    Users might be unable to sign in to OWA or send emails on Exchange Server

    After installation, some on-premises Exchange servers might have trouble with OWA sign-in, email delivery, or mailbox replication. Some affected servers might show a MapiExceptionMdbOffline error or growing email queues.12

    How to apply the workaround Registry / GPO

    For heavily loaded Exchange workloads, increase the default limit of 512 simultaneous Endpoint Lookup calls through the registry. Microsoft Support can provide an additional mitigation.12

    Step-by-step workaround instructions
    2 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Modify the registry key as described in Microsoft’s linked Exchange mitigation guidance.
    2. For the additional mitigation, contact Microsoft Support for business.
  2. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not show synchronization error details after KB5070881 or later updates. This function was temporarily removed to address CVE-2025-59287.13

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-11-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5134137, KB5126646, KB5129235, KB5122871
+32 earlier KB5120233, KB5099536, KB5094125, KB5087539, KB5091157, KB5082063, KB5078740, KB5075899, KB5078135, KB5077793, KB5073379, KB5072033, KB5072359, KB5068861, KB5070881, KB5070773, KB5066835, KB5068221, KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5043080, KB5044284
Replaced by
KB5136489
VersionBuildChannel
2025 26100.33822 General availability

Security

628 vulnerabilities fixed
33 critical 594 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-116928
Windows Search Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-119958
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-118146
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-119969
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-109459
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-113862
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-116710
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-118737
Remote Procedure Call Runtime Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119951
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119952
Windows Schannel Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119961
Windows Internet Information Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119962
Windows CredSSP Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119963
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119964
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119967
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-113856
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-113865
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-119382
Windows TPM Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-119957
Windows Remote Desktop Services Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-125137
Windows Graphics Kernel Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-113749
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113752
Windows Print Spooler Components Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113825
Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113859
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113861
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-118145
Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-118148
Active Directory Domain Services Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-119947
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-119960
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-119966
Windows Graphics Kernel Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-125134
Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113860
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-113864
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 6.4
CVE-2026-111497
Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
 Not rated 8.1

The table lists the 34 exploited, publicly disclosed or critical vulnerabilities. See all 628 vulnerabilities →

Updated components

5,312 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings73
Networking41
Bluetooth36
Graphics and display36
Security and sign-in35
Hyper-V and virtualization30
Windows Update30
Audio28
Printing28
Storage and file systems26
Remote Desktop24
File Explorer and shell21

Page history

  1. Superseded by KB5136489

    Known issue resolved: Windows activation and licensing commands might fail with error 0x80041008 (KB5136489)

  2. New known issue: Windows activation and licensing commands might fail with error 0x80041008

    Added CVE-2026-111497 (No severity)

  3. Known issue resolved: Users might be unable to sign in to OWA or send emails on Exchange Server (KB5131080)

Sources

Updated
Cited passages from Microsoft's official notes (13)
  1. 1. [Certificates] Fixed: Device certificate enrollment might fail because some certificate handles did not persist and key-type flags were set incorrectly, causing keys to be managed improperly. support.microsoft.com
  2. 2. [Printing] Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, “The parameter is incorrect.” support.microsoft.com
  3. 3. [Remote Desktop] Fixed: The “Specify thumbprints of certificates representing trusted .rdp publishers” policy could not be configured successfully through Microsoft Intune. support.microsoft.com
  4. 4. [Remote Desktop Web Access] Fixed: RD Web Access might fail to load and display “Unable to display RD Web Access” in Microsoft Edge or Google Chrome when XSLT is disabled by browser policy. support.microsoft.com
  5. 5. [Windows Deployment Services] Fixed: After installing this security update, the Import-WdsInstallImage cmdlet requires administrator privileges. Attempts to run the cmdlet as a non-administrator fail with an ACCESS_DENIED error. support.microsoft.com
  6. 6. [Windows Setup] Fixed: An in-place upgrade from Windows Server 2016 to Windows Server 2025 might fail during the compatibility check when using installation media that includes the October 2026 update. support.microsoft.com
  7. 7. [Exchange Server] This update fixes an issue that affects on-premises Exchange servers. support.microsoft.com
  8. 8. [Date and Time] This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. support.microsoft.com
  9. 9. [Security] This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. support.microsoft.com
  10. 10. [Start menu] The HideRecommendedSection policy now applies to Windows 11 Enterprise multi-session, including Azure Virtual Desktop and ServerRDSH environments. support.microsoft.com
  11. 11. [Windows PowerShell] This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. support.microsoft.com
  12. 12. For workloads such as Exchange Server, the default limit of 512 simultaneous Endpoint Lookup calls might not be sufficient under heavy load. support.microsoft.com
  13. 13. After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 13 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake