Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Out-of-band update
Out-of-band

KB5134137

KB5134137: Cumulative update for Windows Server, version 2025, October 2026. Offline servers get updated trusted root certificates

In short

Devices that cannot reach Microsoft's certificate-update service get an updated trusted root certificate payload. Hotpatch-enrolled devices that install this update will not receive hotpatch updates until after they install the January 2027 baseline.

Does it affect you? Applies to: This update is intended for Windows Server 2025 devices that do not receive current certificate trust list updates. Examples include disconnected devices, devices that cannot access Microsoft's certificate-update service, and devices with automatic CTL updates disabled.

Build
26100.33674
Restart
Required

What changes

Improvements 2 changes

Certificates

For: Devices that do not receive current CTL updates

  • Devices that cannot get certificate list updates receive an updated set of trusted root certificates.1
    The update includes an updated trusted root certificate payload for devices that cannot access Microsoft's certificate-update service or have automatic certificate trust list (CTL) updates disabled.

Servicing stack

For: Windows Server 2025 devices

  • The component that installs Windows updates gets quality improvements.2
    The servicing stack update is KB5126645, build 26100.33634.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5131080

    Users might be unable to sign in to OWA or send emails on Exchange Server

    Some on-premises Exchange servers might block OWA sign-ins or leave sent messages in the Outbox. KB5131080 resolves this issue.3

    Resolution Fixed in KB5131080

    Install KB5131080 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not show synchronization error details after KB5070881 or later updates. Microsoft says this function is temporarily removed to address CVE-2025-59287.4

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Resolved Affects: Everyone Resolved by KB5129235

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might show Code 10 or have no sound. KB5129235 addresses 8-channel or 3D audio symptoms; KB5131080 addresses the remaining symptoms.5

    Resolution Fixed in KB5129235

    Install KB5129235 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-26
Classification
Updates
Type
Cumulative update
Restart
Required
Replaces
KB5126646, KB5129235, KB5122871, KB5120233
+31 earlier KB5099536, KB5094125, KB5087539, KB5091157, KB5082063, KB5078740, KB5075899, KB5078135, KB5077793, KB5073379, KB5072033, KB5072359, KB5068861, KB5070881, KB5070773, KB5066835, KB5068221, KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5044284, KB5043080
Replaced by
KB5131080
VersionBuildChannel
2025 26100.33674 General availability

Security

No vulnerabilities are listed for this update.

Updated components

32 files changed since the previous update for the same versions.

Top changed componentsFiles
Security and sign-in4

Page history

  1. Known issue resolved: Users might be unable to sign in to OWA or send emails on Exchange Server (KB5131080)

    New known issue: USB Audio Class 1.0 devices with error Code 10 or no output

  2. Superseded by KB5131080

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. This update includes an updated trusted root certificate payload in the Windows cumulative update for devices that cannot access Microsoft’s certificate-update service and devices where automatic certificate trust list (CTL) updates are disabled. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. This issue is resolved in Windows updates released on and after November 10, 2026 such as (KB5131080). support.microsoft.com
  4. 4. After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
  5. 5. The symptoms experienced on devices using 8-channel or 3D audio modes are addressed in the out-of-band (OOB) update released on September 14, 2026, (KB5129235). The remaining symptoms are addressed in (KB5131080). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake