Windows Server October 2026 Updates Explained in Detail

Microsoft has released the new mandatory cumulative updates for Windows Server machines. This month, timing matters as much as content because Windows Server 2022 leaves mainstream support and Windows Server 2012 and 2012 R2 reach the end of their ESU program. Here’s what you need to know!

• Windows 10 - Discover the October 2026 update
• Windows 11 - Discover the October 2026 updates

As a reminder, the October 2026 Patch Tuesday fixes 1,407 vulnerabilities, a new record. On the server side, several flaws deserve special attention, including a critical remote code execution issue in Active Directory domain services and a 9.8/10 flaw in the DHCP server. The zero-day exploited this month, CVE-2026-96951 (Windows Shell), also affects Windows Server 2012 R2 through Windows Server 2025.

The key point: Windows Server 2022 leaves mainstream support

Before getting into the details of each update, let’s talk about the Windows Server lifecycle, because this Patch Tuesday is tied to several important milestones:

• Windows Server 2022 : "The October 2026 security update is the last available mainstream support update for this version", Microsoft says. No need to panic: Windows Server 2022 moves into extended support and will continue receiving monthly security updates, at no extra cost, until October 14, 2031. However, do not expect new features anymore. But honestly, stability is even better!
• Windows Server 2012 and 2012 R2 : the three-year ESU program reaches its end date on October 13, 2026. The KB5126835 (Windows Server 2012) and KB5126836 (Windows Server 2012 R2) updates are therefore the last security updates for these versions.
• Windows Server 2016 : the KB5126868 release notes remind us that the end of free support is approaching. It is set for January 12, 2027, which is in three months.

I also want to remind you that Windows Update certificates expire in 2027: servers that are not updated enough will no longer receive any updates.

Windows Server 2025 - What’s new in KB5126646

Update KB5126646 (build 26100.33650) includes the fixes from the out-of-band KB5129235 update released on September 14, 2026. As a reminder, it was released urgently to fix the Remote Desktop Services (RDS) bug. This new mandatory update brings several new features and changes to Windows Server 2025:

• Quick Machine Recovery : this recovery feature, already available on Windows 11, is now arriving on Windows Server 2025. In the event of a failure preventing boot, it relies on the recovery environment (WinRE) to retrieve and apply targeted fixes from Windows Update. It is disabled by default and enabled through Group Policy. It is part of the Windows recovery tools.
• TLS 1.3 post-quantum : Windows Server 2025 now supports ML-KEM key exchange in TLS 1.3 to protect encrypted connections against future quantum-computing threats. This follows, in particular, the arrival of post-quantum algorithms in Windows Server 2025 in November 2025.
• Netlogon : Microsoft is improving Netlogon secure channel connections so member servers can connect to domain controllers deployed before Windows Server 2025.
• SMB shares : the NetUseAdd function can once again establish SMB network connections during NULL session attempts.
• Hyper-V : the reliability of Intel TDX (Trusted Domain Extensions) virtual machines is improved.

This update also includes a set of changes common to all Windows Server versions:

• AD FS : after installing this patch, a fix is applied for overly permissive ACLs on the AD FS DKM (Distributed Key Manager) container. This change is tied to the CVE-2026-56155 privilege escalation flaw, a zero-day exploited vulnerability patched during the July 2026 Patch Tuesday. If you want to disable this automatic fix, set the RemediateDkmAcl value to 0. Microsoft details the procedure in KB5121391.
• ReFS : Windows now audits ReFS volumes present on external storage devices. Auditing is enabled by default, while blocking remains disabled for now. Microsoft is therefore planning a shared hardening effort across Windows Server, Windows 10, and Windows 11.
• Time zones : daylight saving time becomes permanent in British Columbia and Alberta as of November 2026, and a new "(UTC-5:00) Manitoba" time zone has been added.

Finally, the built-in cURL tool in Windows is updated to version 8.21.0 on Windows Server 2025 and Windows Server 2022.

Windows Server 2022 - What’s new in KB5126655

Update KB5126655 (build 20348.5761) is the last mainstream support update for Windows Server 2022. It includes the common changes mentioned earlier (AD FS, ReFS, etc.), as well as several version-specific changes:

• NTLM auditing : advanced NTLM auditing capabilities are now available on Windows Server 2022 and Windows Server 2019. They make it possible to identify who is using NTLM, why the protocol was selected, and where authentication takes place. A good way to spot dependencies on this old protocol before the end of NTLM, which Microsoft plans in three phases.
• Storage Spaces Direct (fixed issue) : some virtual disks could remain offline after installing a Windows update. During recovery, valid tiered storage metadata was incorrectly considered invalid, preventing the disks from coming online.
• USB Audio (known issue fixed) : some USB Audio Class 1.0 devices could fail to start or produce no sound since the September 2026 update. On Windows Server 2022, this issue is now resolved.

Windows Server 2019 (KB5126651) and Windows Server 2016 (KB5126868)

For these two older versions, Microsoft has released security-focused cumulative updates, respectively named KB5126651 (build 17763.9376) and KB5126868 (build 14393.9612). They include the changes common to all versions, notably the automatic fix for AD FS DKM ACLs and ReFS volume auditing, in addition to this month’s security fixes, which are numerous.

A few details depending on the version:

• Windows Server 2019 : it also benefits from advanced NTLM auditing. In addition, this update fixes an issue where drives encrypted with BitLocker To Go on newer systems were not recognized by older systems.
• Windows Server 2016 : it is recommended to install the servicing stack update KB5126649 first. On WSUS, you must approve this SSU in addition to KB5126868.

On both versions, the issue related to USB Audio Class 1.0 devices is only partially resolved. The September out-of-band update fixed symptoms related to 8-channel and 3D audio modes, but Microsoft is still working on the other issues.

Windows Server update recap

Here is the list of mandatory cumulative updates released by Microsoft since the beginning of 2026.

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio