The Update BureauKB5131090: Cumulative update for Windows Server, version 2022, November 2026. Critical Windows Search remote-code flaw patched
A critical Windows Search flaw and other serious security bugs get fixes, alongside Exchange, printer, and Remote Desktop repairs. Some Exchange and WSUS problems remain open.
Does it affect you? Applies to: Devices running Windows Server 2022, x64. The update includes a servicing stack update.
Review notes Additional details from the official release notes (1) Read note
- Known issues Microsoft describes a temporary mitigation that modifies a registry key to increase Endpoint Mapper's maximum number of simultaneous Endpoint Lookup calls.
The official sources are linked at the end of the page.
What changes
Fixes 5 changes
Exchange Server
-
An issue that could block Outlook on the web sign-ins, delay email delivery, or disrupt mailbox replication on on-premises Exchange servers is addressed.1
The update page says this issue is fixed; the same page lists related Exchange symptoms as a known issue.
Printing
For: Devices adding printers published in Active Directory
-
Adding a printer published in Active Directory works again instead of failing with error 87.2
The failure occurred through Settings > Bluetooth & devices > Printers & scanners > Add device. The issue began with the October 2026 update and does not generally affect existing printers or printing.
Remote Desktop
For: IT administrators using Microsoft Intune
-
The policy for trusted Remote Desktop publisher certificates can be configured through Microsoft Intune.3
Fixes configuration of the “Specify thumbprints of certificates representing trusted .rdp publishers” policy through Microsoft Intune.
Remote Desktop Web Access
For: Users of RD Web Access in Microsoft Edge or Google Chrome
-
RD Web Access pages load in Edge and Chrome when browser policy disables XSLT.4
RD Web Access pages are rendered on the server and no longer depend on browser XSLT support.
Windows Deployment Services
For: IT administrators using Windows Deployment Services
-
The Import-WdsInstallImage command works for administrators; non-administrator attempts fail with an access-denied error.5
After installing this security update, the Import-WdsInstallImage cmdlet requires administrator privileges.
Improvements 4 changes
Date and Time
For: Devices using Cuba time settings
-
Cuba's daylight saving time schedule is adjusted for the extended 2026–2027 period.6
Cuba remains on UTC-04:00 and skips the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.
Security
-
NTLM connections get stronger protection against relay attacks, with auditing to help identify connections that lack signing.7
Clients offer NTLM message signing by default for non-anonymous connections.
Windows PowerShell
For: PowerShell users and IT administrators
-
PowerShell scripts with invalid UTF-8 encoding might fail signature checks, even if they passed before.8
Stricter encoding validation applies to script signing and signature verification. Microsoft advises saving affected scripts with valid UTF-8 encoding and a byte order mark (BOM), then signing them again.
Servicing stack
For: All devices receiving this update
-
The component that installs Windows updates gets quality improvements.9
Includes servicing stack update KB5131089, version 20348.5859.
Known issues
-
Users might be unable to sign in to OWA or send emails on Exchange Server
Some on-premises Exchange servers might block OWA sign-ins, leave sent messages in Outlook's Outbox, or have trouble accessing mailboxes during replication. Affected servers might also show Event ID 1006 or growing email queues.10
How to apply the workaround Registry / GPOTemporarily raise Endpoint Mapper's limit for simultaneous calls using the registry setting described in Microsoft's Exchange guidance.10
-
Windows Server Update Services (WSUS) does not display error details
WSUS does not show synchronization error details after KB5070884 or later updates. Microsoft temporarily removed this feature to address CVE-2025-59287.11
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-11-10
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5134140, KB5126655, KB5129237, KB5122882
+44 earlier
KB5120242, KB5099540, KB5094128, KB5087545, KB5091575, KB5082142, KB5078766, KB5082314, KB5075906, KB5078136, KB5077800, KB5073457, KB5071547, KB5068787, KB5070884, KB5066782, KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129 - Replaced by
- KB5136487
| Version | Build | Channel |
|---|---|---|
| 2022 | 20348.5870 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Windows Search Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Active Directory Domain Services Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Graphic Fonts Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Remote Procedure Call Runtime Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Deployment Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Schannel Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Internet Information Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows CredSSP Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows TPM Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Remote Desktop Services Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Graphics Kernel Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Print Spooler Components Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Active Directory Domain Services Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.0 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 6.4 |
|
Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
|
Not rated | 8.1 |
The table lists the 31 exploited, publicly disclosed or critical vulnerabilities. See all 593 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
1,411 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Storage and file systems | 12 |
| Audio | 11 |
| Bluetooth | 11 |
| Graphics and display | 11 |
| Networking | 11 |
| Hyper-V and virtualization | 10 |
| Security and sign-in | 9 |
| File Explorer and shell | 8 |
| Printing | 8 |
| Kernel | 6 |
| Remote Desktop | 6 |
| Secure Boot | 6 |
Page history
-
Superseded by KB5136487
Known issue resolved: Windows activation and licensing commands might fail with error 0x80041008 (KB5136487)
-
New known issue: Windows activation and licensing commands might fail with error 0x80041008
Added CVE-2026-111497 (No severity)
-
Known issue resolved: Users might be unable to sign in to OWA or send emails on Exchange Server (KB5131090)
Now also covers build 20348.5870 (2022)
Sources
Cited passages from Microsoft's official notes (11)
-
1.
This update fixes an issue that affects on-premises Exchange servers.
support.microsoft.com -
2.
Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, “The parameter is incorrect.”
support.microsoft.com -
3.
Fixed: The “Specify thumbprints of certificates representing trusted .rdp publishers” policy could not be configured successfully through Microsoft Intune.
support.microsoft.com -
4.
RD Web Access pages are now rendered on the server and no longer depend on browser XSLT support.
support.microsoft.com -
5.
After installing this security update, the Import-WdsInstallImage cmdlet requires administrator privileges.
support.microsoft.com -
6.
This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period.
support.microsoft.com -
7.
This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections.
support.microsoft.com -
8.
This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation.
support.microsoft.com -
9.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com -
10.
For workloads such as Exchange Server, the default limit of 512 simultaneous Endpoint Lookup calls might not be sufficient under heavy load.
support.microsoft.com -
11.
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 11 quoted passages · compared with Microsoft's page on Nov 15, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake