This non-security out-of-band (OOB) update for Windows Server 2025 (KB5134137) is cumulative. It includes updates from previous releases, along with additional non-security improvements.
Who should install this update
This out-of-band (OOB) update is intended for devices that do not receive current certificate trust list (CTL) updates, including updates to the list of untrusted certificates. Examples include devices in disconnected environments, devices that cannot access Microsoft’s certificate-update service and devices where automatic CTL updates are disabled.
Improvements
This update contains fixes and quality improvements from KB5126646 (released October 13, 2026). The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change.
- [Certificates] This update includes an updated trusted root certificate payload in the Windows cumulative update for devices that cannot access Microsoft’s certificate-update service and devices where automatic certificate trust list (CTL) updates are disabled. To learn more, see Certificates and trust in Windows.
If you've already installed previous updates, your device will download and install only the new updates included in this package.
For more information about security vulnerabilities, see the Security Update Guide and the October 2026 Security Updates.
Windows Server 2025 servicing stack update (KB5126645) - 26100.33634
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates. To learn more about SSUs, see Servicing stack updates.
Known issues in this update
Users might be unable to sign in to OWA or send emails on Exchange Server
Symptoms:
After installing this update, some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication.
In some affected configurations, Exchange Server OWA might fail with an error MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142) with Event ID 1006 logged in the application log. Another reported symptom is growing email queues. Installing the October 2026 Exchange server security updates isn’t required for these issues to occur.
Workaround
This issue can be temporarily mitigated by modifying the registry key as described in Exchange servers may become unstable after installation of October 2026 Windows updates.
The October 2026 update introduced a default limit on the amount of memory used by Endpoint Mapper when handling Endpoint Lookup calls.
For workloads such as Exchange Server, the default limit of 512 simultaneous Endpoint Lookup calls might not be sufficient under heavy load. Administrators can use this registry setting to increase the maximum number of simultaneous Endpoint Lookup calls, which increases the amount of memory that Endpoint Mapper can use.
Microsoft Support: An additional mitigation is available for affected devices through Microsoft Support. To apply this mitigation in your organization, please contact Microsoft Support for business.
Next steps: Microsoft investigating this issue and will provide more information when it is available.
Windows Server Update Services (WSUS) does not display error details
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
How to get this update
Before you install this update
- Servicing Stack Update (SSU): You must have the latest SSU installed to install this update.
Deployment
If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.
Note
The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.
To ensure the boot.stl file is included as part of the installation media, do one of the following:
- Use the Update WinPE script to update an existing Windows image. (Recommended)
- Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.
For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.
Install this update
To install this update, use one of the following Windows and Microsoft release channels.
| Available | Next Step |
|---|---|
|
This update is available from the Microsoft Update Catalog. |
File information
A list of the files that are included in this update are provided in a CSV (Comma delimited) (*.csv) file. The file can be opened in a text editor such as Notepad or in Microsoft Excel.
Note The English (United States) version of this software update might contain files for additional languages.
Download the file information for out-of-band update KB5134137.
Download the file information for SSU (KB5126645) - version 26100.33634.