KB5126646: Overview with user sentiment and feedback

Overview

KB5126646 is the October 13, 2026 cumulative update for Windows Server 2025 (OS Build 26100.33650). It bundles security fixes and non-security changes, and it carries forward fixes from the September 8 update and the September 14 out-of-band update. It requires checkpoint update KB5043080 when installed from standalone packages, and it includes the servicing stack update KB5126645. It does not apply to Windows Server 2022 or 2025 version 23H2, which use separate KBs.

General Purpose

• Security: adds ML-KEM post-quantum key exchange to TLS 1.3, upgrades bundled cURL to 8.21.0, and automatically remediates overly permissive AD FS DKM container ACLs (CVE-2026-56155).
• Authentication: NTLMv1 SSO credential generation is now blocked by default (Enforce mode) where Credential Guard is off and BlockNtlmv1SSO is unset, which can affect MS-CHAPv2 Wi-Fi, Ethernet, and VPN logons; domain controllers now validate LDAP binds against Kerberos SPN tickets.
• Storage and Hyper-V: fixes Storage Spaces Direct virtual disks staying offline after tiered-metadata misidentification, and improves Intel TDX confidential VM reliability.
• Platform features: Quick machine recovery is supported on Server 2025 (disabled by default), and ReFS adds auditing for externally attached volumes.
• Time zones: permanent DST for British Columbia and Alberta from November 2026, plus the new Manitoba Standard Time zone.

General Sentiment

Community reception is mixed and skews negative. Some administrators report that the update broke SCVMM 2025 VM deployments through the BITS Compact Server, with one admin describing a Microsoft-supplied temporary workaround, and others report 802.1X/PEAP Wi-Fi authentication failures tied to the NTLMv1 default change. Other administrators report no problems, and the documented issues below are either resolved in later updates or narrowly scoped.

Known Issues

• On-premises Exchange servers may fail OWA sign-in, hold outgoing mail in the Outbox, or experience growing mail queues; resolved in Windows updates released on or after November 10, 2026 (KB5131080).
• USB Audio Class 1.0 devices may show Code 10 or produce no audio after the September 8, 2026 update; 8-channel/3D audio issues are fixed in KB5129235 and remaining symptoms in KB5131080.
• WSUS does not display synchronization error details after KB5070881 or later, as this reporting was removed to address CVE-2025-59287.

Disclaimer: We take measures to ensure that AI-generated content is of the highest possible quality, but we cannot guarantee its accuracy and recommend that users do their own independent research. Generated on 2026-11-12 01:34 PM

Back to Knowledge Base Catalog