The Update BureauKB5131085: Cumulative update for Windows 10, version 1809, November 2026. Cuba clock rules adjusted; printer and remote access failures fixed
In short
Cuba’s clock stays on UTC-04:00 through the 2026–2027 daylight-saving period, and the update fixes printer and remote access problems. It also includes security updates for Windows.
Does it affect you? Applies to: This update applies to Windows 10 Enterprise LTSC 2019, version 1809, on x86 and x64 devices. The resolved Exchange issue affects some on-premises Exchange servers running Windows Server 2019 and other listed Windows Server versions.
Microsoft publishes separate notes for this KB for Windows Server.
What changes
Fixes 7 changes
Printing
Verified in package
For: devices adding an Active Directory printer
-
Adding a printer published in Active Directory from Settings works again instead of failing with error 87. Existing printers and printing were generally unaffected.1
The issue affected Settings > Bluetooth & devices > Printers & scanners > Add device.
Windows Deployment Services
-
Importing a Windows deployment image now requires administrator privileges; attempts by non-administrators fail.2
After installing this security update, the
Import-WdsInstallImagecmdlet requires administrator privileges. Non-administrator attempts fail withACCESS_DENIED.
Remote Desktop Web Access
Verified in package
For: business users and IT administrators
-
RD Web Access pages load in Edge and Chrome when browser policy disables XSLT.3
RD Web Access pages are rendered on the server and no longer depend on browser XSLT support.
Remote Desktop
Verified in package
2 items
-
The policy for trusted Remote Desktop publisher certificates can be configured through Intune.4
The policy is “Specify thumbprints of certificates representing trusted .rdp publishers.”
-
Remote Desktop shadow connections no longer fail with an “Unspecified error” on Windows Server 2016 and Windows Server 2012 R2.5
The issue followed installation of the October 14, 2026 update.
USB audio
Verified in package
-
The remaining sound problems on USB Audio Class 1.0 devices are resolved by this update. KB5129238 resolved the 8-channel and 3D audio symptoms earlier.6
The remaining symptoms include Code 10 errors, no audio output, and unresponsive volume or sound settings.
Exchange Server
-
Some users can sign in to OWA and send email again after the issue affecting on-premises Exchange servers is resolved.7
The issue could also leave Outlook messages in the Outbox or affect mailbox replication. Affected platforms include Windows Server 2019.
Improvements 3 changes
Date and Time
For: devices using Cuba time-zone rules
-
Cuba stays on UTC-04:00 through the 2026–2027 daylight-saving period, without clock changes in November 2026 or March 2027. It returns to UTC-05:00 in November 2027.8
Cuba resumes its regular seasonal schedule in 2028.
Windows PowerShell
For: PowerShell script authors and IT administrators
-
PowerShell checks script signatures more strictly. Scripts with invalid UTF-8 encoding might fail validation, even if they passed before.9
Save affected scripts with valid UTF-8 encoding and a byte order mark (BOM), then sign them again.
Security
-
NTLM clients offer message signing by default for non-anonymous connections, helping reduce exposure to relay attacks.10
The change also provides auditing to identify connections that are not using signing.
Known issues
-
USB Audio Class 1.0 devices with error Code 10 or no output
Some USB Audio Class 1.0 devices might show Code 10, produce no sound, or have unresponsive volume controls or sound settings. KB5131085 resolves the remaining symptoms; KB5129238 resolved the 8-channel and 3D audio symptoms earlier.6
How to apply the workaround WorkaroundFor 8-channel or 3D audio problems, some customers reported restoring sound by switching to 2-channel mode.6
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-11-10
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5134124, KB5126651, KB5129238, KB5122876
- Replaced by
- KB5136490
| Version | Build | Channel |
|---|---|---|
| 1809 | 17763.9487 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Windows Xbox Live Networking Service Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Search Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Active Directory Domain Services Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Graphic Fonts Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Network Connected Devices Auto-Setup Service Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Remote Procedure Call Runtime Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Schannel Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Internet Information Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows CredSSP Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows TPM Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Graphics Kernel Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Print Spooler Components Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Active Directory Domain Services Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.0 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 6.4 |
|
Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
|
Not rated | 8.1 |
The table lists the 29 exploited, publicly disclosed or critical vulnerabilities. See all 523 vulnerabilities →
Downloads (Microsoft Update Catalog)
x64
1809
872.0 MB
x86
1809
510.2 MB
Updated components
2,652 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Audio | 31 |
| Bluetooth | 30 |
| Networking | 26 |
| Graphics and display | 18 |
| Storage and file systems | 18 |
| Security and sign-in | 15 |
| Printing | 14 |
| Secure Boot | 11 |
| File Explorer and shell | 10 |
| Hyper-V and virtualization | 8 |
| Remote Desktop | 8 |
| Search | 8 |
Verified in package: changed files confirm Printing, Remote Desktop Web Access, Remote Desktop, USB audio.
Page history
-
Superseded by KB5136490
-
Added CVE-2026-111497 (No severity)
-
Known issue resolved: USB Audio Class 1.0 devices with error Code 10 or no output (KB5129238)
Now also covers build 17763.9487 (1809)
Sources
Cited passages from Microsoft's official notes (10)
-
1.
Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, "The parameter is incorrect."
support.microsoft.com -
2.
After installing this security update, the Import-WdsInstallImage cmdlet requires administrator privileges. Attempts to run the cmdlet as a non-administrator fail with an ACCESS_DENIED error.
support.microsoft.com -
3.
RD Web Access pages are now rendered on the server and no longer depend on browser XSLT support.
support.microsoft.com -
4.
Fixed: The “Specify thumbprints of certificates representing trusted .rdp publishers” policy could not be configured successfully through Microsoft Intune.
support.microsoft.com -
5.
Fixed: Remote Desktop shadow connections might fail with an “Unspecified error” on Windows Server 2016 and Windows Server 2012 R2 after installing the October 14, 2026, update.
support.microsoft.com -
6.
The remaining symptoms are resolved in the Windows security update released on November 10, 2026 (KB5131085) and later updates.
learn.microsoft.com -
7.
This issue was resolved by Windows updates released November 10, 2026 (KB5131085), and updates released after that date.
learn.microsoft.com -
8.
Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.
support.microsoft.com -
9.
This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation.
support.microsoft.com -
10.
This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Nov 15, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake