Skip to the content
The Update Bureau
Windows 11 24H2 / 25H2 / 26H2 Windows 11 24H2 / 25H2 / 26H2 Security update
Patch Tuesday

KB5132061

KB5132061: Cumulative update for Windows 11, versions 24H2, 25H2 and 26H2, November 2026. Remote Desktop and USB audio fixes; NTLM signing strengthened

In short

Remote Desktop connections and some USB audio devices get fixes, while NTLM signing is enabled by default for more connections. The update also closes a publicly disclosed Brotli decoder flaw.

Does it affect you? Applies to: This update applies to Windows 11 versions 25H2 and 26H2, all editions, and version 24H2 Enterprise and Education editions. Version 24H2 Home and Pro are not listed as eligible editions.

Builds
26100.9974 · 26200.9974 · 26300.9974
Security
595 fixed · 34 critical
Restart
Required

What changes

Improvements 7 changes

Security updates

  • The update includes security fixes for Windows.1

Secure Boot

Gradual rollout Verified in package
  • More eligible devices can receive newer Secure Boot certificates automatically.2
    Certificate deployment continues through Windows Update on supported PCs and non-managed business devices.

Security

  • More connections use message signing by default, helping reduce exposure to relay attacks.3
    Clients offer NTLM message signing by default for non-anonymous connections. The change also provides auditing for connections that do not use signing.

Date and Time

For: devices using Cuba time-zone rules

  • Cuba's clocks follow its extended daylight-saving schedule for 2026–2027.4
    Cuba remains on UTC-04:00 and skips the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.

Windows PowerShell

For: people using signed PowerShell scripts

  • PowerShell checks signed scripts more strictly. Scripts with invalid text encoding might fail signature checks.5
    Scripts that fail validation should be saved with valid UTF-8 encoding and a byte order mark (BOM), then signed again.

AI components

Verified in package

For: Copilot+ PCs

  • Four AI components receive an updated version.6
    Image Search, Content Extraction, Semantic Analysis, and Settings Model update to version 1.2610.1063.0. These components apply only to Copilot+ PCs.

Servicing stack update

  • An included update improves the reliability of installing Windows updates.7
    The cumulative update includes KB5132688, build 26100.9971.

Fixes 5 changes

Audio

Verified in package 2 items
  • Some USB audio devices can start again instead of showing an error or producing no sound.8
    Fixes USB Audio 1.0 devices that might fail to start and display error code 10 in Device Manager.
  • HDMI and DisplayPort audio playback works again on certain AMD graphics cards.11

Printing

Verified in package

For: devices adding Active Directory-published printers

  • Adding a printer shared through Active Directory no longer fails with error 87 in the listed Settings flow.9
    The issue affects adding a printer through Settings > Bluetooth & devices > Printers & scanners > Add device. It does not generally affect existing printers or printing.

Remote Desktop

Verified in package 2 items
  • Remote Desktop connections are less likely to fail because of a certificate mismatch.10
    Addresses client RDP connection failures due to a certificate mismatch after the October 2026 non-security preview update.
  • Non-admin users can connect to affected remote devices again instead of receiving error 0xC000000D.12
    The issue affected enterprise-managed Remote Desktop hosts with Administrator protection enabled.

Known issues

  1. Open Affects: Everyone

    November security update might fail to install on some devices

    Some devices might repeatedly try to install the November security update or show error 0x80070306, 0x800f0989, or 0x800f0993.13

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-11-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5127936, KB5134133, KB5127648, KB5124010
+65 earlier KB5129195, KB5124008, KB5120998, KB5121003, KB5101684, KB5121767, KB5101650, KB5095093, KB5094126, KB5089573, KB5089549, KB5083631, KB5083769, KB5086672, KB5079391, KB5085516, KB5079473, KB5077241, KB5077181, KB5074105, KB5078127, KB5077744, KB5074109, KB5072033, KB5070311, KB5068861, KB5067036, KB5070773, KB5066835, KB5065789, KB5068221, KB5065426, KB5064081, KB5063878, KB5062660, KB5064489, KB5062553, KB5060829, KB5063060, KB5060842, KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
VersionBuildChannel
24H2 26100.9974 General availability
25H2 26200.9974 General availability
26H2 26300.9974 General availability

Security

595 vulnerabilities fixed
34 critical 561 important
VulnerabilitySeverityCVSS
CVE-2026-112967
Windows Xbox Live Networking Service Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-116928
Windows Search Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-119958
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-118146
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-119969
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-125136
Windows Network Connected Devices Auto-Setup Service Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-109459
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-111497
Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
 Critical 8.1
CVE-2026-113862
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-116710
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-118737
Remote Procedure Call Runtime Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119952
Windows Schannel Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119961
Windows Internet Information Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119962
Windows CredSSP Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119963
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119964
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119967
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-113856
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-113865
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-119382
Windows TPM Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-125137
Windows Graphics Kernel Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-113749
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113752
Windows Print Spooler Components Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113825
Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113859
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113861
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-118145
Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-118148
Active Directory Domain Services Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-119947
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-119960
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-119966
Windows Graphics Kernel Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-125134
Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113860
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-113864
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 6.4

The table lists the 34 exploited, publicly disclosed or critical vulnerabilities. See all 595 vulnerabilities →

Updated components

3,455 files changed since the previous update for the same versions.

Top changed componentsFiles
Networking36
Bluetooth34
Graphics and display30
Windows Update28
Audio27
Storage and file systems26
Printing24
Remote Desktop22
Security and sign-in20
File Explorer and shell19
Hyper-V and virtualization17
Search14

Verified in package: changed files confirm Secure Boot, AI components, Audio, Printing, Remote Desktop.

Page history

  1. New known issue: November security update might fail to install on some devices

    Added CVE-2026-111497 (Critical)

Sources

Updated
Cited passages from Microsoft's official notes (13)
  1. 1. This update provides security improvements. support.microsoft.com
  2. 2. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  3. 3. This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. support.microsoft.com
  4. 4. This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. support.microsoft.com
  5. 5. This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. support.microsoft.com
  6. 6. This release updates the following AI components to version 1.2610.1063.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model. support.microsoft.com
  7. 7. This Windows update includes KB5132688 (Build 26100.9971), which improves the reliability of the Windows update installation process. support.microsoft.com
  8. 8. Fixed: USB Audio 1.0 devices might fail to start and display error code 10 in Device Manager after installing a recent security update. support.microsoft.com
  9. 9. Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, “The parameter is incorrect.” support.microsoft.com
  10. 10. This update addresses an issue where Remote Desktop Protocol (RDP) connections might fail on the client due to a certificate mismatch after the October 2026 non-security preview update. support.microsoft.com
  11. 11. This update fixes an issue where HDMI and DisplayPort audio playback might fail on certain AMD graphics cards. support.microsoft.com
  12. 12. This issue was resolved by Windows updates released November 10, 2026 (KB5132061), and later. learn.microsoft.com
  13. 13. Affected devices might repeatedly attempt to install the update or display error code 0x80070306, 0x800f0989, or 0x800f0993. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 13 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake