Skip to the content
The Update Bureau
Windows Server 2019 Windows Server 2019 Security update
Patch Tuesday Zero-day

KB5126651

KB5126651: Cumulative update for Windows Server, version 2019, October 2026. Actively exploited Windows Shell flaw patched; Exchange issue mitigated

In short

An actively exploited Windows Shell security bypass is patched. Exchange users might still have sign-in and email problems, but a registry mitigation is available.

Does it affect you? Applies to: Devices running Windows Server 2019.

Build
17763.9376
Security
970 fixed · 30 critical · 1 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 4 changes

Date and Time

  • British Columbia and Alberta get support for permanent daylight saving time starting in November 2026.1

Distributed Key Manager (DKM)

Verified in package
  • Insecure AD FS key-container settings are corrected automatically by default.2
    Administrators can opt out by setting RemediateDkmAcl to 0. This addresses the elevation of privilege vulnerability caused by overly permissive DKM container ACLs.

Secure Boot

Gradual rollout Verified in package
  • Eligible devices continue to receive updated Secure Boot certificates over time.3
    Windows Update uses the latest high-confidence targeting data to identify eligible devices.

Servicing stack update

  • The update improves checks that confirm whether a device is hosted on Azure.4
    The servicing stack uses an updated certificate chain for Azure-hosting validation.

New features 3 changes

Date and Time

  • Manitoba Standard Time is added as a time zone.5
    The new time zone is “(UTC-05:00) Manitoba.”

Authentication

  • Administrators can see who uses NTLM, why it was chosen, and where it is used.6
    Enhanced NTLM auditing is available on Windows Server 2022 and 2019.

ReFS security

  • Auditing and optional security controls are added for ReFS volumes on external storage.7
    Auditing is enabled by default. Enforcement controls are disabled by default.

Fixes 2 changes

BitLocker

  • Older systems can access data on drives encrypted by BitLocker To Go on newer systems.8

Storage Spaces

Verified in package
  • Some Storage Spaces Direct virtual disks might no longer stay offline after a Windows update.9
    Addresses recovery treating valid tiered storage metadata as invalid, which can keep affected virtual disks and dependent workloads offline.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5131085

    Users might be unable to sign in to OWA or send emails on Exchange Server

    Some on-premises Exchange servers might have sign-in or email problems, including OWA sign-in failures, messages stuck in the Outbox, mailbox replication issues, or growing email queues. A temporary mitigation is available.10

    How to apply the workaround Registry / GPO

    Increase the maximum number of simultaneous Endpoint Lookup calls using the registry setting in Microsoft's guidance.10

  2. Resolved Affects: Everyone Resolved by KB5129238

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might show Code 10, produce no sound, or have unresponsive sound controls. KB5129238 partly fixes issues with 8-channel or 3D audio modes; other symptoms remain.11

    How to apply the workaround Workaround

    Some customers report restoring audio by switching to 2-channel mode. For symptoms not addressed by KB5129238, IT administrators can contact Microsoft Support.11

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5129238, KB5122876, KB5120238, KB5099538
+25 earlier KB5094123, KB5087538, KB5091573, KB5082123, KB5078752, KB5075904, KB5078131, KB5077795, KB5073723, KB5074975, KB5071544, KB5068791, KB5070883, KB5066586, KB5065428, KB5066187, KB5063877, KB5062557, KB5060531, KB5061978, KB5058392, KB5059091, KB5058922, KB5050008, KB5037425
Replaced by
KB5134124
VersionBuildChannel
2019 17763.9376 General availability

Security

970 vulnerabilities fixed
1 exploited 30 critical 939 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-96951 Exploited
Windows Shell Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-100202
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70147
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70153
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-96934
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-97814
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-100220
Windows Media Video Decoder Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102214
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102225
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108467
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108471
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-70250
Windows DHCP Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-83934
Windows GDI+ Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-96913
Windows Kernel Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96914
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96952
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108460
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69802
Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-70187
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-70229
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88117
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88119
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88120
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88171
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88174
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-100215
Microsoft Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-108131
Active Directory Federation Services (AD FS) Spoofing Vulnerability
 Critical 7.5
CVE-2026-96222
Active Directory Federation Services (AD FS) Spoofing Vulnerability
 Critical 7.4
CVE-2026-108399
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.2
CVE-2026-102211
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-83917
Windows ALPC Elevation of Privilege Vulnerability
 Critical 7.0

The table lists the 31 exploited, publicly disclosed or critical vulnerabilities. See all 970 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2019
859.9 MB
windows10.0-kb5126651-x64.msu Main update · KB5126651 SHA-1: fbdb84a0…0108e2

Updated components

2,308 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings24
Graphics and display21
Audio20
Bluetooth19
Networking17
Remote Desktop13
Security and sign-in13
Hyper-V and virtualization12
Storage and file systems11
Secure Boot10
Printing7
Kernel6

Verified in package: changed files confirm Distributed Key Manager (DKM), Secure Boot, Storage Spaces.

Page history

  1. Added CVE-2026-69802

  2. Known issue resolved: Users might be unable to sign in to OWA or send emails on Exchange Server (KB5131085)

    Known issue resolved: USB Audio Class 1.0 devices with error Code 10 or no output (KB5129238)

  3. Added 55 vulnerabilities (55 important)

  4. Superseded by windows-server/KB5134124

Sources

Updated
Cited passages from Microsoft's official notes (11)
  1. 1. This update enables permanent Daylight Saving Time (DST) support for British Columbia and Alberta starting in November 2026. support.microsoft.com
  2. 2. This update automatically remediates insecure DKM container ACL configurations in AD FS by default. support.microsoft.com
  3. 3. This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. support.microsoft.com
  4. 4. This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. support.microsoft.com
  5. 5. This update introduces the new time zone Manitoba Standard Time, "(UTC-05:00) Manitoba." support.microsoft.com
  6. 6. The new auditing capabilities provide greater visibility into NTLM authentication, helping administrators identify who is using NTLM, why NTLM was selected, and where NTLM authentication is occurring. support.microsoft.com
  7. 7. This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. support.microsoft.com
  8. 8. This update fixes an issue in which drives encrypted by BitLocker To Go on newer systems were not recognized by older systems. support.microsoft.com
  9. 9. This update addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. support.microsoft.com
  10. 10. For workloads such as Exchange Server, the default limit of 512 simultaneous Endpoint Lookup calls might not be sufficient under heavy load. learn.microsoft.com
  11. 11. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 11 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake