Skip to the content
The Update Bureau
Windows Server 2019 Windows Server 2019 Out-of-band update
Out-of-band

KB5134124

KB5134124: Cumulative update for Windows Server, version 2019, October 2026. Updated root certificate payload for disconnected devices

In short

Devices that cannot get certificate updates from Microsoft receive an updated trusted root certificate payload. Some Exchange servers might still have sign-in and email problems.

Does it affect you? Applies to: Windows Server 2019 devices, especially those that cannot access Microsoft's certificate-update service or have automatic certificate trust list updates disabled.

Build
17763.9378
Restart
Required
Review notes Additional details from the official release notes (3) Read notes
  • What changes The included servicing stack update adds logic to verify whether a device is hosted on Azure, using an updated certificate chain.
  • Does it affect you? This out-of-band update is intended for devices that do not receive current certificate trust list updates, including devices with automatic CTL updates disabled.
  • Known issues IT administrators who need an immediate workaround for USB audio symptoms not addressed by the September 14 out-of-band update should contact Microsoft Support for assistance.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvement 1 change

Certificates

For: Devices without certificate service access or with automatic CTL updates disabled

  • Devices that cannot reach Microsoft's certificate service, or have automatic certificate updates turned off, get an updated trusted root certificate payload.1
    The payload is included in the Windows cumulative update for devices that cannot access the certificate-update service or have automatic certificate trust list (CTL) updates disabled.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5131085

    Users might be unable to sign in to OWA or send emails on Exchange Server

    Some on-premises Exchange users might be unable to sign in to Outlook on the web (OWA) or send email. Messages might stay in the Outbox, and mailbox replication might have problems.2

    How to apply the workaround Registry / GPO

    A registry change can raise the limit on simultaneous connection lookups. Microsoft Support can provide another temporary mitigation.2

  2. Resolved Affects: Everyone Resolved by KB5129238

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might fail to start or produce sound. An earlier out-of-band update partly resolved this: 8-channel and 3D audio symptoms are fixed, but other symptoms remain.3

    How to apply the workaround Workaround

    For remaining symptoms, contact Microsoft Support. Some customers have restored audio in multichannel cases by switching to 2-channel mode.3

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-26
Classification
Updates
Type
Cumulative update
Restart
Required
Replaces
KB5126651, KB5129238, KB5122876, KB5120238
+26 earlier KB5099538, KB5094123, KB5087538, KB5091573, KB5082123, KB5078752, KB5075904, KB5078131, KB5077795, KB5073723, KB5074975, KB5071544, KB5068791, KB5070883, KB5066586, KB5065428, KB5066187, KB5063877, KB5062557, KB5060531, KB5061978, KB5058392, KB5059091, KB5058922, KB5050008, KB5037425
Replaced by
KB5131085
VersionBuildChannel
2019 17763.9378 General availability

Security

No vulnerabilities are listed for this update.

Updated components

20 files changed since the previous update for the same versions.

Top changed componentsFiles
Security and sign-in1

Page history

  1. Known issue resolved: Users might be unable to sign in to OWA or send emails on Exchange Server (KB5131085)

    Known issue resolved: USB Audio Class 1.0 devices with error Code 10 or no output (KB5129238)

  2. Superseded by windows-server/KB5131085

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. This update includes an updated trusted root certificate payload in the Windows cumulative update for devices that cannot access Microsoft’s certificate-update service and devices where automatic certificate trust list (CTL) updates are disabled. support.microsoft.com
  2. 2. After installing this update, some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. support.microsoft.com
  3. 3. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake