Skip to the content
The Update Bureau

Monthly Patch Briefing

October 2026

76 updates released this month .

Updates, page 2

Updates, page 2:
  • Windows 11 · 26H2
    Windows 11 Windows 11 Insider 26H2 Insider Preview
    Experimental Channel
    Build 26340.9750

    Gaming controls, passwordless sign-in, and Windows Hello brightness

    Adds easier-to-reach gaming controls, expands passwordless web sign-in to hybrid-joined devices, and can brighten the screen for Windows Hello. It also includes File Explorer, Search, Run, and shutdown changes.

    Changes 2 new · 6 improved · 3 fixes
  • Windows 11 · 25H2
    Windows 11 Windows 11 Insider 25H2 Insider Preview
    Beta Channel
    Build 26220.9739

    Independent Magnifier views and easier gaming controls

    Adds independent Magnifier zoom and screen locking, refreshes Gaming Task View controls, and includes changes to Settings, File Explorer, family safety, and shutdown reliability.

    Changes 3 new · 4 improved · 1 fix
  • Windows 11 · 24H2, 25H2, 26H2
    Windows 11 24H2 / 25H2 / 26H2 Windows 11 24H2 / 25H2 / 26H2 Security update
    Zero-day Final update for this version Final update for this version Updated
    KB5127648

    Exploited Shell bypass addressed; 24H2 Home and Pro reach end of updates

    Addresses an actively exploited Windows Shell security feature bypass and fixes several problems, including Explorer startup failures and game input stuttering. It is the final update for 24H2 Home and Pro.

    Builds 26100.9711 26200.9711 26300.9711
    Security 1,067 CVEs 25 critical 1 exploited
    Replaced by KB5134133 →
  • Windows 11 · 26H1
    Windows 11 26H1 Windows 11 26H1 Security update
    Zero-day Updated
    KB5127646

    Exploited Windows Shell bypass patched; Explorer crashes fixed

    Attackers are exploiting a Windows Shell security bypass, and the update fixes Explorer crashes after sign-in on some multi-user systems.

    Build 28000.3231
    Security 1,055 CVEs 25 critical 1 exploited
    Replaced by KB5134134 →
  • Windows 11 · 23H2
    Windows 11 23H2 Windows 11 23H2 Security update
    Zero-day Updated
    KB5126653

    Exploited Windows Shell bypass flaw addressed; File History issue addressed

    An actively exploited Windows Shell security-feature bypass is addressed. The update also addresses File History backup and restore failures.

    Build 22631.7652
    Security 1,021 CVEs 25 critical 1 exploited
    Replaced by KB5134130 →
  • Windows 10 · 21H2, 22H2
    Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
    Zero-day Updated
    KB5126657

    Windows Shell flaw under active attack gets patched

    An actively exploited Windows Shell security-feature bypass gets patched, alongside changes to time zones, ReFS security, storage, and File History.

    Builds 19044.7807 19045.7807
    Security 954 CVEs 22 critical 1 exploited
    Replaced by KB5134125 →
  • Windows 10 · 1809
    Windows 10 1809 Windows 10 1809 Security update Also for Windows Server
    Zero-day Updated
    KB5126651

    Windows Shell exploit covered; BitLocker access restored

    An exploited Windows Shell security bypass is covered, and older systems can access drives encrypted on newer systems again. The update also addresses File History and Storage Spaces problems.

    Build 17763.9376
    Security 946 CVEs 24 critical 1 exploited
    Replaced by KB5134124 →
  • Windows 10 · 1607
    Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    Zero-day Updated
    KB5126868

    Actively exploited Windows Shell flaw patched; storage issues addressed

    An actively exploited Windows Shell flaw is patched, alongside fixes for File History and offline Storage Spaces Direct disks. Free support for these 2016 LTSB editions ends on release day.

    Build 14393.9612
    Security 748 CVEs 20 critical 1 exploited
    Replaced by KB5134123 →
  • Windows Server · 2025
    Windows Server 2025 Windows Server 2025 Security update
    Zero-day Updated
    KB5126646

    Exploited Windows Shell flaw patched; server recovery feature added

    An actively exploited Windows Shell security-feature bypass is patched. Windows Server 2025 also gains Quick machine recovery, which is off by default.

    Build 26100.33650
    Security 1,098 CVEs 35 critical 1 exploited
    Known issues 2 open
    Replaced by KB5134137 →
  • Windows Server · 2022
    Windows Server 2022 Windows Server 2022 Security update
    Zero-day Updated
    KB5126655

    Exploited Shell flaw patched; Exchange mail issues mitigated

    An exploited Windows Shell security bypass is addressed. Some Exchange servers may still have sign-in and email delivery problems, with a temporary mitigation available.

    Build 20348.5761
    Security 1,034 CVEs 33 critical 1 exploited
    Known issues 1 open
    Replaced by KB5134140 →
  • Windows Server · 2019
    Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    Zero-day Updated
    KB5126651

    Actively exploited Windows Shell flaw patched; Exchange issue mitigated

    An actively exploited Windows Shell security bypass is patched. Exchange users might still have sign-in and email problems, but a registry mitigation is available.

    Build 17763.9376
    Security 970 CVEs 30 critical 1 exploited
    Replaced by KB5134124 →
  • Windows Server · 2016
    Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    Zero-day Updated
    KB5126868

    Windows Shell flaw exploited; Exchange email issues remain

    An actively exploited Windows Shell security-bypass flaw is addressed, while some on-premises Exchange servers still face email failures despite a temporary mitigation.

    Build 14393.9612
    Security 767 CVEs 26 critical 1 exploited
    Replaced by KB5134123 →
  • Exchange Server · RTM
    Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
    Updated
    KB5128895

    Critical remote-code-execution flaw patched; calendar feeds restored

    The update fixes a Critical remote-code-execution vulnerability and restores published calendar feeds and Korean-language search processing affected by earlier updates.

    Build 15.2.2562.56
    Security 6 CVEs 1 critical
    Replaced by KB5133453 →
  • Exchange Server · CU15
    Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update
    Final update for this version Final update for this version
    KB5128896

    Critical remote-code flaw patched; calendar feeds restored

    Fixes a critical Exchange Server remote-code execution vulnerability and restores published calendar subscriptions that returned HTTP 500 errors.

    Build 15.2.1748.55
    Security 6 CVEs 1 critical
  • Exchange Server · CU14
    Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update
    Final update for this version Final update for this version
    KB5128897

    Remote-code-execution flaw patched; published calendar errors fixed

    Addresses six Exchange Server vulnerabilities, including one critical flaw, and resolves HTTP 500 errors affecting published calendar subscriptions. It is available only to organizations enrolled in the Extended Security Update program.

    Build 15.2.1544.50
    Security 6 CVEs 1 critical
  • Exchange Server · CU23
    Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
    Final update for this version Final update for this version
    KB5128898

    Critical remote-code flaw and published-calendar errors addressed

    Fixes six Exchange Server vulnerabilities, including one critical remote-code-execution flaw, and resolves an issue that stopped published calendar subscriptions from refreshing. It is available only to organizations enrolled in the Extended Security Update program.

    Build 15.1.2507.77
    Security 6 CVEs 1 critical
  • SQL Server · CU9 + GDR
    SQL Server 2025 CU9 + GDR SQL Server 2025 CU9 + GDR Security update
    Updated
    KB5126967

    Backup and PolyBase flaws fixed; recovery queries can crash

    Security fixes cover SQL Server components used for backup, PolyBase, and replication. Queries during database recovery can still trigger an access violation; a trace-flag mitigation is available.

    Build 17.0.5015.4
    Security 24 CVEs
    Known issues 2 open
    Replaced by KB5129299 →
  • SQL Server · GDR
    SQL Server 2025 GDR SQL Server 2025 GDR Security update
    Updated
    KB5128492

    23 SQL vulnerabilities addressed; MSDASQL linked queries still fail

    Addresses 23 SQL Server vulnerabilities, including 22 rated Important. Linked server queries using MSDASQL can still fail with error 7416 in some configurations.

    Build 17.0.1145.4
    Security 23 CVEs
    Known issues 1 open
    Replaced by KB5132748 →
  • SQL Server · CU27 + GDR
    SQL Server 2022 CU27 + GDR SQL Server 2022 CU27 + GDR Security update
    Updated
    KB5126934

    Recovery queries may raise access violations; security flaws fixed

    Security fixes cover SQL Server components. Queries against `sys.dm_exec_requests` during database recovery might raise an access violation and create a dump file.

    Build 16.0.4305.5
    Security 23 CVEs
    Known issues 2 open
    Replaced by KB5129300 →
  • SQL Server · GDR
    SQL Server 2022 GDR SQL Server 2022 GDR Security update
    Updated
    KB5128493

    PolyBase security flaws addressed; linked server queries can fail

    Fixes 22 Important SQL Server vulnerabilities. Linked server queries using MSDASQL and a provider string might fail with error 7416.

    Build 16.0.1210.3
    Security 22 CVEs
    Known issues 1 open
    Replaced by KB5132747 →
  • SQL Server · CU32 + GDR
    SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update
    Updated
    KB5128494

    Database Engine vulnerabilities fixed; MSDASQL queries can fail

    Fixes 21 vulnerabilities in SQL Server 2019. Linked-server queries using MSDASQL with a provider string can fail with error 7416.

    Build 15.0.4500.2
    Security 21 CVEs
    Known issues 1 open
    Replaced by KB5132745 →
  • SQL Server · GDR
    SQL Server 2019 GDR SQL Server 2019 GDR Security update
    Updated
    KB5128495

    21 vulnerabilities fixed; MSDASQL linked queries can fail

    The update fixes 21 vulnerabilities in SQL Server 2019 GDR. A known issue can make linked server queries using MSDASQL and a provider string fail with error 7416.

    Build 15.0.2200.2
    Security 21 CVEs
    Known issues 1 open
    Replaced by KB5132751 →
  • SQL Server · CU31 + GDR
    SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update
    Updated
    KB5128496

    Database Engine vulnerability fixes; MSDASQL queries can fail

    Fixes security vulnerabilities in SQL Server 2017, but linked server queries using MSDASQL and a provider string might fail with error 7416.

    Build 14.0.3560.2
    Security 14 CVEs
    Known issues 1 open
    Replaced by KB5132746 →
  • SQL Server · GDR
    SQL Server 2017 GDR SQL Server 2017 GDR Security update
    Updated
    KB5128497

    SQL Satellite flaws fixed; MSDASQL linked queries can fail

    The update fixes 14 vulnerabilities, including flaws in SQL Satellite and the Virtual Device Interface. Some linked-server queries that use MSDASQL can still fail with error 7416.

    Build 14.0.2140.2
    Security 14 CVEs
    Known issues 1 open
    Replaced by KB5132749 →
  • SharePoint Server · SE
    SharePoint Server SE SharePoint Server SE Security update
    Updated
    KB5002927

    Critical elevation flaw closed; DCache works again

    The update fixes 39 vulnerabilities, including two critical flaws, and restores Distributed Cache after a prior update broke it. It also adds the 26H2 feature update and changes ImportWeb SOAP availability.

    Build 16.0.20326.20190
    Security 39 CVEs 2 critical
    Replaced by KB5002945 →