KB5134140: Cumulative update for Windows Server, version 2022, October 2026. Root certificates updated for isolated servers; Exchange mail can fail

An updated trusted root certificate list helps servers that cannot reach Microsoft's certificate service. Some on-premises Exchange servers might also have trouble with sign-in and mail delivery.

Does it affect you? Applies to: Windows Server 2022 devices that do not receive current certificate trust list updates, such as servers in disconnected environments or with automatic updates disabled.

What changes

Improvements 2 changes

Certificates

For: Devices unable to receive current CTL updates

Servers that cannot get certificate updates from Microsoft receive an updated list of trusted root certificates.¹
The cumulative update includes an updated trusted root certificate payload for devices that cannot access Microsoft’s certificate-update service or have automatic CTL updates disabled.

Servicing stack

For: Windows Server 2022 devices

The component that installs Windows updates gets quality improvements.²
Includes servicing stack update KB5126654, build 20348.5739.

Known issues

Resolved Affects: Organizations and IT administrators Resolved by KB5131090

Users might be unable to sign in to OWA or send emails on Exchange Server

Some on-premises Exchange servers might have trouble with Outlook on the web sign-in, email delivery, or mailbox replication after this update.³

How to apply the workaround Registry / GPO

A registry change can temporarily reduce the problem by raising the limit on simultaneous Endpoint Lookup calls. Microsoft Support can provide another mitigation.³
Open Affects: Organizations and IT administrators

Windows Server Update Services (WSUS) does not display error details

WSUS does not show synchronization error details. This function was temporarily removed in KB5070884 and later updates to address CVE-2025-59287.⁴

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-10-26
Classification: Updates
Type: Cumulative update
Restart: Required
Replaces: KB5126655, KB5129237, KB5122882, KB5120242

+43 earlier
KB5099540, KB5094128, KB5087545, KB5091575, KB5082142, KB5078766, KB5082314, KB5075906, KB5078136, KB5077800, KB5073457, KB5071547, KB5068787, KB5070884, KB5066782, KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by: KB5131090

Version	Build	Channel
2022	20348.5773	General availability

Security

No vulnerabilities are listed for this update.

Downloads (Microsoft Update Catalog)

x64 2022

639.7 MB

windows10.0-kb5134140-x64.msu Main update · KB5134140 SHA-1: eaa8859f…f5c86b

Updated components

270 files changed since the previous update for the same versions.

Top changed components	Files
Hyper-V and virtualization	3
Kernel	2
Secure Boot	2
Security and sign-in	2
File Explorer and shell	1
Graphics and display	1
Printing	1
Remote Desktop	1

Page history

Nov 12, 2026

Known issue resolved: Users might be unable to sign in to OWA or send emails on Exchange Server (KB5131090)
Nov 11, 2026

Superseded by KB5131090

Sources

Microsoft Support: KB5134140

Updated Nov 12, 2026

Cited passages from Microsoft's official notes (4)

1. This update includes an updated trusted root certificate payload in the Windows cumulative update for devices that cannot access Microsoft’s certificate-update service and devices where automatic certificate trust list (CTL) updates are disabled. support.microsoft.com
2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
3. The October 2026 update introduced a default limit on the amount of memory used by Endpoint Mapper when handling Endpoint Lookup calls. support.microsoft.com
4. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Nov 15, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake