Windows 10 KB5131096 extended security update arrives with November fixes

What the update contains

Microsoft has released the Windows 10 KB5131096 extended security update, according to BleepingComputer. The update carries this month's November 2026 Patch Tuesday security fixes along with several bug fixes and small changes.

After installation, Windows 10 moves to build 19045.7846, while Windows 10 Enterprise LTSC 2021 moves to build 19044.7846. Microsoft no longer adds new features to Windows 10, so the update focuses on security patches and fixes.

How to install it

The update applies to devices running Windows 10 Enterprise LTSC and to systems enrolled in the Extended Security Updates (ESU) programme, which delivers security patches to Windows 10 after its regular support ended.

Eligible users can install it through Settings, then Windows Update, by running a manual check for updates. Microsoft has published the full list of fixes and changes on its support pages.

Security and bug fixes included

The update bundles the November 2026 Patch Tuesday fixes, which BleepingComputer reports addressed 1,235 vulnerabilities across Microsoft's products. That total includes one Outlook zero-day flaw, meaning a bug that was actively exploited before a patch existed.

Among the bug fixes, adding a printer published in Active Directory through the Settings app could fail with error 87, a problem introduced by the October 2026 update. Microsoft says existing printers and normal printing were generally not affected.

Two Remote Desktop issues are also resolved. A policy for trusting specific remote desktop publishers could not be configured through Microsoft Intune, and shadow connections on Windows Server 2016 and Windows Server 2012 R2 could fail after the October 14, 2026 update.

Stricter rules for signed PowerShell scripts

The update tightens security for PowerShell script signing, the process that verifies a script comes from a trusted source. Microsoft has introduced stricter encoding validation for signatures.

As a result, scripts with invalid UTF-8 encoding may now fail validation even if they were accepted before. Microsoft advises administrators to review affected scripts, save them as valid UTF-8 with a byte order mark, and sign them again.

Time changes and the end of the USB audio saga

The update adjusts daylight saving time rules for Cuba, which stays on UTC-04:00 and skips the November 2026 and March 2027 clock changes. The country returns to UTC-05:00 in November 2027 and its normal seasonal schedule in 2028.

Microsoft also says all known issues affecting USB Audio Class 1.0 devices are now resolved. Earlier problems caused some devices to stop producing sound, fail to start with Code 10 errors, or show unresponsive volume controls. An emergency out-of-band update on September 14 had already fixed issues with 8-channel and 3D audio modes, and this update clears the remaining faults.