Patch Tuesday — All products

Remote Desktop and USB audio fixes; NTLM signing strengthened

Remote Desktop connections and some USB audio devices get fixes, while NTLM signing is enabled by default for more connections. The update also closes a publicly disclosed Brotli decoder flaw.

NTLM signing becomes the default for client connections

Security fixes cover Windows components, while NTLM clients now offer message signing by default for non-anonymous connections. USB audio startup, printer setup, and Remote Desktop certificate errors also get fixes.

NTLM signing defaults for non-anonymous connections

NTLM clients offer message signing by default for non-anonymous connections, helping reduce relay risks. The update also fixes printer setup and a Remote Desktop policy issue.

PowerShell rejects some invalidly encoded signed scripts

Stricter PowerShell signature checks might reject signed scripts with invalid UTF-8 encoding. The update also fixes printer setup and Remote Desktop problems.

Cuba clock rules adjusted; printer and remote access failures fixed

Cuba’s clock stays on UTC-04:00 through the 2026–2027 daylight-saving period, and the update fixes printer and remote access problems. It also includes security updates for Windows.

Message Queuing and Windows Search flaws patched

Critical flaws in Message Queuing and Windows Search lead this release, alongside fixes for printing, Remote Desktop, and USB audio.

NTLM signing defaults strengthened; Exchange mail issues remain

NTLM clients now offer message signing by default for non-anonymous connections, helping limit relay attacks. Some on-premises Exchange servers might still have email access or delivery problems.

Critical Windows Search remote-code flaw patched

A critical Windows Search flaw and other serious security bugs get fixes, alongside Exchange, printer, and Remote Desktop repairs. Some Exchange and WSUS problems remain open.

LDAP and Search flaws patched; Exchange mail restored

Critical flaws in LDAP and Windows Search are patched, and on-premises Exchange sign-in and email delivery issues are resolved. NTLM clients now offer message signing by default for non-anonymous connections.

Exchange mail issues resolved; NTLM signing strengthened

Exchange servers can sign in to OWA and send mail again after the October update. Clients also offer NTLM signing by default for non-anonymous connections.

Critical mail-server flaw patched; hybrid free/busy corrected

A critical remote-code flaw in Exchange is patched. Hybrid users can also see correct free/busy details in classic Outlook.

Recovery monitoring queries can crash the database engine

Queries against `sys.dm_exec_requests` might raise an access violation while a database is recovering. The release also fixes security flaws across SQL Server components.

Replication and database data-handling flaws fixed

Fixes SQL Server security flaws and memory-safety problems across database, JSON, and replication tasks. Some fixes prevent crashes or unintended data exposure.

Recovery-time queries may trigger access violations

Database monitoring queries during recovery might cause an access violation and create a dump file. The security update also fixes vulnerabilities; avoid those queries or use trace flag 4696 as a mitigation.

Database vulnerabilities addressed; replication checks strengthened

Database security fixes address vulnerabilities, while changes improve replication checks and prevent unsafe memory access. The update can request a restart.

Replication and SSIS memory flaws fixed; XSLT scripting disabled

SQL Server 2019 gets fixes for memory errors and replication security. Integration Services also disables XSLT scripting by default.

Replication and Integration Services flaws fixed

SQL Server 2019 gets fixes for security flaws and data-handling errors across replication, the database engine, and Integration Services.

Database and replication flaws fixed; XSLT scripting disabled

Security fixes address flaws in database processing and replication, and XSLT scripting is now disabled by default. The update can request a restart.

Replication flaws fixed; XSLT scripting disabled by default

Replication and memory-safety fixes address security risks, and XSLT scripting is disabled by default. SQL Server 2017 security updates end on October 12, 2027.

InfoPath and 2010 workflows face removal in July 2027

InfoPath Forms Services and 2010 workflows are slated for removal on July 13, 2027. The update fixes an unexpected Search service stop and addresses important security flaws.

Excel code-execution and data disclosure flaws addressed

Excel remote code execution and information disclosure vulnerabilities are addressed. Office Online Server reaches the end of updates on December 31, 2026.