Announcements and messages
This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.
Important
Because of minimal operations during the Western holidays and the upcoming new year, there will be no December 2026 non-security preview update in the second part of the month. Normal monthly servicing for both security and non-security preview updates will resume in January 2027.
Windows Secure Boot certificate expiration
Secure Boot certificate updates remain in progress as Microsoft transitions devices from certificates that began expiring in 2026 to newer certificates. Devices that have not yet received the newer certificates can continue to start and receive standard Windows updates. Microsoft will continue delivering the newer Secure Boot certificates to eligible devices through Windows Update.
Improvements
This update includes improvements from the following previously released updates:
Applies to: Windows 11, versions 26H2 and 25H2, all editions
This security update includes quality improvements. Key changes include:
- [Security updates] This update provides security improvements. For more information about the security vulnerabilities resolved by this update, see the Security Update Guide.
- [Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Certificate deployment via Windows updates continues across supported PCs and non-managed business devices in the coming months.
- [Audio (known issue)] - Fixed: USB Audio 1.0 devices might fail to start and display error code 10 in Device Manager after installing a recent security update.
- [Printing] Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, “The parameter is incorrect.” This issue was introduced by the October 2026 update and does not generally affect existing printers or printing.
- [Security] This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. This change helps reduce exposure to NTLM relay attacks and provides auditing to identify connections that are not using signing. To learn more, see NTLM signing security improvements in Windows.
- [Date and Time] This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.
- [Remote Desktop] This update addresses an issue where Remote Desktop Protocol (RDP) connections might fail on the client due to a certificate mismatch after the October 2026 non-security preview update.
- [Windows PowerShell] This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. As a result, scripts containing invalid UTF-8 encoding might fail signature validation, even if they were previously accepted. To resolve this issue, review the affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again. For further guidance, see Encoding Guidance for Signed PowerShell Scripts.
Known issues in this update
Microsoft is not currently aware of any issues with this update.
Applies to: Windows 11, version 24H2, Enterprise and Education editions only.
Note
This update includes improvements and fixes from the November 2026 security update, along with those previously released for Windows 11, versions 25H2 and 26H2, in the October 2026 non-security preview update (KB5127936).
This security update includes quality improvements. Key changes include:
[Security updates] This update provides security improvements. For more information about the security vulnerabilities resolved by this update, see the Security Update Guide.
[Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Certificate deployment via Windows updates continues across supported PCs and non-managed business devices in the coming months.
[Audio (known issue)] Fixed
- USB Audio 1.0 devices might fail to start and display error code 10 in Device Manager after installing a recent security update.
- This update fixes an issue where HDMI and DisplayPort audio playback might fail on certain AMD graphics cards.
[Printing] Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, “The parameter is incorrect.” This issue was introduced by the October 2026 update and does not generally affect existing printers or printing.
[Security] This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. This change helps reduce exposure to NTLM relay attacks and provides auditing to identify connections that are not using signing. To learn more, see NTLM signing security improvements in Windows.
[Date and Time] This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.
[Remote Desktop] This update addresses an issue where Remote Desktop Protocol (RDP) connections might fail on the client due to a certificate mismatch after the October 2026 non-security preview update.
[Windows PowerShell] This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. As a result, scripts containing invalid UTF-8 encoding might fail signature validation, even if they were previously accepted. To resolve this issue, review the affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again. For further guidance, see Encoding Guidance for Signed PowerShell Scripts.
Known issues in this update
Microsoft is not currently aware of any issues with this update.
Components updates
AI components
This release updates the following AI components to version 1.2610.1063.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model.
To learn more, see Release information for AI components.
Servicing stack update (SSU)
Microsoft combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). This Windows update includes KB5132688 (Build 26100.9971), which improves the reliability of the Windows update installation process. To learn more about SSUs, see Servicing stack updates.
How to get this update
Before you install this update
Windows 11, version 26H2
For Windows Update: For Windows 11, version 26H2, you must have the Windows update released on or after September 22, 2026 (such as KB5124010) installed before installing this update.
For Windows Server Update Services (WSUS) deployment or when installing the standalone package from Microsoft Update Catalog: For Windows 11, version 26H2, you must have the Windows update released on or after September 22, 2026 (such as KB5124010) installed before installing this update.
Servicing Stack Update (SSU): You must have installed servicing stack update version 26100.9539 or later before installing this update. To determine the latest SSU installed on your device, run DISM /Online /Get-Packages | findstr /i "ServicingStack" from an elevated command prompt. The Package Identity line returned must be version 26100.9539 or later.
Windows 11, version 24H2 and 25H2
For Windows Update: For Windows 11, version 24H2 and Windows 11, version 25H2, you must have the Windows update released on or after June 10, 2025 (such as KB5060842) installed before installing this update.
For Windows Server Update Services (WSUS) deployment or when installing the standalone package from Microsoft Update Catalog: For Windows 11, version 24H2 and Windows 11, version 25H2, you must have the Windows update released on or after June 10, 2025 (such as KB5060842) installed before installing this update.
Servicing Stack Update (SSU): You must have installed servicing stack update version 26100.4193 or later before installing this update. To determine the latest SSU installed on your device, run DISM /Online /Get-Packages | findstr /i "ServicingStack" from an elevated command prompt. The Package Identity line returned must be version 26100.4193 or later.
Deployment
If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.
Note
The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.
To ensure the boot.stl file is included as part of the installation media, do one of the following:
- Use the Update WinPE script to update an existing Windows image. (Recommended)
- Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.
For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.
Install this update
To install this update, use one of the following Windows and Microsoft release channels.
| Available |
Next Step |
|
Open Start 
> Settings 
> Windows Update > Advanced options > Optional updates. In the Optional updates available area, you will find the link to download and install available updates.
Check for optional updates |
| Available |
Next Step |
|
These changes will appear in the next security update to Windows Update for Business. |
| Available |
Next Step |
|
|
To install this update, download the standalone package(s) for this update from the Microsoft Update Catalog. This update contains MSU files that require installation in a specific order. Follow the Arm64 installation instructions or x64 installation instructions, as appropriate.
If you install additional Dynamic Update packages, use versions from the same release month as this update. If a Safe OS Dynamic Update or Setup Dynamic Update is not available for the same release month, use the most recently released version.
Note This latest cumulative update includes updates for AI components. AI components are applicable only to Copilot+ PCs and will not install on other Windows client PCs or Windows Server. |
Arm64 installation instructions
Note The Microsoft Update Catalog may include one or more required checkpoint cumulative updates and the target cumulative update. Install the checkpoint cumulative updates in order before installing the target cumulative update.
Download all MSU files for update KB5132061 from the Microsoft Update Catalog and place them in the same folder (for example, C:\Packages). Ensure no other files are present in the folder.
This update consists of the following update file(s).
Method 1: Install each MSU file individually, in order
Double-click each file in the following order to install that update (if there is more than one .msu file listed):
- windows11.0-kb5043080-arm64_df540a05f9b118e339c5520f4090bb5d450f090b.msu
- windows11.0-kb5132061-arm64_60ca6095fa14ce86f340e9b42b0d90a3ef48cde0.msu
Note If a required checkpoint cumulative update is already present, a message will indicate that the update is already installed. For guidance on using the Windows Update Standalone Installer (Wusa.exe), see Description of the Windows Update Standalone Installer in Windows.
Method 2: Install all MSU files together
Use Deployment Image Servicing and Management (DISM.exe) to install the target cumulative update. DISM automatically scans the folder specified in the PackagePath folder and installs any required checkpoint cumulative updates.
Updating a Windows PC
To apply this update on a running Windows PC, run the following command from an elevated Command Prompt window:
DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-KB5132061-arm64_60ca6095fa14ce86f340e9b42b0d90a3ef48cde0.msu
Or, run the following command from an elevated PowerShell window:
Add-WindowsPackage -Online -PackagePath "c:\\packages\\windows11.0-KB5132061-arm64_60ca6095fa14ce86f340e9b42b0d90a3ef48cde0.msu"
Updating Windows installation media
To apply this update to Windows installation media, see Update Windows installation media with Dynamic Update.
To add this update to a mounted image, run the following command from an elevated Command Prompt window:
DISM /Image:mountdir /Add-Package /PackagePath:windows11.0-KB5132061-arm64_60ca6095fa14ce86f340e9b42b0d90a3ef48cde0.msu
Or, run the following command from an elevated PowerShell window:
Add-WindowsPackage -Path "c:\\offline" -PackagePath "windows11.0-KB5132061-arm64_60ca6095fa14ce86f340e9b42b0d90a3ef48cde0.msu" -PreventPending
x64 installation instructions
Note The Microsoft Update Catalog may include one or more required checkpoint cumulative updates and the target cumulative update. Install the checkpoint cumulative updates in order before installing the target cumulative update.
Download all MSU files for update KB5132061 from the Microsoft Update Catalog and place them in the same folder (for example, C:\Packages). Ensure no other files are present in the folder.
This update consists of the following update file(s).
Method 1: Install each MSU file individually, in order
Double-click each file in the following order to install that update (if there is more than one .msu file listed):
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
- windows11.0-kb5132061-x64_aedc878e9e078df2ec7e2cfb98dd5b21831cdbcc.msu
Note If a required checkpoint cumulative update is already present, a message will indicate that the update is already installed. For guidance on using the Windows Update Standalone Installer (Wusa.exe), see Description of the Windows Update Standalone Installer in Windows.
Method 2: Install all MSU files together
Use Deployment Image Servicing and Management (DISM.exe) to install the target cumulative update. DISM automatically scans the folder specified in the PackagePath folder and installs any required checkpoint cumulative updates.
Updating a Windows PC
To apply this update on a running Windows PC, run the following command from an elevated Command Prompt window:
DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-KB5132061-x64_aedc878e9e078df2ec7e2cfb98dd5b21831cdbcc.msu
Or, run the following command from an elevated PowerShell window:
Add-WindowsPackage -Online -PackagePath "c:\\packages\\windows11.0-KB5132061-x64_aedc878e9e078df2ec7e2cfb98dd5b21831cdbcc.msu"
Updating Windows installation media
To apply this update to Windows installation media, see Update Windows installation media with Dynamic Update.
To add this update to a mounted image, run the following command from an elevated Command Prompt window:
DISM /Image:mountdir /Add-Package /PackagePath:windows11.0-KB5132061-x64_aedc878e9e078df2ec7e2cfb98dd5b21831cdbcc.msu
Or, run the following command from an elevated PowerShell window:
Add-WindowsPackage -Path "c:\\offline" -PackagePath "windows11.0-KB5132061-x64_aedc878e9e078df2ec7e2cfb98dd5b21831cdbcc.msu" -PreventPending
| Available |
Next Step |
|
This update automatically syncs with Windows Server Update Services (WSUS) if you configure Products and Classifications as follows:
- Product: Windows 11
- Classification: Security Updates
|
A list of the files that are included in this update are provided in a CSV (Comma delimited) (*.csv) file. The file can be opened in a text editor such as Notepad or in Microsoft Excel.
Note The English (United States) version of this software update might contain files for additional languages.
Download the file information for cumulative update KB5132061.
Download the file information for SSU (KB5132688 - version 26100.9971.
Windows monthly updates explained
Description of the standard terminology used for Microsoft software updates
Microsoft Store for Business and Education with Configuration Manager
Get updates for apps and games in Microsoft Store
Want a quick overview?: Watch the Windows 11 release note video for this update.