October 13, 2026—KB5126651 (OS Build 17763.9376)

Applies To
Windows Server 2019 Win 10 Ent LTSC 2019

Summary

This article lists the security issues and quality improvements included in this cumulative security update.

Applies to: Windows Server 2019

This security update includes fixes and quality improvements that are part of the following update:

The following is a summary of the issues that this update addresses when you install this update. The bold text within the brackets indicates the item or area of the change we are documenting.

  • [Time and Date]

    • This update enables permanent Daylight Savings Time (DST) support for British Columbia and Alberta starting in November 2026.

    • This update introduces the new time zone Manitoba Standard Time "(UTC-5:00) Manitoba".

  • [Authentication] Enhanced NTLM auditing is now available on Windows Server 2022 and 2019. The new auditing capabilities provide greater visibility into NTLM authentication, helping administrators identify who is using NTLM, why NTLM was selected, and where NTLM authentication is occurring. This additional visibility can help organizations identify legacy NTLM dependencies and prepare their environments to move toward more secure authentication protocols such as Kerberos. To learn more, see: Overview of NTLM auditing enhancements in Windows 11, version 24H2, Windows Server 2019, and later versions.

  • [BitLocker] This update fixes an issue in which drives encrypted by BitLocker To Go on newer systems were not recognized by older systems. Now, you can access encrypted data on these drives when using older systems.

  • [ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. To learn more, see KB5130741.

  • [Distributed Key Manager (DKM)] This update automatically remediates insecure DKM container ACL configurations in AD FS by default. Administrators can opt out of automatic remediation by setting RemediateDkmAcl to 0. This change helps address an elevation of privilege vulnerability that can occur when the DKM container ACL is overly permissive. For more information about how to manage this change, see CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening.

  • [Secure Boot] This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. Deployment through Windows Update remains ongoing across supported device.

Note If you installed earlier updates, only the new updates contained in this package will be downloaded and installed on your device.

For information about security vulnerabilities, see the Security Update Guide and October 2026 Security Updates.

Known issues in this update

USB Audio Class 1.0 devices with error Code 10 or no output

Symptoms

After installing the September 8, 2026, Windows security update, some USB Audio Class 1.0 devices might fail to start or produce audio. Affected devices might experience one or more of the following symptoms:

  • The device displays an error in Device Manager: "This device cannot start (Code 10).”
  • No audio output.
  • Volume controls are unresponsive or remain at zero.
  • Sound settings are unresponsive or unavailable.
  • Some devices might function in standard stereo configurations but fail when using multichannel audio features, including 8-channel or 3D audio modes. Some customers have reported that they're able to restore audio in these cases by switching to 2-channel mode.

This issue is limited to USB Audio Class 1.0 devices.

Resolution

This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available.

IT administrators who need an immediate workaround for the symptoms not addressed yet by the OOB update should contact Microsoft Support for Business for assistance.

Servicing stack update (KB5126650) - 17763.9354

Microsoft now combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). SSUs improves the reliability of the update process and includes fixes to the servicing stack, the component that installs Windows updates.

This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. To ensure that the device can access the required certificate update domains to successfully download and install certificate updates, see Certificate downloads and revocation lists and Azure Certificate Authority details. To learn more about SSUs, see Servicing stack updates.

How to get this update

Before you install this update

You must have installed the August 10, 2021 SSU (KB5005112 before installing this cumulative update.

Get and install this update

To get and install this update, use one of the following Windows or Microsoft release channels.

Available Next Step
Available This update will be downloaded and installed automatically from Windows Update.

File information

A list of the files that are included in this update are provided in a CSV (Comma delimited) (*.csv) file. The file can be opened in a text editor such as Notepad or in Microsoft Excel.

Note The English (United States) version of this software update might contain files for additional languages.

Download Download the file information for cumulative update KB5126651.

Download Download the file information for SSU (KB5126650) - version 17763.9354.

References

  • Microsoft Store application updates

    Windows updates do not install Microsoft Store application updates. If you are an enterprise user, see Microsoft Store apps - Configuration Manager. If you are a consumer user, see Get updates for apps and games in Microsoft Store.

  • Secure Boot certificate updates remain in progress as Microsoft transitions devices from certificates that began expiring in 2026 to newer certificates. Devices that have not yet received the newer certificates can continue to start and receive standard Windows updates. Microsoft will continue delivering the newer Secure Boot certificates to eligible devices through Windows Update.

  • End of support

    Microsoft will no longer provide free software updates from Windows Update, technical assistance, or security fixes on the following end dates. We recommend that you upgrade to a later version of Windows Server.