Skip to the content
The Update Bureau
Windows 10 1607 Windows 10 1607 Security update
Patch Tuesday Final update for this version

KB5131291

KB5131291: Cumulative update for Windows 10, version 1607, November 2026. Message Queuing and Windows Search flaws patched

In short

Critical flaws in Message Queuing and Windows Search lead this release, alongside fixes for printing, Remote Desktop, and USB audio.

Does it affect you? Applies to: This update applies to Windows 10 Enterprise 2016 LTSB, version 1607. Support for this edition and Windows 10 IoT Enterprise 2016 LTSB ended October 13, 2026; eligible devices need ESU enrollment to continue receiving critical and important security updates.

Build
14393.9688
Security
453 fixed · 24 critical
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues KB5131291 resolves the remaining USB Audio Class 1.0 symptoms. KB5129239 had already addressed symptoms with 8-channel or 3D audio.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fixes 6 changes

Printing

For: Devices adding an Active Directory-published printer

  • Adding some printers published in Active Directory works again instead of failing with error 87. Existing printers and printing are not generally affected.1
    The failure can occur through Settings > Bluetooth & devices > Printers & scanners > Add device.

Windows Deployment Services

  • The Windows image import command now requires administrator rights. Running it without those rights fails with an access denied error.2
    The Import-WdsInstallImage cmdlet requires administrator privileges.

Remote Desktop

2 items
  • The certificate policy for trusted Remote Desktop publishers can be configured through Intune again.3
    Fixes configuration of the “Specify thumbprints of certificates representing trusted .rdp publishers” policy through Microsoft Intune.
  • Remote Desktop shadow connections work again on some older servers instead of failing with an unspecified error.4
    Applies to Windows Server 2016 and Windows Server 2012 R2 after installing the October 14, 2026, update.

Remote Desktop Web Access

  • RD Web Access pages load in Edge and Chrome even when browser policy disables XSLT.5
    RD Web Access pages are rendered on the server and no longer depend on browser XSLT support.

USB Audio Class 1.0 devices

  • The remaining Code 10, no-audio, and sound control problems on USB Audio Class 1.0 devices are resolved by KB5131291. KB5129239 already addressed symptoms with 8-channel or 3D audio.6
    The issue is limited to USB Audio Class 1.0 devices.

Improvements 3 changes

Date and Time

For: Devices using Cuba time settings

  • Cuba's daylight saving time rules now reflect its schedule through 2027.7
    Cuba remains on UTC-04:00 and skips the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.

Windows PowerShell

For: PowerShell users and IT administrators

  • PowerShell checks script signatures more strictly. Scripts with invalid UTF-8 encoding might fail validation, even if they passed before.8
    Review affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again.

Security

  • NTLM connections offer message signing by default when they are not anonymous. This helps reduce exposure to relay attacks.9
    The change also provides auditing to identify connections that are not using NTLM signing.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5129239

    USB Audio Class 1.0 devices with error Code 10 or no output

    The remaining problems with USB Audio Class 1.0 devices, including Code 10 errors or no audio, are resolved by KB5131291. Earlier, KB5129239 addressed symptoms when using 8-channel or 3D audio.6

    How to apply the workaround Workaround

    Some customers reported restoring audio in 8-channel or 3D audio modes by switching to 2-channel mode.6

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-11-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5134123, KB5126868, KB5129239, KB5123099
+26 earlier KB5120418, KB5099535, KB5094122, KB5087537, KB5091572, KB5082198, KB5078938, KB5075999, KB5073722, KB5074974, KB5071543, KB5068864, KB5066836, KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
VersionBuildChannel
1607 14393.9688 General availability

Security

453 vulnerabilities fixed
24 critical 429 important
VulnerabilitySeverityCVSS
CVE-2026-116928
Windows Search Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-119958
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-118146
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-119969
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-125136
Windows Network Connected Devices Auto-Setup Service Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-109459
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-113862
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-116710
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-118737
Remote Procedure Call Runtime Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119952
Windows Schannel Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119961
Windows Internet Information Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119962
Windows CredSSP Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119963
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119964
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119967
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119382
Windows TPM Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-113749
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113752
Windows Print Spooler Components Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113861
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-118145
Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-118148
Active Directory Domain Services Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-119947
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-125134
Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113864
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 6.4

The table lists the 24 exploited, publicly disclosed or critical vulnerabilities. See all 453 vulnerabilities →

Updated components

2,774 files changed since the previous update for the same versions.

Top changed componentsFiles
Networking35
Bluetooth24
Audio20
Graphics and display18
Storage and file systems18
Remote Desktop17
Printing12
Security and sign-in11
File Explorer and shell10
Kernel10
Secure Boot10
Windows Update10

Page history

  1. Known issue resolved: USB Audio Class 1.0 devices with error Code 10 or no output (KB5129239)

    Now also covers build 14393.9688 (1607)

Sources

Updated
Cited passages from Microsoft's official notes (9)
  1. 1. Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, "The parameter is incorrect." support.microsoft.com
  2. 2. Fixed: After installing this security update, the Import-WdsInstallImage cmdlet requires administrator privileges. support.microsoft.com
  3. 3. Fixed: The “Specify thumbprints of certificates representing trusted .rdp publishers” policy could not be configured successfully through Microsoft Intune. support.microsoft.com
  4. 4. Fixed: Remote Desktop shadow connections might fail with an “Unspecified error” on Windows Server 2016 and Windows Server 2012 R2 after installing the October 14, 2026, update. support.microsoft.com
  5. 5. RD Web Access pages are now rendered on the server and no longer depend on browser XSLT support. support.microsoft.com
  6. 6. The remaining symptoms are addressed in (KB5131291). support.microsoft.com
  7. 7. This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. support.microsoft.com
  8. 8. This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. support.microsoft.com
  9. 9. This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Nov 10, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake