Skip to the content
The Update Bureau
Windows Server 2019 Windows Server 2019 Security update
Patch Tuesday

KB5131085

KB5131085: Cumulative update for Windows Server, version 2019, November 2026. LDAP and Search flaws patched; Exchange mail restored

In short

Critical flaws in LDAP and Windows Search are patched, and on-premises Exchange sign-in and email delivery issues are resolved. NTLM clients now offer message signing by default for non-anonymous connections.

Does it affect you? Applies to: Devices running Windows Server 2019, x64.

Build
17763.9487
Security
561 fixed · 28 critical
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Fixes 6 changes

Printing

Verified in package

For: Devices adding an Active Directory-published printer

  • Adding a printer shared through Active Directory no longer fails with error 87.1
    Fixes error 87, "The parameter is incorrect," when adding an Active Directory-published printer through Settings > Bluetooth & devices > Printers & scanners > Add device. The issue did not generally affect existing printers or printing.

Windows Deployment Services

For: Windows Deployment Services administrators

  • The Import-WdsInstallImage command works for administrators without an ACCESS_DENIED error.2
    Fixes the Import-WdsInstallImage cmdlet requiring administrator privileges after installing this security update.

Remote Desktop Web Access

Verified in package

For: RD Web Access users

  • RD Web Access loads in Edge and Chrome even when browser policy disables XSLT.3
    RD Web Access pages are rendered on the server and no longer depend on browser XSLT support.

Remote Desktop

Verified in package 2 items
  • The trusted Remote Desktop publisher certificate policy can be set through Intune.4
    Fixes configuration of the “Specify thumbprints of certificates representing trusted .rdp publishers” policy through Microsoft Intune.
  • Remote Desktop shadow connections work again on Windows Server 2016 and Windows Server 2012 R2.5
    Fixes shadow connections failing with an “Unspecified error” after installing the October 14, 2026 update.

Exchange Server

For: On-premises Exchange Server users

  • Users can sign in to OWA and send email again on affected on-premises Exchange servers.6
    Also fixes Exchange access to mailboxes during mailbox replication.

Improvements 3 changes

Date and Time

For: Devices using Cuba time zone

  • Cuba's time zone stays at UTC-04:00 through the November 2026 and March 2027 time changes.7
    Cuba remains on UTC-04:00 for the extended 2026-2027 daylight saving time period. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.

Windows PowerShell

For: PowerShell script authors and administrators

  • PowerShell checks script signatures more strictly. Scripts with invalid UTF-8 encoding might fail validation, even if they passed before.8
    Review affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again.

Security

  • For non-anonymous connections, NTLM clients offer message signing by default. This helps reduce exposure to relay attacks.9
    Clients offer NTLM message signing by default for non-anonymous connections. The change also provides auditing to identify connections that are not using signing.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5131085

    Users might be unable to sign in to OWA or send emails on Exchange Server

    Some on-premises Exchange servers might block OWA sign-in, email delivery, or mailbox access during replication. KB5131085 resolves this issue.10

    Resolution Fixed in KB5131085

    Install KB5131085 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Everyone Resolved by KB5129238

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might fail to start or produce sound. KB5129238 addressed symptoms with 8-channel or 3D audio modes; KB5131085 resolves the remaining symptoms.11

    Resolution Fixed in KB5129238

    Install KB5129238 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Organizations and IT administrators Resolved by KB5136490

    Windows activation and licensing commands might fail with error 0x80041008

    Organizations using command-line tools or automated processes for activation might see error 0x80041008 when running some licensing commands. Devices already activated remain activated; devices with the needed KMS key and setup that do not need these commands are not expected to be affected.12

    How to apply the workaround Workaround

    Contact Microsoft Support for business for an immediate mitigation.12

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-11-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5134124, KB5126651, KB5129238, KB5122876
+27 earlier KB5120238, KB5099538, KB5094123, KB5087538, KB5091573, KB5082123, KB5078752, KB5075904, KB5078131, KB5077795, KB5073723, KB5074975, KB5071544, KB5068791, KB5070883, KB5066586, KB5065428, KB5066187, KB5063877, KB5062557, KB5060531, KB5061978, KB5058392, KB5059091, KB5058922, KB5050008, KB5037425
Replaced by
KB5136490
VersionBuildChannel
2019 17763.9487 General availability

Security

561 vulnerabilities fixed
28 critical 532 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-116928
Windows Search Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-119958
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-118146
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-119969
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-109459
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-113862
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-116710
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-118737
Remote Procedure Call Runtime Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119951
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119952
Windows Schannel Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119961
Windows Internet Information Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119962
Windows CredSSP Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119963
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119964
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119967
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-119382
Windows TPM Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-119957
Windows Remote Desktop Services Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-125137
Windows Graphics Kernel Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-113749
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113752
Windows Print Spooler Components Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113825
Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113861
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-118145
Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-118148
Active Directory Domain Services Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-119947
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-125134
Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-113860
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-113864
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 6.4
CVE-2026-111497
Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
 Not rated 8.1

The table lists the 29 exploited, publicly disclosed or critical vulnerabilities. See all 561 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2019
872.0 MB
windows10.0-kb5131085-x64.msu Main update · KB5131085 SHA-1: 5b4a0d0a…1e2054

Updated components

1,333 files changed since the previous update for the same versions.

Top changed componentsFiles
Bluetooth15
Audio14
Networking13
Graphics and display8
Storage and file systems8
Hyper-V and virtualization7
Printing7
Security and sign-in7
Secure Boot6
File Explorer and shell5
Kernel4
Remote Desktop4

Verified in package: changed files confirm Printing, Remote Desktop Web Access, Remote Desktop.

Page history

  1. Superseded by windows-server/KB5136490

    Known issue resolved: Windows activation and licensing commands might fail with error 0x80041008 (KB5136490)

  2. New known issue: Windows activation and licensing commands might fail with error 0x80041008

    Added CVE-2026-111497 (No severity)

  3. Now also covers build 17763.9487 (2019)

Sources

Updated
Cited passages from Microsoft's official notes (12)
  1. 1. Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, "The parameter is incorrect." support.microsoft.com
  2. 2. Fixed: After installing this security update, the Import-WdsInstallImage cmdlet requires administrator privileges. support.microsoft.com
  3. 3. RD Web Access pages are now rendered on the server and no longer depend on browser XSLT support. support.microsoft.com
  4. 4. Fixed: The “Specify thumbprints of certificates representing trusted .rdp publishers” policy could not be configured successfully through Microsoft Intune. support.microsoft.com
  5. 5. Fixed: Remote Desktop shadow connections might fail with an “Unspecified error” on Windows Server 2016 and Windows Server 2012 R2 after installing the October 14, 2026, update. support.microsoft.com
  6. 6. This update fixes an issue that affects on-premises Exchange servers. The issue might prevent signing in to Outlook on the web (OWA), cause email messages to remain in the Outlook Outbox without being delivered, or prevent Exchange from accessing mailboxes during mailbox replication. support.microsoft.com
  7. 7. This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. support.microsoft.com
  8. 8. This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. support.microsoft.com
  9. 9. This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. support.microsoft.com
  10. 10. This issue was resolved by Windows updates released November 10, 2026 (KB5131085), and updates released after that date. learn.microsoft.com
  11. 11. The remaining symptoms are resolved in the Windows security update released on November 10, 2026 (KB5131085) and later updates. learn.microsoft.com
  12. 12. This issue primarily affects organizations that use command-line tools or automated processes to manage Windows activation and licensing. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 12 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake