The Update BureauKB5131087: Cumulative update for Windows 11, version 23H2, November 2026. NTLM signing defaults for non-anonymous connections
In short
NTLM clients offer message signing by default for non-anonymous connections, helping reduce relay risks. The update also fixes printer setup and a Remote Desktop policy issue.
Does it affect you? Applies to: Devices running Windows 11, version 23H2, on x64 or Arm64. The November 2026 update is the last update for Enterprise and Education editions.
Review notes Additional details from the official release notes (1) Read note
- What changes Devices that have not yet received newer Secure Boot certificates can still start and receive standard Windows updates. Microsoft continues delivering the certificates to eligible devices through Windows Update.
The official sources are linked at the end of the page.
What changes
Improvements 6 changes
Security updates
- Windows receives security improvements against vulnerabilities.1
Secure Boot
Gradual rollout
-
More eligible devices can receive newer Secure Boot certificates automatically over the coming months.2
Adds high-confidence device targeting data. Certificate deployment continues across supported PCs and non-managed business devices.
Security
-
NTLM connections are better protected against relay attacks.3
Clients offer NTLM message signing by default for non-anonymous connections. The change also provides auditing to identify connections that are not using signing.
Date and Time
For: Devices using Cuba's time zone
-
Cuba's clocks follow its extended daylight saving schedule for 2026–2027.4
Cuba remains on UTC-04:00 and skips the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.
Windows PowerShell
For: People and administrators using signed PowerShell scripts
-
PowerShell checks signed scripts more strictly, so some scripts with invalid encoding might fail validation.5
Stricter encoding validation can cause scripts with invalid UTF-8 encoding to fail signature validation, even if they were previously accepted. Microsoft advises saving affected scripts using valid UTF-8 encoding with a byte order mark (BOM), then signing them again.
Servicing stack
-
The component that installs Windows updates receives quality improvements.6
Includes servicing stack update KB5132696, version 22621.7698.
Fixes 2 changes
Printing
For: Devices adding printers published in Active Directory
-
Adding some printers through Settings works again instead of failing with an error.7
Fixes error 87 when adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device. The issue began with the October 2026 update and does not generally affect existing printers or printing.
Remote Desktop
For: IT administrators using Microsoft Intune
-
The trusted Remote Desktop publisher policy can be set through Intune again.8
Fixes configuration of the “Specify thumbprints of certificates representing trusted .rdp publishers” policy through Microsoft Intune.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-11-10
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5134130, KB5126653, KB5129242, KB5122880
+59 earlier
KB5120240, KB5099414, KB5093998, KB5087420, KB5082052, KB5078883, KB5075941, KB5078132, KB5077797, KB5073455, KB5071417, KB5070312, KB5068865, KB5067112, KB5066793, KB5065790, KB5065431, KB5064080, KB5066189, KB5063875, KB5062663, KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123 - Replaced by
- KB5136483
| Version | Build | Channel |
|---|---|---|
| 23H2 | 22631.7711 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Windows Xbox Live Networking Service Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Search Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Active Directory Domain Services Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Graphic Fonts Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Network Connected Devices Auto-Setup Service Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Remote Procedure Call Runtime Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Schannel Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Internet Information Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows CredSSP Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows TPM Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Graphics Kernel Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Print Spooler Components Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Active Directory Domain Services Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Graphics Kernel Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.0 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 6.4 |
|
Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
|
Not rated | 8.1 |
The table lists the 32 exploited, publicly disclosed or critical vulnerabilities. See all 575 vulnerabilities →
Downloads (Microsoft Update Catalog)
x64
23H2
1.1 GB
Arm64
23H2
1.2 GB
Updated components
3,028 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Bluetooth | 30 |
| Graphics and display | 30 |
| Networking | 26 |
| Windows Update | 26 |
| Audio | 23 |
| Storage and file systems | 22 |
| Remote Desktop | 19 |
| Security and sign-in | 18 |
| Hyper-V and virtualization | 16 |
| File Explorer and shell | 15 |
| Printing | 14 |
| Search | 12 |
Page history
-
Superseded by KB5136483
-
Added CVE-2026-111497 (No severity)
-
Now also covers build 22631.7711 (23H2)
Sources
Updated
Cited passages from Microsoft's official notes (8)
-
1.
This update provides security improvements.
support.microsoft.com -
2.
This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates.
support.microsoft.com -
3.
This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections.
support.microsoft.com -
4.
This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period.
support.microsoft.com -
5.
scripts containing invalid UTF-8 encoding might fail signature validation, even if they were previously accepted.
support.microsoft.com -
6.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com -
7.
Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, “The parameter is incorrect.”
support.microsoft.com -
8.
Fixed: The “Specify thumbprints of certificates representing trusted .rdp publishers” policy could not be configured successfully through Microsoft Intune.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Nov 10, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 4/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake