Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday

KB5131096

KB5131096: Cumulative update for Windows 10, versions 21H2 and 22H2, November 2026. PowerShell rejects some invalidly encoded signed scripts

In short

Stricter PowerShell signature checks might reject signed scripts with invalid UTF-8 encoding. The update also fixes printer setup and Remote Desktop problems.

Does it affect you? Applies to: Windows 10 version 22H2 devices enrolled in ESU, and Windows 10 Enterprise LTSC 2021 or IoT Enterprise LTSC 2021 devices running version 21H2. Commercial version 22H2 devices need an ESU Year 2 license.

Builds
19044.7846 · 19045.7846
Security
547 fixed · 30 critical
Restart
Required

What changes

Improvements 4 changes

Date and Time

For: Devices using Cuba time

  • Cuba stays on UTC-04:00 and skips the November 2026 and March 2027 clock changes. It returns to UTC-05:00 in November 2027 and resumes its regular schedule in 2028.1
    Adjusts daylight saving time rules for Cuba during the extended 2026–2027 period.

Windows PowerShell

For: People who sign PowerShell scripts

  • Some signed PowerShell scripts with invalid UTF-8 encoding might fail signature checks. Save affected scripts as valid UTF-8 with a BOM, then sign them again.2
    Introduces stricter encoding validation for PowerShell script signing and signature verification.

Servicing stack

2 items
  • The latest servicing stack update comes bundled with the cumulative update.3
    The servicing stack update (SSU) is combined with the latest cumulative update (LCU).
  • The servicing stack update adds checks to confirm whether a device is hosted on Azure.4
    The SSU uses an updated certificate chain to verify whether a device is hosted on Azure.

Fixes 3 changes

Printing

For: People adding printers published in Active Directory

  • Adding a printer published in Active Directory no longer fails in some cases. Existing printers and printing are not generally affected.5
    Fixes error 87, “The parameter is incorrect,” when adding a printer through Settings > Bluetooth & devices > Printers & scanners > Add device. The issue was introduced by the October 2026 update.

Remote Desktop

2 items
  • The trusted Remote Desktop publisher policy can be configured through Intune again.6
    Fixes configuration of the “Specify thumbprints of certificates representing trusted .rdp publishers” policy through Microsoft Intune.
  • Remote Desktop shadow connections work again in cases where they failed with an “Unspecified error.”7
    Fixes shadow connection failures on Windows Server 2016 and Windows Server 2012 R2 after installing the October 14, 2026 update.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5131085

    USB Audio Class 1.0 devices with error Code 10 or no output

    After the September 8, 2026 security update, some USB Audio Class 1.0 devices might show Code 10, produce no audio, or have unresponsive sound controls. The September 14 out-of-band update fixes symptoms with 8-channel or 3D audio; other symptoms remain.8

    How to apply the workaround Workaround

    For multichannel audio problems, some customers restore sound by switching to 2-channel mode. IT administrators can contact Microsoft Support for Business about symptoms not fixed by the out-of-band update.8

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-11-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5134125, KB5126657, KB5129236, KB5122878
+42 earlier KB5120249, KB5099539, KB5094127, KB5087544, KB5082200, KB5078885, KB5075912, KB5078129, KB5077796, KB5073724, KB5074976, KB5071546, KB5068781, KB5066791, KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by
KB5136493
VersionBuildChannel
21H2 19044.7846 General availability
22H2 19045.7846 General availability

Security

547 vulnerabilities fixed
30 critical 516 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-112967
Windows Xbox Live Networking Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-116928
Windows Search Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-119958
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-118146
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-119969
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-125136
Windows Network Connected Devices Auto-Setup Service Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-109459
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-113862
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-116710
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-118737
Remote Procedure Call Runtime Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119952
Windows Schannel Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119961
Windows Internet Information Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119962
Windows CredSSP Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119963
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119964
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119967
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-113856
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-113865
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-119382
Windows TPM Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-125137
Windows Graphics Kernel Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-113749
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113752
Windows Print Spooler Components Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113825
Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113861
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-118145
Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-118148
Active Directory Domain Services Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-119947
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-125134
Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113860
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-113864
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 6.4
CVE-2026-111497
Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
 Not rated 8.1

The table lists the 31 exploited, publicly disclosed or critical vulnerabilities. See all 547 vulnerabilities →

Updated components

4,100 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display48
Bluetooth45
Networking44
Audio43
Storage and file systems34
File Explorer and shell24
Security and sign-in24
Remote Desktop23
Printing22
Windows Update18
Search17
Emoji and input15

Page history

  1. Superseded by KB5136493

    Known issue resolved: Windows activation and licensing commands might fail with error 0x80041008 (KB5136493)

  2. New known issue: Windows activation and licensing commands might fail with error 0x80041008

    Added CVE-2026-111497 (No severity)

  3. Known issue resolved: USB Audio Class 1.0 devices with error Code 10 or no output (KB5129236)

    Now also covers build 19044.7846 (21H2)

    Now also covers build 19045.7846 (22H2)

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. support.microsoft.com
  2. 2. This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. support.microsoft.com
  3. 3. Microsoft now combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). support.microsoft.com
  4. 4. This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. support.microsoft.com
  5. 5. Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, "The parameter is incorrect." support.microsoft.com
  6. 6. Fixed: The “Specify thumbprints of certificates representing trusted .rdp publishers” policy could not be configured successfully through Microsoft Intune. support.microsoft.com
  7. 7. Fixed: Remote Desktop shadow connections might fail with an “Unspecified error” on Windows Server 2016 and Windows Server 2012 R2 after installing the October 14, 2026, update. support.microsoft.com
  8. 8. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake