CONTACT US
Twitter Linkedin Youtube
Patch Review Recommendations

Flexis October 2026 Patch Recommendation

Patches Microsoft released in October 2026

 

  • KB5126655: 2026-10 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems
  • KB5126651: 2026-10 Cumulative Update for Windows Server 2019 (1809) for x64-based Systems
  • KB5126649: 2026-10 Servicing Stack Update for Windows Server 2016 for x64-based Systems 
  • KB5126868: 2026-10 Cumulative Update for Windows 11, version 23H2 for x64-based Systems 

Get Help With Patching, Talk to a Patching Expert.

Microsoft-Windows

Microsoft Windows

Microsoft-Edge

Microsoft Edge

(HTML-based)

Microsoft-Edge

Microsoft Edge

 (Chromium-based)

Internet-Explorer

Internet Explorer

Microsoft-Office

Microsoft Office and Microsoft Office Services and Web Apps

Windows-Defenser

Windows Defender

Visual-Studio

Visual Studio

6

ASP.NET Core

Untitled design (1)

Chakra Core

Microsoft-Dynamics

Microsoft Dynamics

NET-Framework

.NET Framework

NET-Core

.NET Core

Please note the following information regarding the security updates:

Windows 10 Enterprise and Education and Windows 10 Home and Pro Lifecycle pages, Windows 10 was ended on October 14, 2025. The current version, 22H2, will be the final version of Windows 10. The following editions will remain in support with monthly security update releases through that date: 

Home

Pro

Pro Education

Pro for Workstations

Education

Enterprise

Enterprise multi-session

KB5126655: Windows Server 2022

Link to Microsoft Support

Important 

Windows Server 2022 has reach end of mainstream support. The October 2026 security update is the last mainstream support update available for this version. After this date, Windows Server 2022 will transition to extended support, which includes security updates at no additional cost, and will continue to receive monthly security updates through October 14, 2031. For more information, see the Fixed Lifecycle Policy. 

 

 

Windows Secure Boot certificate expiration 

 

Important: Secure Boot certificate updates remain in progress as Microsoft transitions devices from certificates that began expiring in 2026 to newer certificates. Devices that have not yet received the newer certificates can continue to start and receive standard Windows updates. Microsoft will continue delivering the newer Secure Boot certificates to eligible devices through Windows Update. 

 

Improvements 

This security update contains fixes and quality improvements from KB5122882 (released September 8, 2026) and the out-of-band update KB5129237. The following summary outlines key issues addressed by this update. Also, included are available new features. The bold text within the brackets indicates the item or area of the change. 

  • [Authentication] Enhanced NTLM auditing is now available on Windows Server 2022 and 2019. The new auditing capabilities provide greater visibility into NTLM authentication, helping administrators identify who is using NTLM, why NTLM was selected, and where NTLM authentication is occurring. This additional visibility can help organizations identify legacy NTLM dependencies and prepare their environments to move toward more secure authentication protocols such as Kerberos. Learn more here: Overview of NTLM auditing enhancements in Windows 11, version 24H2, Windows Server 2019, and later versions. 
  • [Date and Time] 
  • This update introduces the new time zone Manitoba Standard Time, “(UTC-05:00) Manitoba.” 
  • [Security] This update upgrades the version of cURL included with Windows to version 8.21.0. 
  • [ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. To learn more, see KB5130741. 
  • [Storage Spaces] Addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. This issue occurs when valid tiered storage metadata is incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online. 
  • [Distributed Key Manager (DKM)] This update automatically remediates insecure DKM container ACL configurations in AD FS by default. Administrators can opt out of automatic remediation by setting RemediateDkmAcl to 0. This change helps address an elevation of privilege vulnerability that can occur when the DKM container ACL is overly permissive. For more information about how to manage this change, see CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening. 
  • [Audio (known issue)] Fixed: This update addresses an issue where some USB Audio Class 1.0 devices might fail to start or produce audio. 

 

 

Known issues in this update 

 

Users might be unable to sign in to OWA or send emails on Exchange Server 

Symptoms: 

After installing this update, some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication. 

In some affected configurations, Exchange Server OWA might fail with an error MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142) with Event ID 1006 logged in the application log. Another reported symptom is growing email queues. Installing the October 2026 Exchange server security updates isn’t required for these issues to occur. 

 

Workaround 

This issue can be temporarily mitigated by modifying the registry key as described in Exchange servers may become unstable after installation of October 2026 Windows updates. 

The October 2026 update introduced a default limit on the amount of memory used by Endpoint Mapper when handling Endpoint Lookup calls. 

For workloads such as Exchange Server, the default limit of 512 simultaneous Endpoint Lookup calls might not be sufficient under heavy load. Administrators can use this registry setting to increase the maximum number of simultaneous Endpoint Lookup calls, which increases the amount of memory that Endpoint Mapper can use. 

 

Windows Server Update Services (WSUS) does not display error details 

 

Symptoms 

  • After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.

KB5126651: Windows Server 2022

Link to Microsoft Support

Windows Server 2019 

Applies to: Windows Server 2019 

This security update includes fixes and quality improvements that are part of the following update: 

The following is a summary of the issues that this update addresses when you install this update. The bold text within the brackets indicates the item or area of the change we are documenting. 

  • [Date and Time] 
  • This update introduces the new time zone Manitoba Standard Time, “(UTC-05:00) Manitoba.” 
  • [Authentication] Enhanced NTLM auditing is now available on Windows Server 2022 and 2019. The new auditing capabilities provide greater visibility into NTLM authentication, helping administrators identify who is using NTLM, why NTLM was selected, and where NTLM authentication is occurring. This additional visibility can help organizations identify legacy NTLM dependencies and prepare their environments to move toward more secure authentication protocols such as Kerberos. To learn more, see: Overview of NTLM auditing enhancements in Windows 11, version 24H2, Windows Server 2019, and later versions. 
  • [BitLocker] This update fixes an issue in which drives encrypted by BitLocker To Go on newer systems were not recognized by older systems. Now, you can access encrypted data on these drives when using older systems. 
  • [ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. To learn more, see KB5130741. 
  • [Distributed Key Manager (DKM)] This update automatically remediates insecure DKM container ACL configurations in AD FS by default. Administrators can opt out of automatic remediation by setting RemediateDkmAcl to 0. This change helps address an elevation of privilege vulnerability that can occur when the DKM container ACL is overly permissive. For more information about how to manage this change, see CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening. 
  • [Secure Boot] This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. Deployment through Windows Update remains ongoing across supported device. 
  • [Storage Spaces] This update addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. This issue occurs when valid tiered storage metadata is incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online. 

 

Windows 10, version 1809 

Applies to: Windows 10 Enterprise LTSC 2019 

 

This security update includes fixes and quality improvements that are part of the following update: 

The following is a summary of the issues that this update addresses when you install this update. The bold text within the brackets indicates the item or area of the change we are documenting. 

  • [Date and Time] 
  • This update introduces the new time zone Manitoba Standard Time, “(UTC-05:00) Manitoba.” 
  • [BitLocker] This update fixes an issue in which drives encrypted by BitLocker To Go on newer systems were not recognized by older systems. Now, you can access encrypted data on these drives when using older systems. 
  • [File History (known issue)] Fixed: This update addresses an issue where File History might fail to back up or restore files to an external drive or network location. Affected devices might incorrectly display a “Reconnect your drive” message even when a compatible backup drive is connected and working properly. 
  • [ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. To learn more, see KB5130741. 
  • [Secure Boot] This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. Deployment through Windows Update remains ongoing across supported device. 
  • [Storage Spaces] This update addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. This issue occurs when valid tiered storage metadata is incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online. 

 

 

Known issues in this update 

 

USB Audio Class 1.0 devices with error Code 10 or no output  

  

Symptoms 

After installing the September 8, 2026, Windows security update, some USB Audio Class 1.0 devices might fail to start or produce audio. Affected devices might experience one or more of the following symptoms: 

  • The device displays an error in Device Manager: “This device cannot start (Code 10).” 
  • No audio output. 
  • Volume controls are unresponsive or remain at zero. 
  • Sound settings are unresponsive or unavailable. 
  • Some devices might function in standard stereo configurations but fail when using multichannel audio features, including 8-channel or 3D audio modes. Some customers have reported that they’re able to restore audio in these cases by switching to 2-channel mode. 

This issue is limited to USB Audio Class 1.0 devices. 

Resolution 

This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available. 

KB5126649: Win 10 Ent LTSB 2016 Win 10 IoT Ent LTSB 2016 Windows Server 2016, all editions

Link to Microsoft Support

Important 

Free support for Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB ends on October 13, 2026. Free support for Windows Server 2016 ends soon. To learn about continuing support, see Plan for Windows Server 2016 and Windows 10 2016 LTSB end of support. 

 

Summary 

This servicing stack update (SSU) makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates make sure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates.

KB5126868: Windows Server 2016, all editions Win 10 Ent LTSB 2016 Win 10 IoT Ent LTSB 2016

Link to Microsoft Support

Important 

Support for Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB ended on October 13, 2026. Support for Windows Server 2016 ends soon. To learn more about continuing to receive updates, see Plan for Windows Server 2016 and Windows 10 2016 LTSB end of support. 

 

Windows Server 2016 

Applies to: Windows Server 2016 

This security update includes fixes and improvements that are a part of the following update: 

The following is a summary of the issues that this update addresses. The bold text within the brackets indicates the item or area of the change we are documenting. 

  • [Date and Time] 
  • This update introduces the new time zone Manitoba Standard Time, “(UTC-05:00) Manitoba.” 
  • [ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. To learn more, see KB5130741. 
  • [Distributed Key Manager (DKM)] This update automatically remediates insecure DKM container ACL configurations in AD FS by default. Administrators can opt out of automatic remediation by setting RemediateDkmAcl to 0. This change helps address an elevation of privilege vulnerability that can occur when the DKM container ACL is overly permissive. For more information about how to manage this change, see CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening. 
  • [Secure Boot] This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. Deployment through Windows Update remains ongoing across supported device. 
  • [Storage Spaces] This update addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. This issue occurs when valid tiered storage metadata is incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online. 

 

Windows 10 version 1607 

Applies to: Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB 

This security update includes fixes and improvements that are a part of the following update: 

The following is a summary of the issues that this update addresses. The bold text within the brackets indicates the item or area of the change we are documenting. 

  • [Date and Time] 
  • This update introduces the new time zone Manitoba Standard Time, “(UTC-05:00) Manitoba.” 
  • [ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. To learn more, see KB5130741. 
  • [File History (known issue)] Fixed: This update addresses an issue where File History might fail to back up or restore files to an external drive or network location. Affected devices might incorrectly display a “Reconnect your drive” message even when a compatible backup drive is connected and working properly. 
  • [Secure Boot] This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. Deployment through Windows Update remains ongoing across supported device. 
  • [Storage Spaces] This update addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. This issue occurs when valid tiered storage metadata is incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online. 

 

Known issues in this update 

USB Audio Class 1.0 devices with error Code 10 or no output 

 

 

Symptoms 

After installing the September 8, 2026, Windows security update, some USB Audio Class 1.0 devices might fail to start or produce audio. Affected devices might experience one or more of the following symptoms: 

  • The device displays an error in Device Manager: “This device cannot start (Code 10).” 
  • No audio output. 
  • Volume controls are unresponsive or remain at zero. 
  • Sound settings are unresponsive or unavailable. 
  • Some devices might function in standard stereo configurations but fail when using multichannel audio features, including 8-channel or 3D audio modes. Some customers have reported that they’re able to restore audio in these cases by switching to 2-channel mode. 

This issue is limited to USB Audio Class 1.0 devices. 

Resolution 

This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available. 

 

 

After installing the September 2026 Windows security update, some organizations might experience issues with Remote Desktop Services (RDS). 

In some environments, RDS might become unstable, resulting in RDP connections failing after several minutes, sign-in issues, or servers hanging at “Please wait for the Remote Desktop Configuration”. Related tools, including Microsoft Management Console (MMC), RDS Licensing Diagnoser, and File Explorer might also become unresponsive. Additionally, the Windows Update page might stop responding and continuously display a loading indicator. 

 

 

Resolution 

This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available.