November 10, 2026—KB5132061 (OS Builds 26300.9974, 26200.9974 and 26100.9974)

Applies To

Windows 11 version 26H2, all editions Windows 11 version 25H2, all editions Windows 11 Enterprise and Education, version 24H2

Want a quick overview?: Watch the Windows 11 release note video for this update.

Announcements and messages

This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.

Important

Because of minimal operations during the Western holidays and the upcoming new year, there will be no December 2026 non-security preview update in the second part of the month. Normal monthly servicing for both security and non-security preview updates will resume in January 2027.

Windows Secure Boot certificate expiration

Secure Boot certificate updates remain in progress as Microsoft transitions devices from certificates that began expiring in 2026 to newer certificates. Devices that have not yet received the newer certificates can continue to start and receive standard Windows updates. Microsoft will continue delivering the newer Secure Boot certificates to eligible devices through Windows Update.

Improvements

This update includes improvements from the following previously released updates:

Windows 11, versions 25H2 and 26H2
Windows 11, version 24H2

Applies to: Windows 11, versions 26H2 and 25H2, all editions

This security update includes quality improvements. Key changes include:

[Security updates] This update provides security improvements. For more information about the security vulnerabilities resolved by this update, see the Security Update Guide
[Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Certificate deployment via Windows updates continues across supported PCs and non-managed business devices in the coming months.
[Audio (known issue)] - Fixed: USB Audio 1.0 devices might fail to start and display error code 10 in Device Manager after installing a recent security update.
[Printing] Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, “The parameter is incorrect.” This issue was introduced by the October 2026 update and does not generally affect existing printers or printing.
[Security] This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. This change helps reduce exposure to NTLM relay attacks and provides auditing to identify connections that are not using signing. To learn more, see NTLM signing security improvements in Windows.
[Date and Time] This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.
- For the latest DST and time zone guidance, see the Daylight Saving Time & Time Zone Blog.
[Remote Desktop] This update addresses an issue where Remote Desktop Protocol (RDP) connections might fail on the client due to a certificate mismatch after the October 2026 non-security preview update.
[Windows PowerShell] This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. As a result, scripts containing invalid UTF-8 encoding might fail signature validation, even if they were previously accepted. To resolve this issue, review the affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again. For further guidance, see Encoding Guidance for Signed PowerShell Scripts.

Known issues in this update

Microsoft is not currently aware of any issues with this update.

Applies to: Windows 11, version 24H2, Enterprise and Education editions only.

Note

This update includes improvements and fixes from the November 2026 security update, along with those previously released for Windows 11, versions 25H2 and 26H2, in the October 2026 non-security preview update (KB5127936).

This security update includes quality improvements. Key changes include:

[Security updates] This update provides security improvements. For more information about the security vulnerabilities resolved by this update, see the Security Update Guide
[Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Certificate deployment via Windows updates continues across supported PCs and non-managed business devices in the coming months.
[Audio (known issue)] Fixed
- USB Audio 1.0 devices might fail to start and display error code 10 in Device Manager after installing a recent security update.
- This update fixes an issue where HDMI and DisplayPort audio playback might fail on certain AMD graphics cards.
[Printing] Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, “The parameter is incorrect.” This issue was introduced by the October 2026 update and does not generally affect existing printers or printing.
[Security] This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. This change helps reduce exposure to NTLM relay attacks and provides auditing to identify connections that are not using signing. To learn more, see NTLM signing security improvements in Windows.
[Date and Time] This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.
- For the latest DST and time zone guidance, see the Daylight Saving Time & Time Zone Blog.
[Remote Desktop] This update addresses an issue where Remote Desktop Protocol (RDP) connections might fail on the client due to a certificate mismatch after the October 2026 non-security preview update.
[Windows PowerShell] This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. As a result, scripts containing invalid UTF-8 encoding might fail signature validation, even if they were previously accepted. To resolve this issue, review the affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again. For further guidance, see Encoding Guidance for Signed PowerShell Scripts.

Known issues in this update

Microsoft is not currently aware of any issues with this update.

Components updates

AI components

This release updates the following AI components to version 1.2610.1063.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model.

To learn more, see Release information for AI components.

Servicing stack update (SSU)

Microsoft combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). This Windows update includes KB5132688 (Build 26100.9971), which improves the reliability of the Windows update installation process. To learn more about SSUs, see Servicing stack updates.

How to get this update

Before you install this update

Windows 11, version 26H2

For Windows Update: For Windows 11, version 26H2, you must have the Windows update released on or after September 22, 2026 (such as KB5124010) installed before installing this update.
For Windows Server Update Services (WSUS) deployment or when installing the standalone package from Microsoft Update Catalog: For Windows 11, version 26H2, you must have the Windows update released on or after September 22, 2026 (such as KB5124010) installed before installing this update.
Servicing Stack Update (SSU): You must have installed servicing stack update version 26100.9539 or later before installing this update. To determine the latest SSU installed on your device, run DISM /Online /Get-Packages | findstr /i "ServicingStack" from an elevated command prompt. The Package Identity line returned must be version 26100.9539 or later.

Windows 11, version 24H2 and 25H2

For Windows Update: For Windows 11, version 24H2 and Windows 11, version 25H2, you must have the Windows update released on or after June 10, 2025 (such as KB5060842) installed before installing this update.
For Windows Server Update Services (WSUS) deployment or when installing the standalone package from Microsoft Update Catalog: For Windows 11, version 24H2 and Windows 11, version 25H2, you must have the Windows update released on or after June 10, 2025 (such as KB5060842) installed before installing this update.
Servicing Stack Update (SSU): You must have installed servicing stack update version 26100.4193 or later before installing this update. To determine the latest SSU installed on your device, run DISM /Online /Get-Packages | findstr /i "ServicingStack" from an elevated command prompt. The Package Identity line returned must be version 26100.4193 or later.

Deployment

If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.

Note

The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.

To ensure the boot.stl file is included as part of the installation media, do one of the following:

Use the Update WinPE script to update an existing Windows image. (Recommended)
Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.

For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.

Available	Next Step
	Open Start > Settings > Windows Update > Advanced options > Optional updates. In the Optional updates available area, you will find the link to download and install available updates. Check for optional updates

Available	Next Step
	These changes will appear in the next security update to Windows Update for Business.

Available	Next Step
	To install this update, download the standalone package(s) for this update from the Microsoft Update Catalog. This update contains MSU files that require installation in a specific order. Follow the Arm64 installation instructions or x64 installation instructions, as appropriate. If you install additional Dynamic Update packages, use versions from the same release month as this update. If a Safe OS Dynamic Update or Setup Dynamic Update is not available for the same release month, use the most recently released version. Note This latest cumulative update includes updates for AI components. AI components are applicable only to Copilot+ PCs and will not install on other Windows client PCs or Windows Server.

Available

Next Step

To install this update, download the standalone package(s) for this update from the Microsoft Update Catalog. This update contains MSU files that require installation in a specific order. Follow the Arm64 installation instructions or x64 installation instructions, as appropriate.

If you install additional Dynamic Update packages, use versions from the same release month as this update. If a Safe OS Dynamic Update or Setup Dynamic Update is not available for the same release month, use the most recently released version.

Note This latest cumulative update includes updates for AI components. AI components are applicable only to Copilot+ PCs and will not install on other Windows client PCs or Windows Server.

Arm64 installation instructions

Note The Microsoft Update Catalog may include one or more required checkpoint cumulative updates and the target cumulative update. Install the checkpoint cumulative updates in order before installing the target cumulative update.

Download all MSU files for update KB5132061 from the Microsoft Update Catalog and place them in the same folder (for example, C:\Packages). Ensure no other files are present in the folder.

This update consists of the following update file(s).

Item	MSU file
Required checkpoint cumulative update	windows11.0-kb5043080-arm64_
Target cumulative update	windows11.0-kb5132061-arm64_

Method 1: Install each MSU file individually, in order

Double-click each file in the following order to install that update (if there is more than one .msu file listed):

windows11.0-kb5043080-arm64_
windows11.0-kb5132061-arm64_

Note If a required checkpoint cumulative update is already present, a message will indicate that the update is already installed. For guidance on using the Windows Update Standalone Installer (Wusa.exe), see Description of the Windows Update Standalone Installer in Windows.

Method 2: Install all MSU files together

Use Deployment Image Servicing and Management (DISM.exe) to install the target cumulative update. DISM automatically scans the folder specified in the PackagePath folder and installs any required checkpoint cumulative updates.

Updating a Windows PC

To apply this update on a running Windows PC, run the following command from an elevated Command Prompt window:

DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-KB5132061-arm64_.msu

Or, run the following command from an elevated PowerShell window:

Add-WindowsPackage -Online -PackagePath "c:\\packages\\windows11.0-KB5132061-arm64_.msu"

Updating Windows installation media

To apply this update to Windows installation media, see Update Windows installation media with Dynamic Update.

To add this update to a mounted image, run the following command from an elevated Command Prompt window:

DISM /Image:mountdir /Add-Package /PackagePath:windows11.0-KB5132061-arm64_08dafc621b261936677b0827cd72ef2eb759b626.msu

Or, run the following command from an elevated PowerShell window:

Add-WindowsPackage -Path "c:\\offline" -PackagePath "windows11.0-KB5132061-arm64_.msu" -PreventPending

x64 installation instructions

Download all MSU files for update KB5132061 from the Microsoft Update Catalog and place them in the same folder (for example, C:\Packages). Ensure no other files are present in the folder.

This update consists of the following update file(s).

Item	MSU file
Required checkpoint cumulative update	windows11.0-kb5043080-x64_
Target cumulative update	windows11.0-kb5132061-x64_

Method 1: Install each MSU file individually, in order

Double-click each file in the following order to install that update (if there is more than one .msu file listed):

windows11.0-kb5043080-x64_
windows11.0-kb5132061-x64_

Method 2: Install all MSU files together

Updating a Windows PC

To apply this update on a running Windows PC, run the following command from an elevated Command Prompt window:

DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-KB5132061-x64_.msu

Or, run the following command from an elevated PowerShell window:

Add-WindowsPackage -Online -PackagePath "c:\\packages\\windows11.0-KB5132061-x64_.msu"

Updating Windows installation media

To apply this update to Windows installation media, see Update Windows installation media with Dynamic Update.

To add this update to a mounted image, run the following command from an elevated Command Prompt window:

DISM /Image:mountdir /Add-Package /PackagePath:windows11.0-KB5132061-x64_.msu

Or, run the following command from an elevated PowerShell window:

Add-WindowsPackage -Path "c:\\offline" -PackagePath "windows11.0-KB5132061-x64_.msu" -PreventPending

Available	Next Step
	You can import this update into Windows Server Update Services (WSUS) manually. See the Microsoft Update Catalog for instructions.

File information

A list of the files that are included in this update are provided in a CSV (Comma delimited) (*.csv) file. The file can be opened in a text editor such as Notepad or in Microsoft Excel.

Note The English (United States) version of this software update might contain files for additional languages.

Download the file information for cumulative update KB5132061.