The Update BureauKB5131291: Cumulative update for Windows Server, version 2016, November 2026. Exchange mail issues resolved; NTLM signing strengthened
Exchange servers can sign in to OWA and send mail again after the October update. Clients also offer NTLM signing by default for non-anonymous connections.
Does it affect you? Applies to: Devices running Windows Server 2016. The update applies to Windows Server 2016.
Review notes Additional details from the official release notes (2) Read notes
- What changes This update fixes a problem in which Import-WdsInstallImage required administrator privileges; non-administrators otherwise received ACCESS_DENIED.
- What changes This update fixes a problem in which Import-WdsInstallImage required administrator privileges; non-administrators otherwise received ACCESS_DENIED.
The official sources are linked at the end of the page.
Microsoft publishes separate notes for this KB for Windows 10.
What changes
Fixes 6 changes
Printing
For: devices adding printers published in Active Directory
-
Adding a printer published in Active Directory through Settings might no longer fail with error 87.1
The issue does not generally affect existing printers or printing.
Windows Deployment Services
For: Windows Deployment Services administrators
-
Running Import-WdsInstallImage without administrator rights fails with ACCESS_DENIED after this update.2
After installing this security update, the
Import-WdsInstallImagecmdlet requires administrator privileges. Attempts to run it as a non-administrator fail with anACCESS_DENIEDerror.
Remote Desktop
-
The trusted Remote Desktop publisher certificate policy can be configured through Microsoft Intune.3
Fixes configuration of the “Specify thumbprints of certificates representing trusted .rdp publishers” policy through Microsoft Intune.
-
Remote Desktop shadow connections no longer fail with an “Unspecified error” on affected servers.3
The issue affected Windows Server 2016 and Windows Server 2012 R2 after installing the October 14, 2026, update.
Remote Desktop Web Access
For: devices using RD Web Access with XSLT disabled by browser policy
-
RD Web Access pages load in Edge and Chrome when browser policy disables XSLT.4
RD Web Access pages are now rendered on the server and no longer depend on browser XSLT support.
Exchange Server
For: on-premises Exchange Server administrators and users
-
Users can sign in to OWA and send email again on affected on-premises Exchange servers.5
Also fixes Exchange access to mailboxes during mailbox replication.
Improvements 3 changes
Date and Time
For: devices using Cuba time zones
-
Cuba stays on UTC-04:00 through the extended 2026–2027 daylight saving time period.6
Cuba does not observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.
Windows PowerShell
For: PowerShell script authors and administrators
-
PowerShell scripts with invalid UTF-8 encoding might fail signature checks, even if they passed before.5
Save affected scripts using valid UTF-8 encoding with a byte order mark (BOM), then sign them again.
Security
-
Clients offer NTLM signing by default for non-anonymous connections, helping reduce exposure to relay attacks.5
The change also provides auditing to identify connections that are not using signing.
Known issues
-
Users might be unable to sign in to OWA or send emails on Exchange Server
Some on-premises Exchange servers might block OWA sign-ins, delay email delivery, or have trouble accessing mailboxes during replication. KB5131291 resolves this issue.7
Resolution Fixed in KB5131291Install KB5131291 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
USB Audio Class 1.0 devices with error Code 10 or no output
Some USB Audio Class 1.0 devices might show Code 10, produce no sound, or have unresponsive volume controls. KB5131291 resolves the remaining symptoms; 8-channel and 3D audio symptoms were resolved earlier by KB5129239.8
Resolution Fixed in KB5129239Install KB5129239 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-11-10
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5134123, KB5126868, KB5129239, KB5123099
+27 earlier
KB5120418, KB5099535, KB5094122, KB5087537, KB5091572, KB5082198, KB5078938, KB5075999, KB5073722, KB5074974, KB5071543, KB5068864, KB5070882, KB5066836, KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
| Version | Build | Channel |
|---|---|---|
| 2016 | 14393.9688 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Windows Search Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Active Directory Domain Services Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Graphic Fonts Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Remote Procedure Call Runtime Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Deployment Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Schannel Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Internet Information Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows CredSSP Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows TPM Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Remote Desktop Services Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Print Spooler Components Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Active Directory Domain Services Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 7.5 |
|
Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Elevation of Privilege Vulnerability
|
Critical | 6.4 |
The table lists the 25 exploited, publicly disclosed or critical vulnerabilities. See all 502 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
1,482 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Networking | 18 |
| Bluetooth | 12 |
| Audio | 10 |
| Graphics and display | 10 |
| Remote Desktop | 10 |
| Hyper-V and virtualization | 9 |
| Storage and file systems | 9 |
| Printing | 6 |
| Security and sign-in | 6 |
| File Explorer and shell | 5 |
| Kernel | 5 |
| Secure Boot | 5 |
Verified in package: changed files confirm Printing, Remote Desktop, Remote Desktop Web Access.
Page history
-
Now also covers build 14393.9688 (2016)
Sources
Cited passages from Microsoft's official notes (8)
-
1.
Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, "The parameter is incorrect."
support.microsoft.com -
2.
After installing this security update, the Import-WdsInstallImage cmdlet requires administrator privileges. Attempts to run the cmdlet as a non-administrator fail with an ACCESS_DENIED error.
support.microsoft.com -
3.
Fixed: Remote Desktop shadow connections might fail with an “Unspecified error” on Windows Server 2016 and Windows Server 2012 R2 after installing the October 14, 2026, update.
support.microsoft.com -
4.
RD Web Access pages are now rendered on the server and no longer depend on browser XSLT support.
support.microsoft.com -
5.
This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections.
support.microsoft.com -
6.
This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period.
support.microsoft.com -
7.
This issue was resolved by Windows updates released November 10, 2026 (KB5131291), and updates released after that date.
learn.microsoft.com -
8.
The remaining symptoms are resolved in the Windows security update released on November 10, 2026 (KB5131291) and later updates.
learn.microsoft.com
Checked automatically: 8 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Nov 15, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake