New Update Windows 11 November 2026 Patch Tuesday (KB5132061, KB5131087)

[Gandalf_The_Grey]

Microsoft has released the November 2026 Patch Tuesday updates for Windows 11 26H2 25H2 and 24H2. The 26H2 and 25H2 update is provided via KB5132061 (manual download link below), build 26300.9974 on 26H2, build 26200.9974 on 25H2, and 26100.9974 on 24H2 after applying the updates. Windows 11 23H2 is available under KB5131087 (manual download link below), build 22631.7582.

The changelog for Windows 11 26H2, 25H2 and 24H2 is given below:

• [Security updates] This update provides security improvements. For more information about the security vulnerabilities resolved by this update, see the Security Update Guide
• [Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Certificate deployment via Windows updates continues across supported PCs and non-managed business devices in the coming months.
• [Audio (known issue)] - Fixed: USB Audio 1.0 devices might fail to start and display error code 10 in Device Manager after installing a recent security update.
• [Printing] Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, “The parameter is incorrect.” This issue was introduced by the October 2026 update and does not generally affect existing printers or printing.
• [Security] This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. This change helps reduce exposure to NTLM relay attacks and provides auditing to identify connections that are not using signing. To learn more, see NTLM signing security improvements in Windows.
• [Date and Time]This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.
  • For the latest DST and time zone guidance, see the Daylight Saving Time & Time Zone Blog.
• [Remote Desktop] This update addresses an issue where Remote Desktop Protocol (RDP) connections might fail on the client due to a certificate mismatch after the October 2026 non-security preview update.
• [Windows PowerShell] This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. As a result, scripts containing invalid UTF-8 encoding might fail signature validation, even if they were previously accepted. To resolve this issue, review the affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again. For further guidance, see Encoding Guidance for Signed PowerShell Scripts.

Version 23H2 also has the same release notes except the USB audio bug-fix.

https://www.neowin.net/news/windows-11-kb5132061-kb5131087-november-2026-patch-tuesday-direct-download-links-here/

 

[Bot]

(link omitted)

Hi Gandalf, this is worth installing promptly, although there are two errors in the copied details:

• KB5132061 does produce builds 26300.9974, 26200.9974 and 26100.9974, as stated.
• KB5131087 produces 22631.7711, not 22631.7582. Build 22631.7582 was the September update. Windows servicing has enough peculiarities without putting the build number into reverse.
• The Security Update Guide link also points to September. The November page is 2026-Nov.

The most consequential changes for managed environments are probably the NTLM signing and PowerShell encoding changes. Offering NTLM signing by default is not the same as enforcing signing everywhere, but administrators should review the new auditing for old NAS devices, appliances and legacy services. For signed PowerShell scripts, changing the encoding changes the file and therefore invalidates its existing signature; affected scripts need to be saved as valid UTF-8 with BOM and then signed again, rather than weakening signature validation.

For ordinary users, Windows Update is preferable to manually downloading the package. The USB Audio Class 1.0 fix alone will be welcome for anyone who acquired a mysterious Code 10 after September. Businesses should pilot the update against legacy authentication and signed-script workloads, but I would not defer a cumulative security update merely because those compatibility changes exist.

One final lifecycle point: 23H2 Enterprise and Education receive their last monthly security update here, while 24H2 Home and Pro have already left servicing. Those systems should be moved to a supported Windows 11 release rather than treating this patch as an extended lease on life.

Sources

• September 8, 2026—KB5122880 (OS Build 22621.7582) | Microsoft Support
• {{release}} - Release Notes - Security Update Guide - Microsoft - Release Notes - Security Update Guide - Microsoft

 

[AFEH]

Updated; no issues, no new features.

 

[SeriousHoax]

Updated successfully