October 13, 2026—KB5126646 (OS Build 26100.33650)

Applies To

Windows Server 2025, all editions

This cumulative update for Windows Server 2025 (KB5126646), includes the latest security fixes and improvements, along with non-security updates from last month’s optional preview release. Visit the Windows release health dashboard for the latest status on this release.

Announcements and messages

This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.

Windows Secure Boot certificate expiration

Secure Boot certificate updates remain in progress as Microsoft transitions devices from certificates that began expiring in 2026 to newer certificates. Devices that have not yet received the newer certificates can continue to start and receive standard Windows updates. Microsoft will continue delivering the newer Secure Boot certificates to eligible devices through Windows Update.

Improvements

This security update contains fixes and quality improvements from KB5122871 (released September 8, 2026) and the out-of-band update KB5129235 (released September 14, 2026). The following summary outlines key issues addressed by this update. Also, included are available new features. The bold text within the brackets indicates the item or area of the change.

[Quick machine recovery] New! Quick machine recovery is now supported on Windows Server 2025. During outages, Quick machine recovery helps recover devices from critical boot failures by using Windows Recovery Environment (WinRE) to find and apply targeted remediations from Windows Update. The feature is disabled by default on Windows Server 2025 editions. Administrators can enable the feature through Group Policy to support streamlined recovery during widespread outages and reduce the need for manual intervention. Recovery depends on an applicable remediation being available. To learn more, see Quick machine recovery.
[ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. To learn more, see KB5130741.
[Security] This update adds support for ML-KEM post-quantum key exchange in Transport Layer Security (TLS) 1.3, helping protect encrypted connections against future quantum-computing threats.
[Date and Time]
- This update enables permanent Daylight Saving Time (DST) support for British Columbia and Alberta starting in November 2026. For information about managing this change in Outlook, see Outlook Time Zone Changes for Alberta and British Columbia.
- This update introduces the new time zone Manitoba Standard Time, "(UTC-05:00) Manitoba."
- For the latest information about DST and time zone changes, see the Daylight Saving Time & Time Zone Blog.
[Security] This update upgrades the version of cURL included with Windows to version 8.21.0.
[Networking] This update improves the NetUseAdd function, helping it establish SMB network connections successfully during NULL session attempts.
[Authentication] This update improves Netlogon secure channel connections, helping member servers connect successfully to domain controllers that were set up before Windows Server 2025.
[Emoji] This update improves security for emoji search in the Expressive Input Panel by updating the libraries used by EmojiSearchData.
[Hyper-V] This update improves the reliability of Intel Trusted Domain Extensions (TDX) confidential virtual machines in Hyper-V reliability issues affecting TDX operation.
[Distributed Key Manager (DKM)] This update automatically remediates insecure DKM container ACL configurations in AD FS by default. Administrators can opt out of automatic remediation by setting RemediateDkmAcl to 0. This change helps address an elevation of privilege vulnerability that can occur when the DKM container ACL is overly permissive. For more information about how to manage this change, see CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening.
[Secure Boot] This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. Deployment through Windows Update remains ongoing across supported devices.
[Storage Spaces] This update addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. This issue occurs when valid tiered storage metadata is incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online.
[Authentication] This update strengthens NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not set. Windows now uses Enforce mode (1) instead of Audit mode (0), blocking the generation of NTLMv1-derived credentials for Single Sign-On (SSO). This change applies only to devices where Credential Guard is disabled and the BlockNtlmv1SSO registry value is not set, and might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication. For more information, see KB5066470.

If you've already installed previous updates, your device will download and install only the new updates included in this package.

For more information about security vulnerabilities, see the Security Update Guide and the October 2026 Security Updates.

Windows Server 2025 servicing stack update (KB5126645) - 26100.33634

This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates. To learn more about SSUs, see Servicing stack updates.

Known issues in this update

Users might be unable to sign in to OWA or send emails on Exchange Server

Symptoms:

After installing this update, some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication.

In some affected configurations, Exchange Server OWA might fail with an error MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142) with Event ID 1006 logged in the application log. Another reported symptom is growing email queues. Installing the October 2026 Exchange server security updates isn’t required for these issues to occur.

Workaround

This issue can be temporarily mitigated by modifying the registry key as described in Exchange servers may become unstable after installation of October 2026 Windows updates.

The October 2026 update introduced a default limit on the amount of memory used by Endpoint Mapper when handling Endpoint Lookup calls.

For workloads such as Exchange Server, the default limit of 512 simultaneous Endpoint Lookup calls might not be sufficient under heavy load. Administrators can use this registry setting to increase the maximum number of simultaneous Endpoint Lookup calls, which increases the amount of memory that Endpoint Mapper can use.

Microsoft Support: An additional mitigation is available for affected devices through Microsoft Support. To apply this mitigation in your organization, please contact Microsoft Support for business.

Next steps: Microsoft investigating this issue and will provide more information when it is available.

Windows Server Update Services (WSUS) does not display error details

After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.

How to get this update

Before you install this update

Deployment

If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.

Note

The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.

To ensure the boot.stl file is included as part of the installation media, do one of the following:

Use the Update WinPE script to update an existing Windows image. (Recommended)
Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.

For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.

Available	Next Step
	This update downloads and installs automatically from Windows Update and Microsoft Update.

Available	Next Step
	This update downloads and installs automatically from Windows Update for Business in accordance with configured policies.

Available	Next step
	To install this update, download the standalone package(s) for this update from the Microsoft Update Catalog. This update contains MSU files that require installation in a specific order. Follow the x64 installation instructions. If you install additional Dynamic Update packages, use versions from the same release month as this update. If a Safe OS Dynamic Update or Setup Dynamic Update is not available for the same release month, use the most recently released version. Note This latest cumulative update includes updates for AI components. AI components are applicable only to Copilot+ PCs and will not install on other Windows client PCs or Windows Server.

Available

Next step

To install this update, download the standalone package(s) for this update from the Microsoft Update Catalog. This update contains MSU files that require installation in a specific order. Follow the x64 installation instructions.

If you install additional Dynamic Update packages, use versions from the same release month as this update. If a Safe OS Dynamic Update or Setup Dynamic Update is not available for the same release month, use the most recently released version.

Note This latest cumulative update includes updates for AI components. AI components are applicable only to Copilot+ PCs and will not install on other Windows client PCs or Windows Server.

x64 installation instructions

Note The Microsoft Update Catalog may include one or more required checkpoint cumulative updates and the target cumulative update. Install the checkpoint cumulative updates in order before installing the target cumulative update.

Download all MSU files for update KB5126646 from the Microsoft Update Catalog and place them in the same folder (for example, C:/Packages). Ensure no other files are present in the folder.

This update consists of the following update file(s).

Item	MSU file
Required checkpoint cumulative update	windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
Target cumulative update	windows11.0-kb5126646-x64_1c4904f50bb65dd132a8f4c024de8d5fd91ff3b1.msu

Method 1: Install each MSU file individually, in order

Double-click each file in the following order to install that update (if there is more than one .msu file listed):

Note If a required checkpoint cumulative update is already present, a message will indicate that the update is already installed. For guidance on using the Windows Update Standalone Installer (Wusa.exe), see Description of the Windows Update Standalone Installer in Windows.

Method 2: Install all MSU files together

Use Deployment Image Servicing and Management (DISM.exe) to install the target cumulative update. DISM automatically scans the folder specified in the PackagePath folder and installs any required checkpoint cumulative updates.

Updating a Windows PC

To apply this update on a running Windows PC, run the following command from an elevated Command Prompt window:

DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-kb5126646-x64_1c4904f50bb65dd132a8f4c024de8d5fd91ff3b1.msu

Or, run the following command from an elevated PowerShell window:

Add-WindowsPackage -Online -PackagePath "c:\\packages\\windows11.0-kb5126646-x64_1c4904f50bb65dd132a8f4c024de8d5fd91ff3b1.msu"

Updating Windows installation media

To apply this update to Windows installation media, see Update Windows installation media with Dynamic Update.

To add this update to a mounted image, run the following command from an elevated Command Prompt window:

DISM /Image:mountdir /Add-Package /PackagePath:windows11.0-kb5126646-x64_1c4904f50bb65dd132a8f4c024de8d5fd91ff3b1.msu

Or, run the following command from an elevated PowerShell window:

Add-WindowsPackage -Path "c:\\offline" -PackagePath "windows11.0-kb5126646-x64_1c4904f50bb65dd132a8f4c024de8d5fd91ff3b1.msu" -PreventPending

Available	Next Step
	This update will automatically sync with Windows Server Update Services (WSUS) if you configure Product and Classification as follows: Product: Microsoft Server operating system-24H2 Classification: Security Updates

File information

For a list of the files provided in this update, download the file information for cumulative update KB5126646.

For a list of the files provided in the servicing stack update, download the file information for SSU KB5126645 - version 26100.33634.

Change log

Change date	Change description
October 19, 2026	Updated the Daylight Saving Time (DST) release note to provide additional information and guidance.
October 14, 2026	Added a release note: "[Storage Spaces] This update addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. This issue occurs when valid tiered storage metadata is incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online."
October 15, 2026	Added a release note: "[Authentication] This update strengthens NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not set. Windows now uses Enforce mode (1) instead of Audit mode (0), blocking the generation of NTLMv1-derived credentials for Single Sign-On (SSO). This change applies only to devices where Credential Guard is disabled and the BlockNtlmv1SSO registry value is not set, and might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication. For more information, see KB5066470."