Windows 10 KB5131096: 1,235 Patch Tuesday flaws, ESU only

Microsoft shipped KB5131096 on November 10, 2026, the extended security update that carries this month’s Windows 10 fixes. It is for machines on the Extended Security Updates program and for Windows 10 Enterprise LTSC. After it installs, Windows 10 22H2 reports build 19045.7846, and Windows 10 Enterprise LTSC 2021 reports build 19044.7846. A Windows 10 PC that is on neither track does not receive the package. Microsoft has stopped shipping new Windows 10 features, so this update is the security set plus a short list of repairs.

BleepingComputer counts 1,235 flaws in the November 10 Patch Tuesday release this package belongs to, including one Outlook zero-day already exploited in the wild. The Windows cumulative is how an enrolled Windows 10 PC gets the operating-system portion. The Outlook fix travels with Office.

What KB5131096 changes on the machine

The non-security notes are small and specific. Cuba’s daylight-saving calendar stays on UTC−4 through the extended 2026–2027 period, skipping the November 2026 and March 2027 transitions and returning to UTC−5 in November 2027. Adding a printer that was published in Active Directory could fail with error 87 after the October update; that path is fixed, and printers already installed were generally unaffected. An Intune policy for trusted Remote Desktop publisher certificate thumbprints can be set again. Remote Desktop shadow connections that failed with an unspecified error on Windows Server 2016 and Windows Server 2012 R2 after the October 14 update are addressed in the same release train.

PowerShell is the change that will break a real admin workflow. Signature checks now reject invalid UTF-8 inside a signed script, including scripts that previously passed. When a scheduled task or a login script starts failing verification, open the file, save it as UTF-8 with a byte order mark, and sign it again. Microsoft’s encoding note for signed scripts is the reference. A signature that survived last month can fail on the first boot after 19045.7846.

USB Audio Class 1.0 devices are the other reason some fleets will notice the install. The September 8 security update, KB5122878, left some of those devices silent, stuck on Device Manager code 10, or with volume controls that would not move. An out-of-band update on September 14 restored 8-channel and 3D modes. Microsoft’s Windows 10 release-health page now marks the remaining symptoms resolved in KB5131096.

The Outlook zero-day is an Office update

The exploited flaw in the same Patch Tuesday is CVE-2026-124194, a spoofing bug in Microsoft Outlook scored 6.5. Microsoft says the product can take an unsafe action without the usual warning. Opening a message file can disclose authentication material that an attacker could use to impersonate that user. Microsoft says the person has to open the file. The Preview Pane is outside that path. CISA added the CVE to the Known Exploited Vulnerabilities catalog on November 10.

The Outlook fix ships in the November 10 Office security update. KB5131096 is the Windows cumulative. Microsoft’s Office release notes put Office LTSC 2024 volume-licensed installs on build 17932.21140 and Office LTSC 2021 volume-licensed installs on build 14334.21048. Microsoft 365 Apps picks up the same fix through the update channel. Until that channel has landed, treat an unexpected message file as hostile, and block outbound NTLM authentication from workstations to the internet.

What to check before calling the fleet patched

On every Windows 10 endpoint still in service, read the build, not the ticket that says “Patch Tuesday applied.” Enrolled 22H2 machines should show 19045.7846. Enterprise LTSC 2021 should show 19044.7846. Anything older is still on the October code, including the machines whose ESU license lapsed and whose Windows Update check returns nothing to install.

Then read the Office build on the same PC. A current Windows 10 ESU install with a pre-November Outlook is still exposed to CVE-2026-124194. Re-sign the PowerShell scripts the new UTF-8 rule rejects before the Monday job fails. And treat any Windows 10 device that cannot show either build as outside the security window Microsoft is still willing to patch.

This briefing relies on public reporting by BleepingComputer and on Microsoft’s November 10 release notes.