Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5126868

KB5126868: Cumulative update for Windows Server, version 2016, October 2026. Windows Shell flaw exploited; Exchange email issues remain

In short

An actively exploited Windows Shell security-bypass flaw is addressed, while some on-premises Exchange servers still face email failures despite a temporary mitigation.

Does it affect you? Applies to: This update applies to Windows Server 2016.

Build
14393.9612
Security
767 fixed · 26 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • In short Microsoft lists the Exchange issue as mitigated. A temporary mitigation is available through the registry setting described in Microsoft's Exchange guidance.
  • Known issues The documented Exchange mitigation is to modify the registry setting described in Microsoft's Exchange guidance.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 4 changes

Date and Time

  • Time-zone data enables support for permanent daylight saving time in British Columbia and Alberta starting in November 2026.1

ReFS security

  • ReFS volumes on externally attached storage gain auditing and optional security controls. Auditing is on by default.2
    Enforcement controls remain disabled by default so administrators can evaluate and prepare for future security hardening changes.

Distributed Key Manager (DKM)

  • Insecure AD FS key-container permissions are corrected automatically by default.3
    Administrators can opt out of automatic remediation by setting RemediateDkmAcl to 0. The change addresses an elevation-of-privilege risk from overly permissive DKM container ACLs.

Secure Boot

Gradual rollout Verified in package
  • Eligible devices continue to receive updated Secure Boot certificates through Windows Update.4
    Deployment uses the latest high-confidence targeting data to identify eligible devices ready to receive the new certificates automatically.

Fix 1 change

Storage Spaces

Verified in package
  • The update addresses cases where some Storage Spaces Direct virtual disks stay offline after a Windows update.5
    Valid tiered storage metadata can be incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online.

New feature 1 change

Date and Time

  • Manitoba Standard Time is added as a new time zone.6
    The time zone is named Manitoba Standard Time, “(UTC-05:00) Manitoba.”

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5131291

    Users might be unable to sign in to OWA or send emails on Exchange Server

    Some on-premises Exchange servers might have problems with OWA sign-in, sending email, or mailbox access during replication. A temporary mitigation is available.7

    How to apply the workaround Registry / GPO

    Use the registry setting in Microsoft's Exchange guidance to raise the maximum number of simultaneous Endpoint Lookup calls.7

  2. Resolved Affects: Everyone Resolved by KB5129239

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might show Code 10, produce no audio, or have unresponsive controls. The September 14 update KB5129239 partially resolves symptoms in 8-channel or 3D audio modes; other symptoms remain.8

    How to apply the workaround Workaround

    Some customers have restored audio by switching affected devices to 2-channel mode.8

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5129239, KB5123099, KB5120418, KB5099535
+25 earlier KB5094122, KB5087537, KB5091572, KB5082198, KB5078938, KB5075999, KB5073722, KB5074974, KB5071543, KB5068864, KB5070882, KB5066836, KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5134123
VersionBuildChannel
2016 14393.9612 General availability

Security

767 vulnerabilities fixed
1 exploited 26 critical 740 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-96951 Exploited
Windows Shell Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-100202
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70147
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70153
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-96934
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-97814
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-100220
Windows Media Video Decoder Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102214
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102225
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108467
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70250
Windows DHCP Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-83934
Windows GDI+ Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-96914
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-108460
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69802
Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-70187
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-70229
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88117
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88119
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88120
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88171
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-88174
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-100215
Microsoft Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-108131
Active Directory Federation Services (AD FS) Spoofing Vulnerability
 Critical 7.5
CVE-2026-96222
Active Directory Federation Services (AD FS) Spoofing Vulnerability
 Critical 7.4
CVE-2026-108399
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.2
CVE-2026-102211
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.0

The table lists the 27 exploited, publicly disclosed or critical vulnerabilities. See all 767 vulnerabilities →

Updated components

1,363 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio16
WPF14
Bluetooth12
Networking11
Graphics and display10
Remote Desktop9
Secure Boot9
Hyper-V and virtualization8
Security and sign-in8
.NET runtime (CLR)7
Storage and file systems7
WCF7

Verified in package: changed files confirm Secure Boot, Storage Spaces.

Page history

  1. Added CVE-2026-69802

  2. Known issue resolved: Users might be unable to sign in to OWA or send emails on Exchange Server (KB5131291)

    Known issue resolved: USB Audio Class 1.0 devices with error Code 10 or no output (KB5129239)

  3. Added 16 vulnerabilities (16 important)

  4. Superseded by windows-server/KB5134123

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. This update enables permanent Daylight Saving Time (DST) support for British Columbia and Alberta starting in November 2026. support.microsoft.com
  2. 2. This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default support.microsoft.com
  3. 3. This update automatically remediates insecure DKM container ACL configurations in AD FS by default. support.microsoft.com
  4. 4. Deployment through Windows Update remains ongoing across supported device. support.microsoft.com
  5. 5. This update addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. support.microsoft.com
  6. 6. This update introduces the new time zone Manitoba Standard Time, "(UTC-05:00) Manitoba." support.microsoft.com
  7. 7. For workloads such as Exchange Server, the default limit of 512 simultaneous Endpoint Lookup calls might not be sufficient under heavy load. learn.microsoft.com
  8. 8. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake