Microsoft's November 2026 Patch Tuesday addressed 1,235 vulnerabilities across its products — including an actively exploited Outlook zero‑day — and those fixes are bundled into the Windows 10 KB5131096 extended security update.
What KB5131096 delivers: security fixes, bug patches, and no new features
Microsoft describes KB5131096 as an extended security update that "mainly includes security updates and bug fixes." The company notes that it no longer releases new features for Windows 10, and after installation consumer and enterprise images advance to specific builds: Windows 10 will be updated to build 19045.7846, and Windows 10 Enterprise LTSC 2021 will be updated to build 19044.7846. The update explicitly includes the fixes released in the November 2026 Patch Tuesday cycle, which covered 1,235 vulnerabilities across Microsoft products and addressed one actively exploited Outlook zero‑day flaw.
How to obtain KB5131096 and what systems are eligible
Administrators and customers running Windows 10 Enterprise LTSC or enrolled in the Extended Security Updates (ESU) program can get KB5131096 through the normal Windows Update path: open Settings, click Windows Update, and run a manual "Check for Updates." Microsoft frames this release as part of continued security maintenance for qualifying Windows 10 lines rather than feature development.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogDaylight saving time rules changed for Cuba — immediate timetable and guidance
KB5131096 adjusts daylight saving time (DST) rules for Cuba for the extended 2026–2027 period. Microsoft states Cuba remains on UTC‑04:00 and will not observe the November 2026 and March 2027 DST transitions. According to the update, Cuba will return to UTC‑05:00 in November 2027 and resume its regular seasonal schedule in 2028. For additional, ongoing guidance Microsoft points administrators to its Daylight Saving Time & Time Zone Blog.
Specific bug fixes: printing, Remote Desktop, PowerShell signing, and USB audio
- Printing: A fix addresses an issue introduced by the October 2026 update where adding a printer published in Active Directory via Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87 ("The parameter is incorrect"). Microsoft says this issue does not generally affect existing printers or printing.
- Remote Desktop: The update fixes two problems: one where the "Specify thumbprints of certificates representing trusted .rdp publishers" policy could not be configured successfully through Microsoft Intune, and another where Remote Desktop shadow connections could fail with an "Unspecified error" on Windows Server 2016 and Windows Server 2012 R2 after the October 14, 2026 update.
- Windows PowerShell script signing: Microsoft tightened encoding validation for PowerShell signature verification. As a result, scripts that contain invalid UTF‑8 encoding might now fail signature validation even if they were previously accepted. The vendor advises reviewing affected scripts, saving them using valid UTF‑8 encoding with a byte order mark (BOM), and signing them again; Microsoft links to "Encoding Guidance for Signed PowerShell Scripts" for further detail.
- USB Audio Class 1.0 devices: Microsoft reports it has resolved all remaining known issues introduced by the September 2026 Windows security updates. Those earlier problems caused some USB Audio Class 1.0 devices to stop producing audio, fail to start with Code 10 errors, or exhibit unresponsive volume controls and sound settings. Microsoft previously issued an emergency out‑of‑band update on September 14 to fix issues affecting 8‑channel and 3D audio modes; KB5131096 completes the remaining audio fixes.
What this means for technologists, enterprises, and end users
- Technologists and security teams: The inclusion of the November 2026 Patch Tuesday fixes — 1,235 vulnerabilities and an actively exploited Outlook zero‑day — makes KB5131096 a high priority for eligible Windows 10 Enterprise LTSC and ESU environments. Teams must also account for the PowerShell signing change: affected scripts should be validated, saved with UTF‑8 + BOM, and re‑signed to prevent runtime failures.
- Enterprises and procurement leaders: Organizations running LTSC or enrolled in ESU can apply the update through Windows Update; they should validate printer workflows where Active Directory‑published printers are added, and test Remote Desktop shadowing on older Server 2016 and 2012 R2 hosts to confirm the prescribed fixes resolve any residual issues.
- End users and device owners: Users with USB Audio Class 1.0 devices that experienced failures or unresponsive controls after the September updates should see those remaining issues resolved after applying KB5131096. In regions affected by Cuba's DST rule change, system clocks and scheduling may be affected until November 2027 according to the timeline Microsoft provided.
Microsoft concludes this release cycle by packaging the November Patch Tuesday security fixes and a focused set of bug repairs into KB5131096 for eligible Windows 10 lines. For administrators, the next concrete steps are straightforward: install the update via Windows Update if eligible, review and re‑encode/re‑sign PowerShell scripts where necessary, and verify printer and Remote Desktop behaviors on affected servers and endpoints.
