October 13, 2026—KB5126646 (OS Build 26100.33650)

This cumulative update for Windows Server 2025 (KB5126646), includes the latest security fixes and improvements, along with non-security updates from last month’s optional preview release. Visit the Windows release health dashboard for the latest status on this release.

Announcements and messages

This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.

Windows Secure Boot certificate expiration

Secure Boot certificate updates remain in progress as Microsoft transitions devices from certificates that began expiring in 2026 to newer certificates. Devices that have not yet received the newer certificates can continue to start and receive standard Windows updates. Microsoft will continue delivering the newer Secure Boot certificates to eligible devices through Windows Update.

Improvements

This security update contains fixes and quality improvements from KB5122871 (released September 8, 2026) and the out-of-band update KB5129235 (released September 14, 2026). The following summary outlines key issues addressed by this update. Also, included are available new features. The bold text within the brackets indicates the item or area of the change. 

• [Quick machine recovery] New! Quick machine recovery is now supported on Windows Server 2025. During outages, Quick machine recovery helps recover devices from critical boot failures by using Windows Recovery Environment (WinRE) to find and apply targeted remediations from Windows Update. The feature is disabled by default on Windows Server 2025 editions. Administrators can enable the feature through Group Policy to support streamlined recovery during widespread outages and reduce the need for manual intervention. Recovery depends on an applicable remediation being available. To learn more, see Quick machine recovery.

• [ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. To learn more, see KB5130741.

• [Security] This update adds support for ML-KEM post-quantum key exchange in Transport Layer Security (TLS) 1.3, helping protect encrypted connections against future quantum-computing threats.

• [Time and Date]

  • This update updates Windows time-zone data to support permanent daylight-saving time (DST) in British Columbia and Alberta starting in November 2026.

  • This update introduces the new time zone Manitoba Standard Time "(UTC-5:00) Manitoba".

• [Security] This update upgrades the version of cURL included with Windows to version 8.21.0.

• [Networking] This update improves the NetUseAdd function, helping it establish SMB network connections successfully during NULL session attempts.

• [Authentication] This update improves Netlogon secure channel connections, helping member servers connect successfully to domain controllers that were set up before Windows Server 2025.

• [Emoji] This update improves security for emoji search in the Expressive Input Panel by updating the libraries used by EmojiSearchData.

• [Hyper-V] This update improves the reliability of Intel Trusted Domain Extensions (TDX) confidential virtual machines in Hyper-V reliability issues affecting TDX operation.

• [Distributed Key Manager (DKM)] This update automatically remediates insecure DKM container ACL configurations in AD FS by default. Administrators can opt out of automatic remediation by setting RemediateDkmAcl to 0. This change helps address an elevation of privilege vulnerability that can occur when the DKM container ACL is overly permissive. For more information about how to manage this change, see CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening.

• [Secure Boot] This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. Deployment through Windows Update remains ongoing across supported devices.

If you've already installed previous updates, your device will download and install only the new updates included in this package.

For more information about security vulnerabilities, see the Security Update Guide and the October 2026 Security Updates.

Windows Server 2025 servicing stack update (KB5126645) - 26100.33634

This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates. To learn more about SSUs, see Servicing stack updates.

Known issues in this update

Windows Server Update Services (WSUS) does not display error details

After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.

How to get this update

Before you install this update

Deployment

If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.

To ensure the boot.stl file is included as part of the installation media, do one of the following:

• Use the Update WinPE script to update an existing Windows image. (Recommended)
• Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.

For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.

---

File information

For a list of the files provided in this update, download the file information for cumulative update KB5126646.

For a list of the files provided in the servicing stack update, download the file information for SSU KB5126645 - version 26100.33634.