Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Out-of-band update
Out-of-band

KB5134123

KB5134123: Cumulative update for Windows Server, version 2016, October 2026. Certificate trust updates for isolated devices; Exchange issues remain

In short

Devices that cannot get certificate trust updates receive a refreshed trusted root certificate list. Some on-premises Exchange servers might still have OWA sign-in or email delivery problems.

Does it affect you? Applies to: Windows Server 2016 devices, especially those that cannot access Microsoft's certificate-update service or have automatic certificate trust list updates disabled.

Build
14393.9615
Restart
Required
Review notes Additional details from the official release notes (3) Read notes
  • Does it affect you? This update is intended for Windows Server 2016 devices that do not receive current certificate trust list updates, such as devices that cannot access Microsoft’s certificate-update service or have automatic CTL updates disabled.
  • Known issues Some USB Audio Class 1.0 devices might fail to start or produce audio; the issue is not limited to business users.
  • Known issues The temporary workaround described by Microsoft is a registry change to increase the maximum number of simultaneous Endpoint Lookup calls.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvement 1 change

Certificates

For: Devices without current certificate trust list updates

  • Devices that cannot get certificate trust updates receive a refreshed set of trusted root certificates.1
    Adds an updated trusted root certificate payload to the Windows cumulative update for devices that cannot access Microsoft's certificate-update service or have automatic certificate trust list updates disabled.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5131291

    Users might be unable to sign in to OWA or send emails on Exchange Server

    Some on-premises Exchange servers might have trouble accessing or sending email. OWA sign-in can fail, and messages might stay in the Outbox.2

    How to apply the workaround Registry / GPO

    A registry change can temporarily raise the limit for simultaneous Endpoint Lookup calls. Microsoft Support can provide another mitigation.2

  2. Resolved Affects: Organizations and IT administrators Resolved by KB5129239

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might fail to start or produce audio. The September 14, 2026 out-of-band update fixes symptoms with 8-channel or 3D audio, but other symptoms remain.3

    How to apply the workaround Workaround

    For an immediate workaround for symptoms not covered by the partial fix, contact Microsoft Support for Business.3

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-26
Classification
Updates
Type
Cumulative update
Restart
Required
Replaces
KB5126868, KB5129239, KB5123099, KB5120418
+26 earlier KB5099535, KB5094122, KB5087537, KB5091572, KB5082198, KB5078938, KB5075999, KB5073722, KB5074974, KB5071543, KB5068864, KB5070882, KB5066836, KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5131291
VersionBuildChannel
2016 14393.9615 General availability

Security

No vulnerabilities are listed for this update.

Updated components

23 files changed since the previous update for the same versions.

Top changed componentsFiles
Security and sign-in1

Page history

  1. Known issue resolved: Users might be unable to sign in to OWA or send emails on Exchange Server (KB5131291)

    Known issue resolved: USB Audio Class 1.0 devices with error Code 10 or no output (KB5129239)

  2. Superseded by windows-server/KB5131291

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. This update includes an updated trusted root certificate payload in the Windows cumulative update for devices that cannot access Microsoft’s certificate-update service and devices where automatic certificate trust list (CTL) updates are disabled. support.microsoft.com
  2. 2. This issue can be temporarily mitigated by modifying the registry key as described in Exchange servers may become unstable after installation of October 2026 Windows updates. support.microsoft.com
  3. 3. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake