Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Out-of-band update
Out-of-band

KB5134125

KB5134125: Cumulative update for Windows 10, versions 21H2 and 22H2, October 2026. Offline devices get updated certificate trust data

In short

Devices that miss automatic certificate updates get refreshed trust data in this out-of-band release. It also partly resolves USB audio problems with 8-channel and 3D audio.

Does it affect you? Applies to: This update is intended for Windows 10 devices that do not receive current certificate trust list updates. It applies to Windows 10 version 22H2 devices in the ESU program, and Windows 10 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 devices running version 21H2.

Builds
19044.7811 · 19045.7811
Restart
Required

What changes

Improvements 4 changes

Certificates

3 items
  • Devices that cannot receive certificate updates automatically get a refreshed list of trusted certificates.1
    For Windows 10 version 22H2 devices, the cumulative update includes an updated trusted root certificate payload for devices that cannot access Microsoft's certificate-update service or have automatic CTL updates disabled.
  • Devices that cannot receive certificate updates automatically get a refreshed list of trusted certificates.1
    For Windows 10 version 21H2 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 devices, the cumulative update includes an updated trusted root certificate payload for devices that cannot access Microsoft's certificate-update service or have automatic CTL updates disabled.
  • The release notes now link to details about certificate trust changes related to eMudhra.3
    The KB change log says it added a link to additional information about the Windows certificate trust changes related to eMudhra.

Servicing stack

  • The update process better checks whether a device is hosted on Azure, using updated security certificates.2
    The servicing stack update includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5129236

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might show Code 10, lose sound, have zero volume, or have unresponsive or unavailable sound settings. The September 14 OOB update partly resolves 8-channel and 3D audio problems.4

    How to apply the workaround Workaround

    Some customers restore sound for multichannel audio by switching to 2-channel mode. For other unresolved symptoms, IT administrators can contact Microsoft Support for Business.4

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-26
Classification
Updates
Type
Cumulative update
Restart
Required
Replaces
KB5126657, KB5129236, KB5122878, KB5120249
+41 earlier KB5099539, KB5094127, KB5087544, KB5082200, KB5078885, KB5075912, KB5078129, KB5077796, KB5073724, KB5074976, KB5071546, KB5068781, KB5066791, KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by
KB5131096
VersionBuildChannel
21H2 19044.7811 General availability
22H2 19045.7811 General availability

Security

No vulnerabilities are listed for this update.

Updated components

3,087 files changed since the previous update for the same versions.

Top changed componentsFiles
Networking48
Graphics and display43
Audio40
Remote Desktop39
Bluetooth36
Security and sign-in34
File Explorer and shell24
Settings21
Printing18
Storage and file systems18
Windows Update18
Hyper-V and virtualization17

Page history

  1. Known issue resolved: USB Audio Class 1.0 devices with error Code 10 or no output (KB5129236)

  2. Superseded by KB5131096

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. This update includes an updated trusted root certificate payload in the Windows cumulative update for devices that cannot access Microsoft’s certificate-update service and devices where automatic certificate trust list (CTL) updates are disabled. support.microsoft.com
  2. 2. This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. support.microsoft.com
  3. 3. Updated the release note to link to additional information about the Windows certificate trust changes related to eMudhra. support.microsoft.com
  4. 4. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake