November 13, 2026—KB5136489 (OS Build 26100.33828) Out-of-band

Applies To

Windows Server 2025, all editions

This non-security out-of-band (OOB) update for Windows Server 2025 (KB5136489) is cumulative. It includes updates from previous releases, along with additional non-security improvements.

Tip

To learn more about Windows out-of-band (OOB) updates, including the differences between security and non-security updates and guidance for deploying them, see Windows out-of-band (OOB) updates.

Improvements

This update contains fixes and quality improvements from KB5131080 (released November 10, 2026). The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change.

[Licensing and Activation] Fixed: An issue where certain Windows licensing and activation operations using the Software Licensing Management Tool (SLMGR) might fail with error 0x80041008 (Invalid parameter). This issue primarily affected organizations using slmgr.vbs commands or automated processes to configure Key Management Service (KMS) activation, install product keys, or manage Windows licensing. Devices that were already activated remained activated, and devices with existing KMS configurations that did not require additional slmgr.vbs commands were not affected.

If you've already installed previous updates, your device will download and install only the new updates included in this package.

Windows Server 2025 servicing stack update (KB5131079) - 26100.33822

This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates. To learn more about SSUs, see Servicing stack updates.

Known issues in this update

Windows Server Update Services (WSUS) does not display error details

After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.

How to get this update

Before you install this update

Servicing Stack Update (SSU): You must have installed servicing stack update version 26100.2032 or later before installing this update. To determine the latest SSU installed on your device, run DISM /Online /Get-Packages | findstr /i "ServicingStack" from an elevated command prompt. The Package Identity line returned must be version 26100.2032 or later.

Deployment

If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.

Note

The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.

To ensure the boot.stl file is included as part of the installation media, do one of the following:

Use the Update WinPE script to update an existing Windows image. (Recommended)
Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.

For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.

Available	Next Step
	This update is available from the Microsoft Update Catalog.

Available	Next step
	To install this update, download the standalone package(s) for this update from the Microsoft Update Catalog. This update contains MSU files that require installation in a specific order. Follow the x64 installation instructions. If you install additional Dynamic Update packages, use versions from the same release month as this update. If a Safe OS Dynamic Update or Setup Dynamic Update is not available for the same release month, use the most recently released version. Note This latest cumulative update includes updates for AI components. AI components are applicable only to Copilot+ PCs and will not install on other Windows client PCs or Windows Server.

Available

Next step

To install this update, download the standalone package(s) for this update from the Microsoft Update Catalog. This update contains MSU files that require installation in a specific order. Follow the x64 installation instructions.

If you install additional Dynamic Update packages, use versions from the same release month as this update. If a Safe OS Dynamic Update or Setup Dynamic Update is not available for the same release month, use the most recently released version.

Note This latest cumulative update includes updates for AI components. AI components are applicable only to Copilot+ PCs and will not install on other Windows client PCs or Windows Server.

x64 installation instructions

Note The Microsoft Update Catalog may include one or more required checkpoint cumulative updates and the target cumulative update. Install the checkpoint cumulative updates in order before installing the target cumulative update.

Download all MSU files for update KB5136489 from the Microsoft Update Catalog and place them in the same folder (for example, C:/Packages). Ensure no other files are present in the folder.

This update consists of the following update file(s).

Item	MSU file
Required checkpoint cumulative update	windows11.0-kb5043080-x64_.msu
Target cumulative update	windows11.0-kb5136489-x64_.msu

Method 1: Install each MSU file individually, in order

Double-click each file in the following order to install that update (if there is more than one .msu file listed):

windows11.0-kb5043080-x64_.msu
windows11.0-kb5136489-x64_.msu

Note If a required checkpoint cumulative update is already present, a message will indicate that the update is already installed. For guidance on using the Windows Update Standalone Installer (Wusa.exe), see Description of the Windows Update Standalone Installer in Windows.

Method 2: Install all MSU files together

Use Deployment Image Servicing and Management (DISM.exe) to install the target cumulative update. DISM automatically scans the folder specified in the PackagePath folder and installs any required checkpoint cumulative updates.

Updating a Windows PC

To apply this update on a running Windows PC, run the following command from an elevated Command Prompt window:

DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-kb5136489-x64_.msu

Or, run the following command from an elevated PowerShell window:

Add-WindowsPackage -Online -PackagePath "c:\\packages\\windows11.0-kb5136489-x64_.msu"

Updating Windows installation media

To apply this update to Windows installation media, see Update Windows installation media with Dynamic Update.

To add this update to a mounted image, run the following command from an elevated Command Prompt window:

DISM /Image:mountdir /Add-Package /PackagePath:windows11.0-kb5136489-x64_.msu

Or, run the following command from an elevated PowerShell window:

Add-WindowsPackage -Path "c:\\offline" -PackagePath "windows11.0-kb5136489-x64_.msu" -PreventPending

File information

A list of the files that are included in this update are provided in a CSV (Comma delimited) (*.csv) file. The file can be opened in a text editor such as Notepad or in Microsoft Excel.

Note The English (United States) version of this software update might contain files for additional languages.

Download the file information for out-of-band update KB5136489.

Download the file information for SSU (KB5131079) - version 26100.33822.

Change log

Change date	Change description
November 13, 2026	This is the original publish date for this update.