On-Premises Windows, Office & Server Update Report — October 2026

Field Intelligence & Regression Tracker (Released Oct 13, 2026 • Updated Friday, Oct 16, 2026) — Covering Windows Clients, Windows Servers, On-Premises Exchange Server, Office 2016/2019/2024, Veeam B&R (v12/v13) & Symantec Endpoint Protection Manager

On-Prem Exchange Server Outage
MdbOffline (22–36h)
Oct Windows Server KBs (2016–2025) crash Exchange SE, 2019 & 2016 after ~24h (Event 1006 / ec=1142)
Network & RDP Lockouts
802.1X & 0xC000000D
KB5066470 confirms Wi-Fi, Wired Ethernet & VPN PEAP break; Admin Protection breaks RDP & $ shares
Office 2016 / 2019 / 2024
132 CVEs + Paste Bug
Fixes zero-click Outlook RCEs (CVE-2026-70242); Excel 2016 KB5002934 reintroduces Ctrl+V paste failure
3rd-Party Impact (Veeam & SEPM)
VSS / ReFS / SMB / TLS
Veeam hit by Exchange VSS freezes, ReFS Event 524 & .NET 8/10; SEPM hit by $ share & SQL TLS bugs

🚨 Pre-Deployment Directives for On-Premises IT Operations (As of October 16, 2026)

1. HALT Windows Server OS Patches on Exchange Hosts: Do not install KB5126646 (2025), KB5126655 (2022), KB5126651 (2019), or KB5126868 (2016) on Exchange servers. They cause MapiExceptionMdbOffline after ~24 hours.
2. Push BlockNtlmv1SSO=0 Before KB5127648 / KB5126646: Microsoft confirmed (KB5066470) that Wi-Fi, Wired Ethernet (dot3svc), and VPNs using PEAP/MS-CHAPv2 break when Credential Guard is disabled.
3. Disable Admin Protection on Win 11 RDP & SEPM Targets: Set Admin Approval Mode to Legacy (1) on Win 11 24H2–26H2 to prevent RDP 0xC000000D lockouts, broken GPO drives, and broken ADMIN$/C$ shares.
4. Office 2016 MSI & Veeam .NET 8: Pair Excel 2016 KB5002934 with hotfix KB5002665 to prevent Ctrl+V failures; keep .NET 8 installed on Veeam B&R 12.x/13.0 servers.

1. Reported Update & Installation Issues (On-Premises Deep-Dive)

Click any issue card below to view technical symptoms, event IDs, root causes, registry workarounds, and community sources.

CRITICAL OUTAGE • On-Prem Exchange + Win Server KB5126646 / KB5126655 / KB5126651 / KB5126868 MS Exchange Team / FrankysWeb / BornCity / EighTwOne On-Premises Exchange Server (SE, 2019 & 2016) Stops Delivering Mail & Freezes 22–36 Hours After Oct Windows Server Updates

Symptoms & The "24-Hour Time Bomb" Pattern

  • Delayed Outage (22–36 Hours Post-Reboot): Exchange Server Subscription Edition (SE), Exchange 2019, and Exchange 2016 operate normally for ~24 hours after patching (frequently failing right after overnight 01:00–02:00 AM VSS backups or background database maintenance).
  • MapiExceptionMdbOffline (ec=1142): Outlook and OWA disconnect, mail queues stall in Retry, and Application logs flood with Event ID 1006 (MSExchange Replication Service): MapiExceptionMdbOffline: Unable to make connection to the server (hr=0x80004005, ec=1142).
  • Databases Show "Mounted" But Cannot Switch Over: ECP and PowerShell still display databases as Mounted and healthy, but DAG switchovers fail.
  • OS Freezes, "Invalid File Handle" & DC Auth Drop: Affected Exchange servers reject console/RDP login with "Invalid File Handle" ("ungültige File Handle"), log internal errors establishing a secure session with Domain Controllers, or freeze completely.

Official Root Cause Confirmation & Workarounds

  • Windows Server OS Update is the Culprit: On Oct 15, Microsoft's Exchange Team added an emergency warning banner confirming that the October 2026 Windows Server OS updates (KB5126646 on 2025, KB5126655 on 2022, KB5126651 on 2019, KB5126868 on 2016) trigger the outage—even if the October Exchange SU (KB5128895) is NOT installed.
  • Permanent Recovery: Uninstall the October Windows Server Cumulative Update (and October .NET update) from the Exchange host and reboot. Admins on FrankysWeb confirmed this immediately stops the 24-hour crashes.
  • Temporary Band-Aid: Rebooting the server (or restarting MSExchangeIS) restores mail flow, but the outage recurs every 20–26 hours.

Emergency PowerShell Check & Temporary Service Recovery Command

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1006; ProviderName='MSExchange Replication'} -MaxEvents 10 | Select TimeCreated, Message; Restart-Service MSExchangeIS -Force
Verified Sources: MS Exchange Team Official Warning ↗ FrankysWeb Analysis & Admin Reports ↗ BornCity Exchange Outage Report ↗ EighTwOne Advisory ↗ r/sysadmin Thread ↗
Blocker • Wi-Fi / Wired 802.1X / VPN KB5127648 / KB5126646 (KB5066470) Microsoft Official Confirmation / Neowin / MS Q&A Microsoft Confirms KB5127648 & KB5126646 Break 802.1X Wi-Fi, Wired Ethernet (dot3svc) & MS-CHAPv2 VPNs

Official MS Confirmation (Oct 15) & Technical Symptoms

  • Official Scope (KB5066470): Microsoft confirmed that KB5127648 (Win 11 24H2–26H2) and KB5126646 (Server 2025) switch BlockNtlmv1SSO to Enforcement mode by default whenever Credential Guard is disabled and the registry value is not explicitly set.
  • Wireless (WLAN-AutoConfig): Logs Event ID 12014 (OneX Held State timeout) and Event ID 12013 (Error 0x80070285) on WPA2/WPA3-Enterprise PEAP networks.
  • Wired Ethernet (dot3svc) & VPN: Wired 802.1X ports fail with Error 0x80070285 and Event ID 15506 ("Explicit Eap failure received") with a 600-second lockout loop. MS-CHAPv2 VPNs using Windows SSO also fail.

Mitigation & Rollback Gotcha

  • Registry Fix: Set BlockNtlmv1SSO = 0 (Audit mode) under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 and restart the device.
  • Uninstall Note: If rolling back via wusa /uninstall /kb:5127648, admins in MS Q&A #6036828 warn that some endpoints also require rolling back the companion KB5127690 / KB5127647 update batch.

Official Microsoft Registry Workaround (Requires Reboot)

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v BlockNtlmv1SSO /t REG_DWORD /d 0 /f
Verified Sources: Neowin (MS Official Admission — Oct 15) ↗ MS Q&A #6036828 (Wired 802.1X) ↗ MS Q&A #6036507 (Wi-Fi 802.1X) ↗
Blocker • RDP / GPO / SMB KB5127648 / KB5127646 MS Support / BornCity (Oct 15) / Neowin Remote Desktop Fails for Non-Admins (0xC000000D on 24H2–26H2 & 26H1), GPO Drives & Admin $ Shares Break

1. RDP Error 0xC000000D & Mid-Install Disconnects

On Windows 11 24H2, 25H2, 26H2 (KB5127648) and 26H1 (KB5127646), non-admin users cannot connect via Remote Desktop when Administrator Protection is enabled (which is enabled by default in Microsoft Security Compliance Toolkit baselines). Connections fail with Error 0xC000000D ("The token that was passed to the function is invalid"). Active RDP sessions also drop mid-install.

2. GPO Drive Mappings & Admin $ Shares Broken (BornCity Oct 15)

BornCity readers (Max, RabeMUC) reported on Oct 15 that KB5127648 breaks GPO network drive mappings and disables administrative $ shares (C$, ADMIN$) on Windows 11 24H2 endpoints (which also breaks remote push tools like SEPM and PDQ). Uninstalling KB5127648 or disabling Admin Protection restores both.

Workaround: Switch to Legacy Admin Approval Mode

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v TypeOfAdminApprovalMode /t REG_DWORD /d 1 /f
Verified Sources: BornCity RDP & GPO Share Report (Oct 15) ↗ MS Support KB5127646 ↗ Neowin Admin Protection Report ↗
Office 2016 / 2019 / 2024 KB5002934 / Build 17932.21056 / Build 10417.20207 MS Q&A #6037340 / BleepingComputer / MS Learn Excel 2016 (KB5002934) Reintroduces Silent Ctrl+C/Ctrl+V Paste Failure; Office 2016/2019 License Deactivation & C2R Rollback

1. Excel 2016 MSI (KB5002934) Silent Paste Failure Regression

  • Symptoms (MS Q&A #6037340 — Oct 14, 2026): After installing the October 13, 2026 security update for Excel 2016 MSI (KB5002934, which replaces September's KB5002914 and upgrades EXCEL.EXE to 16.0.5574.1004), copying cells with Ctrl+C works, but pasting with Ctrl+V silently fails (blinking marquee remains, destination cell does not update, no error shown) in existing/complex workbooks and workbooks with conditional formatting.
  • Workaround: Apply the latest version of non-security hotfix KB5002665 on top of KB5002934, use Paste Special -> Values/Formulas (or Ctrl+X / Ctrl+V), or uninstall KB5002934.

2. Office 2019 / 2024 C2R Paste Caveat & KB5002907 Deactivations

  • Office LTSC 2024 (Build 17932.21056) & Office 2019 (Build 10417.20207): While the October 13 Click-to-Run builds incorporate fixes for the September Excel paste bug, Microsoft notes paste operations can still fail in complex sheets containing conditional formatting.
  • Office 2016/2019 License Deactivation / Removal (KB5002907): Admins must ensure paused update KB5002907 is blocked in WSUS/SCCM, as it unexpectedly deactivates or completely uninstalls perpetual Office 2016 and Office 2019 installations.
  • Office LTSC 2021 EOL: Reached final End of Support on October 13, 2026 after receiving Build 14334.20974.

Click-to-Run Rollback Command (If Office 2024 / 2019 / 2016 C2R Exhibits Paste Regressions)

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user updatetoversion=16.0.17932.20910
Verified Sources: MS Q&A #6037340 (KB5002934 Excel Paste Regression) ↗ MS Support (KB5002934) ↗ BleepingComputer (KB5002907 Office Deactivation) ↗ Office LTSC 2024 Update History ↗ Office 2019 / 2016 C2R Update History ↗
Security Scope • Office 2016–2024 132 CVEs (CVE-2026-70242 / CVE-2026-97016) Action1 / TechTimes / IT-Blogger 132 Microsoft Office CVEs Patched: Two CVSS 9.8 Zero-Click Outlook Reading Pane RCEs & 51 Excel RCEs

Zero-Click Outlook Reading Pane RCEs (CVSS 9.8)

Of the 132 Office vulnerabilities patched on October 13, 2026 (51 in Excel, 36 in Office Suite, 13 in Word, 13 in Access, 8 in Outlook, 7 in PowerPoint, 3 in Visio, 1 in OneNote), five are Outlook flaws that fire before clicking—led by CVE-2026-70242 (CVSS 9.8) and CVE-2026-97016 (CVSS 9.8). Merely previewing a crafted email in the Outlook Reading Pane triggers a heap-based buffer overflow and remote code execution with zero user interaction.

Manual Deployment Required for MSI & Discretion Note

While Office LTSC 2024 (17932.21056) and Office 2019 C2R (10417.20207) receive these fixes via Click-to-Run, MSI installations of Office 2016 require manual deployment via WSUS/Catalog (KB5130763 / KB5002934). Note that official support for Office 2016/2019 ended Oct 14, 2025, and Microsoft issues C2R/MSI patches for them strictly at its discretion.

Verified Sources: TechTimes (Five Zero-Click Outlook Flaws) ↗ IT-Blogger (132 Office CVEs Breakdown) ↗ Microsoft Support (KB5130763 Office Oct 2026) ↗
Lifecycle & Servicing • On-Prem Exchange KB5128895 / KB5128896 / KB5128897 / KB5128898 MS Exchange Blog / Messageware / FrankysWeb Final Ever Security Updates for Exchange 2016 & 2019 (Even with ESU2) & ContentEngine SQL 2025 Binary Issue

End of Vulnerability Testing for Exchange 2016 & 2019

Alongside KB5128895 (Exchange SE RTM SU11, patching 6 CVEs up to CVSS 9.4 including CVE-2026-70571 & CVE-2026-70279), Microsoft released KB5128896 (2019 CU15), KB5128897 (2019 CU14), and KB5128898 (2016 CU23). Microsoft stated: "After October 2026: Updates will be released for Exchange Subscription Edition (SE) only... We will stop testing Exchange 2016 and 2019 for vulnerabilities."

Fixes Included & SQL 2025 Binary Note

The October Exchange SUs fix the Published Calendar (.ics) HTTP 500 error and Korean WordBreaker rule files. However, BornCity readers (R.S., Leopold Butters) noted that for certain ContentEngine search deadlocks, updated binaries still need to be extracted from a SQL Server 2025 Setup package.

Verified Sources: Messageware Oct 2026 Exchange Analysis ↗ BornCity Exchange Oct 2026 Thread ↗
Client Installation & Stability KB5127648 (Build 26x00.9711) Deskmodder (Oct 14–15) / BornCity KB5127648 Aborts at 99% & Rolls Back, Boot BSODs, Smart App Control Toggle Locked & 5-Min Hard Restart

1. 99% Install Rollback & Boot BSODs

  • 99% Rollback Loop: Deskmodder users reported on Oct 14–15 that KB5127648 installs to 99%, aborts, reboots with "Something didn't go as planned — undoing changes", and rolls back.
  • Boot BSOD & 5-Min Hard Reboot: BornCity user U2Pas reported BSODs on boot after patching, while multiple Deskmodder users (Doj, Martin2108) reported a sudden hard restart (no BSOD) ~5 minutes after the initial post-patch boot.

2. Smart App Control Locked, HVCI + Hello & Taskbar

  • Smart App Control Stuck (Win 11 Pro 26H2): Reported Oct 15 on Deskmodder — Smart App Control can no longer be toggled on or off after installing KB5127648.
  • Core Isolation + Windows Hello: Enabling Memory Integrity alongside KB5127648 breaks biometric sign-in on certain hardware.
  • Taskbar Auto-Hide: Auto-hidden taskbar fails to reappear after closing images in File Explorer.
Verified Sources: Deskmodder KB5127648 Comments ↗ BornCity Win 10/11 Patchday Comments ↗
Server Rollout & Timing KB5126646 / KB5126655 / KB5126651 r/sysadmin / BornCity Server 2019 Reboot Loops, Server 2025 20+ Min Reboot Hang & >1-Hour Install Duration (2.5 GB + 2 Reboots)

Server 2019 Loops & Server 2025 Reboot Hang

In the r/sysadmin megathread, admins reported clusters of Windows Server 2019 machines entering continuous reboot loops during overnight maintenance windows, and Windows Server 2025 Standard VMs hanging on "Restarting..." for over 20 minutes (with one test member server failing to boot back up).

>1-Hour Install Time for 2.5 GB Payload (Server 2022/2025)

Admins patching large fleets (180 to 400 servers on r/sysadmin and BornCity) confirmed that non-Exchange servers and Domain Controllers are stable post-patch, but the ~2.5 GB payload for KB5126655 (2022) and KB5126646 (2025) takes over 60 minutes per server and requires 2 reboots. Extend RMM maintenance windows to 90–120 minutes.

Verified Sources: r/sysadmin Patch Tuesday Megathread ↗ BornCity Server Patchday Thread ↗
Virtualization • Hyper-V Server 2022 / 2025 Hosts r/sysadmin Hyper-V VMs Fail to Resume from Saved State After Host Patch Reboot on AMD EPYC & Ryzen 9 CPUs

Symptoms

On Hyper-V hosts powered by AMD EPYC or AMD Ryzen 9 CPUs, guest VMs placed into a Saved State during host reboot fail to resume after the host boots back up.

Workaround

Run Remove-VMSavedState -VMName <Name> (or select Delete Saved State in Hyper-V Manager) and cold-boot the VM. Configure Hyper-V host automatic stop actions to cleanly shut down guest OSes before patching.

Verified Sources: r/sysadmin Megathread (Ehfraim & PrettyFlyForITguy) ↗
Storage Hardening • ReFS KB5130741 (All Oct KBs) MS Advisory / Deskmodder / IT-Connect External / USB ReFS Drives Flagged (Event ID 524) & Scheduled for Default Mount Block in January 2027

Audit Phase Now Active (Oct 13, 2026)

All October 2026 updates for Windows 10, Windows 11, and Windows Server enable Audit Mode (1) for ReFS volumes on removable/external media, logging Warning Event ID 524 (Source: ReFS) in the System log. In January 2027, Enforcement Mode (2) will block external ReFS backup drives from mounting by default.

Registry Policy Control

Migrate USB backup drives to NTFS or override via RefsRemovableDeviceMountPolicy (0 = Allow, 1 = Audit, 2 = Block):

reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v RefsRemovableDeviceMountPolicy /t REG_DWORD /d 0 /f
Verified Sources: Deskmodder ReFS Schedule & Discussion ↗ KB5130741 Technical Guide ↗
Imaging, Certs & AD FS boot.stl / KB5043080 / KB5121391 Microsoft Support / Deskmodder Media Boot Failure (0xc0430001 boot.stl), AD FS DKM ACL Stripping (CVE-2026-56155) & Server 2025 Checkpoint MSU

1. Boot Error 0xc0430001 (boot.stl) & Offline Servicing

Applying October 2026 Dynamic Updates to WinPE/WDS/SCCM media without updating Windows\Boot\EFI\boot.stl causes boot failure 0xc0430001. Manual MSU installation of KB5126646 on Server 2025 requires checkpoint update KB5043080 first; Server 2022 offline servicing fails with 0x800f0823 without SSU KB5030216.

2. AD FS Automatic DKM Container ACL Stripping (CVE-2026-56155)

October 2026 Server updates automatically disable inheritance on the AD Distributed Key Manager (DKM) container and strip all explicit Allow ACEs except Domain Admins, Enterprise Admins, SYSTEM, and the AD FS Service Account (logs Event ID 1132). Opt out if needed via RemediateDkmAcl = 0.

Verified Sources: Server 2025 Advisory (KB5126646) ↗ AD FS DKM Advisory (KB5121391) ↗
Peripherals & Resolved Bugs KB5127648 / KB5126657 BornCity / BleepingComputer / Caschy USB Audio 1.0 Code 10 Residual Bug vs. Confirmed Fixes (Black Screen KIR Retired, Always On VPN, S2D & AC-3 Audio)

Residual Known Issue: USB Audio Class 1.0 (Code 10)

Resolved on Server 2022 (KB5126655), but Windows 11 and Windows 10 October release notes still list residual Code 10 ("This device cannot start") errors on legacy USB 1.0 DACs/headsets.

Confirmed September Bugs Fixed in October 2026

Permanently resolves the AVD/FSLogix Black Screen on sign-in (retiring GPO KIRs 260924_20021 & 260924_20071), Always On VPN stuck in "Connecting", Storage Spaces Direct (S2D) offline virtual disks, Server 2025 mixed-domain Netlogon, and AC-3 Dolby audio app crashes.

Verified Sources: BornCity (Black Screen KIR Retired — Oct 16) ↗ BleepingComputer (Always On VPN Fix) ↗

2. Expandable October 2026 Reference Matrix (Windows, Server, Exchange & Office 2016/2019/2024)

Click any row (or "Expand Details") to view the Most Critical Fixes and Most Critical Installation / Post-Install Issues for each product.

Product / OS Version KB Article / Release Build / Version Lifecycle & Summary Status Details
Windows 11 26H2 / 25H2 / 24H2 KB5127648 26300 / 26200 / 26100.9711 First CU for 26H2; 24H2 Home & Pro reached EOL on Oct 13, 2026

✅ Most Critical Security & Quality Fixes

  • Zero-Day & Critical CVEs: Patches actively exploited Windows Shell MotW bypass (CVE-2026-96951), unauthenticated IPv6 MSQUIC RCE (CVE-2026-105016, CVSS 9.8), and QuickTime Media Foundation RCE (CVE-2026-96952).
  • Quality Fixes: Permanently resolves AVD/FSLogix Black Screen on sign-in (retiring KIR 260924_20071), fixes AC-3 Dolby audio app crashes, restores PDF previews in File Explorer, fixes RAW/Generic Text printing, fixes gaming mouse stutter, and fixes cold-boot fingerprint sign-in.

⚠️ Most Critical Issues When Installing / Post-Install

  • 802.1X Wi-Fi, Wired Ethernet & VPN Breakage (KB5066470): Enforces BlockNtlmv1SSO=1 when Credential Guard is disabled, breaking PEAP/MS-CHAPv2 SSO (Error 0x80070285, Events 12014, 15506). Fix: Set BlockNtlmv1SSO=0.
  • RDP Lockout (0xC000000D), GPO Drives & $ Shares: Admin Protection breaks non-admin RDP, drops active RDP mid-install, and breaks GPO drive mappings & C$/ADMIN$ shares. Fix: Set TypeOfAdminApprovalMode=1.
  • 99% Install Rollback & 5-Min Hard Reboot: Reports of install aborting at 99%, Smart App Control toggle locking on 26H2, and a sudden restart 5 mins post-boot.
Official KB5127648 Advisory ↗
Windows 11 26H1 KB5127646 28000.3231 Includes SSU KB5127645; RDP Known Issue added Oct 14

✅ Most Critical Security & Quality Fixes

  • Security: Patches CVE-2026-96951 (MotW zero-day), CVE-2026-105016 (MSQUIC RCE), and CVE-2026-96952.
  • Quality Fixes: Resolves AVD/FSLogix Explorer.exe black screen on sign-in, fixes Always On VPN stuck in "Connecting" / "Port already in use", and fixes Storage Spaces Direct (S2D) tiered virtual disks staying offline.

⚠️ Most Critical Issues When Installing / Post-Install

  • Remote Desktop Non-Admin Failure (0xC000000D): Added by Microsoft on Oct 14—non-admins cannot RDP into 26H1 hosts when Administrator Protection is enabled.
  • Media Boot Error 0xc0430001 & USB Audio 1.0: Dynamic update media requires updated boot.stl; legacy USB Audio 1.0 devices may fail with Code 10.
Official KB5127646 Advisory ↗
Windows 11 23H2 (Ent/Edu) KB5126653 22621.7652 Includes SSU KB5126652; supported for Enterprise/Edu until Nov 2026

✅ Most Critical Security & Quality Fixes

  • Security & Storage: Patches October zero-days (`CVE-2026-96951`), fixes File History backup failure ("Reconnect your drive"), and fixes S2D virtual disks staying offline after updates.

⚠️ Most Critical Issues When Installing / Post-Install

  • Boot Error 0xc0430001 & ReFS Audit (Event 524): Installation media updated with Oct dynamic updates requires Windows\Boot\EFI\boot.stl; external ReFS drives begin logging Event ID 524 (KB5130741).
Official KB5126653 Advisory ↗
Windows 10 22H2 / 21H2 (ESU) KB5126657 19045.7807 / 19044.7807 Consumer ESU ends Oct 13, 2026; Commercial ESU enters Year 2 ($122/device)

✅ Most Critical Security & Quality Fixes

  • Security: Patches CVE-2026-96951 (MotW bypass), CVE-2026-96952 (Media Foundation RCE), and pairs with .NET update KB5128925 (fixing publicly disclosed WDAC bypass CVE-2026-108398).

⚠️ Most Critical Issues When Installing / Post-Install

  • Local Admin Account Detection Quirk (Consumer ESU): Checking Windows Update from a local admin account only offers MSRT; the 1.15 GB KB5126657 update only appears after signing into the linked Microsoft Account.
  • USB Audio 1.0 (Code 10) & External ReFS (Event 524): Legacy USB 1.0 audio devices may fail to start; removable ReFS volumes log Warning Event 524.
Official KB5126657 Advisory ↗
Windows Server 2025 KB5126646 26100.33650 CRITICAL: Do NOT install on Exchange SE hosts; requires checkpoint KB5043080

✅ Most Critical Security & Quality Fixes

  • Security & Post-Quantum TLS: Patches MSQUIC IPv6 RCE (CVE-2026-105016), AD FS privilege escalation (CVE-2026-56155), and adds ML-KEM post-quantum TLS 1.3 and Quick Machine Recovery support.
  • Netlogon & S2D Fixed: Resolves mixed-domain Netlogon secure channel drops to pre-2025 DCs and fixes S2D tiered virtual disks staying offline after updates (confirmed Oct 14).

⚠️ Most Critical Issues When Installing / Post-Install

  • Crashes Exchange Server SE After ~24h: Triggers MapiExceptionMdbOffline (ec=1142) and server freezes 22–36 hours after installation.
  • Breaks 802.1X / VPN (KB5066470): Enforces BlockNtlmv1SSO=1 when Credential Guard is disabled.
  • >1-Hour Install (2.5 GB + 2 Reboots), 20+ Min Reboot Hang & Checkpoint MSU: Takes >60 mins to install; VMs may hang on "Restarting"; manual MSU install fails unless checkpoint KB5043080 is present; AMD EPYC/Ryzen Hyper-V VMs fail to resume from saved state.
Official KB5126646 Advisory ↗
Windows Server 2022 KB5126655 20348.5761 CRITICAL: Do NOT install on Exchange SE/2019 hosts; Mainstream Support ended Oct 13

✅ Most Critical Security & Quality Fixes

  • Security & Auditing: Patches October critical CVEs, enforces AD FS DKM ACL hardening (CVE-2026-56155), and adds Enhanced NTLM Auditing.
  • S2D & USB Audio Fixed: Fixes Storage Spaces Direct tiered virtual disks staying offline after updates and fully resolves the Sept USB Audio 1.0 issue on Server 2022.

⚠️ Most Critical Issues When Installing / Post-Install

  • Crashes Exchange Server SE / 2019 After ~24h: Triggers MapiExceptionMdbOffline (ec=1142) and stalls mail flow 22–36 hours post-reboot.
  • >1-Hour Install (2.5 GB + 2 Reboots) & Offline Error 0x800f0823: Takes over 1 hour to install; offline image servicing fails with 0x800f0823 without SSU KB5030216; WSUS sync error details remain suppressed (CVE-2025-59287).
Official KB5126655 Advisory ↗
Windows Server 2019 / 2016 KB5126651 / KB5126868 17763.9376 / 14393.9612 CRITICAL: Do NOT install on Exchange hosts; Win 10 LTSB 2016 reached EOL

✅ Most Critical Security & Quality Fixes

  • Security & BitLocker: Patches October critical CVEs, enforces AD FS DKM container ACL hardening (CVE-2026-56155), adds Enhanced NTLM Auditing on 2019, and fixes BitLocker To Go compatibility.

⚠️ Most Critical Issues When Installing / Post-Install

  • Crashes Exchange 2019 / 2016 After ~24h: Triggers MapiExceptionMdbOffline, DC secure-channel errors, and "Invalid File Handle" login lockouts after 22–36 hours.
  • Server 2019 Reboot Loops: Community reports on r/sysadmin of groups of Server 2019 VMs getting stuck in continuous reboot loops during overnight patching.
Official KB5126651 (2019) ↗ Official KB5126868 (2016) ↗
Exchange Server SE / 2019 / 2016 (On-Prem) KB5128895 / 896 / 897 / 898 15.2.2562.56 (SE SU11) Safe if installed without Oct Windows Server OS update; Final update ever for 2016/2019

✅ Most Critical Security & Quality Fixes

  • 6 Security Vulnerabilities Patched: Resolves Spoofing and RCE vulnerabilities up to CVSS 9.4 (including CVE-2026-70571 and CVE-2026-70279).
  • Quality Fixes: Fixes Published Calendar (.ics) HTTP 500 errors and includes missing Korean WordBreaker rule files for ContentEngine.

⚠️ Most Critical Issues When Installing / Post-Install

  • Severe Conflict with Oct 2026 Windows Server OS Updates: If the underlying Windows Server has KB5126646, KB5126655, KB5126651, or KB5126868 installed, Exchange fails after 22–36 hours with MapiExceptionMdbOffline (ec=1142). Install the Exchange SU only on September-patched Windows Server hosts.
  • Non-Elevated Install Disables Services: Running the SU installer without an elevated Admin Command Prompt leaves Exchange services disabled.
Official KB5128895 Advisory ↗
Microsoft Office LTSC 2024 / Office 2024 Click-to-Run (Oct 13, 2026) Version 2408 (Build 17932.21056) Active Mainstream Support; patches 132 Office CVEs

✅ Most Critical Security & Quality Fixes

  • Zero-Click Outlook RCEs & Excel RCEs: Patches 132 Office CVEs including Critical CVSS 9.8 zero-click Outlook Reading Pane RCEs (CVE-2026-70242, CVE-2026-97016), CVE-2026-70256 (CVSS 8.8), and 51 Excel RCE/Info Disclosure flaws.
  • Quality Fixes: Integrates the Click-to-Run fix for the widespread September Excel Ctrl+C/Ctrl+V paste failure.

⚠️ Most Critical Issues When Installing / Post-Install

  • Conditional Formatting Paste Caveat: Microsoft notes that even after the October update, standard Ctrl+V paste operations in Excel LTSC 2024 may still fail in complex workbooks containing conditional formatting (Workaround: Paste Special -> Formulas/Values or rollback to 16.0.17932.20910).
Office LTSC 2024 Update History ↗
Microsoft Office 2019 & Office LTSC 2021 Click-to-Run (Oct 13, 2026) 1808 (10417.20207) / 2108 (14334.20974) Office LTSC 2021 reached EOL Oct 13, 2026; Office 2019 EOL Oct 2025 (discretionary patch)

✅ Most Critical Security & Quality Fixes

  • Security Rollup: Delivers the final scheduled security rollup for Office LTSC 2021 (14334.20974) and a discretionary security update for Volume Licensed Office 2019 / 2016 C2R (10417.20207), addressing the October Outlook and Excel RCEs.

⚠️ Most Critical Issues When Installing / Post-Install

  • License Deactivation / Uninstall Hazard (KB5002907): Ensure update KB5002907 remains blocked in WSUS/SCCM, as it deactivates or completely removes Office 2019 and Office 2016 installations.
  • Excel Paste Regression on Build 10417.20207: Users on MS Q&A reported 64-bit Office 2019 Build 10417.20207 still exhibiting silent Ctrl+V paste failures in complex sheets (Workaround: rollback via OfficeC2RClient.exe /update user updatetoversion=16.0.10417.20197).
Office 2019 / 2016 C2R Update History ↗ Office LTSC 2021 Update History ↗
Microsoft Office 2016 (MSI Edition) KB5002934 / KB5130763 Excel 16.0.5574.1004 Discretionary MSI security patch (EOL Oct 2025); replaces Sept KB5002914

✅ Most Critical Security & Quality Fixes

  • Excel 2016 RCE & Info Disclosure Fixes (KB5002934): Patches 13+ CVEs in Excel 2016 MSI including CVE-2026-81399, CVE-2026-81947, CVE-2026-78512, and CVE-2026-81397. Also released SharePoint Server SE (KB5002927) and Office Online Server (KB5002928).

⚠️ Most Critical Issues When Installing / Post-Install

  • Silent Ctrl+C / Ctrl+V Paste Failure Reintroduced (MS Q&A #6037340): Enterprise admins reported on Oct 14 that installing KB5002934 reintroduces the silent Ctrl+V paste failure on 64-bit/32-bit Excel 2016 MSI across existing workbooks.
  • Mitigation: Install the latest version of corrective update KB5002665 alongside KB5002934, use Paste Special, or uninstall KB5002934 (wusa /uninstall /kb:5002934).
Official KB5002934 Advisory ↗ MS Q&A #6037340 (Paste Bug Recurrence) ↗

3. Third-Party Application Compatibility & Impact Analysis

Detailed verification of how the October 2026 Windows & Server updates interact with Veeam Backup & Replication (v12 & v13) and Symantec Endpoint Protection Manager (SEPM).

Third-Party Impact • Backup Infrastructure Veeam B&R v12 (12.3.2.4934) & v13 (13.0 / 13.1.1.18) Veeam KB4696 / KB4738 / KB4935 / r/sysadmin / FrankysWeb Veeam Backup & Replication (v12 & v13): 4 Confirmed Interactions with October 2026 Windows Updates

While the core Veeam Backup Service runs on patched Windows Server 2022/2025 hosts, four specific interactions between the October 2026 Windows updates and Veeam v12/v13 require immediate admin attention:

1. Exchange VSS Application-Aware Backups Trigger / Fail in 24h Outage

On Exchange Server SE/2019/2016 hosts patched with the October Windows Server updates (KB5126646, KB5126655, KB5126651), admins on FrankysWeb and BornCity noticed that the MapiExceptionMdbOffline (ec=1142) store freeze frequently occurs right after overnight (01:00–02:00 AM) Veeam application-aware VSS snapshot jobs, causing subsequent Veeam Exchange backups and log truncation to fail until the Windows Server OS update is uninstalled.

2. Rotated / External ReFS Backup Repositories Flagged (KB5130741)

Veeam v12 and v13 environments using ReFS-formatted external USB/removable drives for rotated backup repositories or VHDX seeding will now log Warning Event ID 524 (Source: ReFS) after installing the October 2026 Windows updates, and Windows will block those ReFS drives from mounting in January 2027. Set RefsRemovableDeviceMountPolicy = 0 on the Veeam repository host or reformat rotated media to NTFS.

3. Strict .NET 8 vs. .NET 10 Runtime Split (VBR v12/13.0 vs. v13.1)

With Microsoft patching .NET (KB5128925 / CVE-2026-108398) and ending support for .NET 8 and .NET 9 on November 10, 2026, sysadmins on r/sysadmin warned that Veeam B&R v12.x and v13.0 strictly require .NET 8. Only Veeam B&R v13.1+ (13.1.1.18) supports .NET 10. Uninstalling .NET 8 during security remediation on a VBR 12.x server breaks Veeam B&R and Veeam ONE.

4. Win 11 24H2+ / Server 2025 Recovery Media (boot.stl) & Oct 6 Veeam Patch

Per Veeam KB4696 and KB4738, Veeam Agent for Windows Recovery Media created on Win 11 24H2+ or Server 2025 can fail to boot without updated WinPE/Secure Boot files (boot.stl error 0xc0430001). Ensure VBR v12 is on Build 12.3.2.4934 (released Oct 6, 2026 to patch Critical RCE CVE-2025-64393) and VBR v13 is on Build 13.1.1.18 (which fixes Windows Server 2025 VM guest processing).

Verified Sources: Veeam KB4696 (VBR 12.3.2.4934 — Oct 6, 2026) ↗ Veeam KB4738 (VBR 13 & 13.1.1.18 Release Notes) ↗ Veeam KB4935 (Oct 6, 2026 S3 Repository Issue) ↗ r/sysadmin (Veeam 12 vs 13.1 .NET 8/10 Warning) ↗ FrankysWeb (Overnight Backup & Exchange Crash Correlation) ↗
Third-Party Impact • Endpoint Security Symantec Endpoint Protection Manager (SEPM 14.3 RU9/RU10 & 14.4) Broadcom TechDocs / KB457006 / KB457304 / KB154575 Symantec Endpoint Protection Manager (SEPM): Remote Push, SQL TLS Padding, Server 2025 & Win 11 ARM64 Issues

Based on Broadcom’s official SEPM advisories (updated late September / October 2026) and Windows 11/Server 2025 October patch behaviors, administrators running SEPM should watch for four operational issues:

1. SEPM Remote Client Push Fails on Win 11 (KB5127648 Admin $ Shares)

SEPM’s Client Deployment Wizard (Remote Push) requires access to ADMIN$ and C$ administrative shares over SMB. Because KB5127648 breaks administrative $ shares and non-admin tokens (0xC000000D) on Windows 11 24H2–26H2 when Administrator Protection is active, remote SEP agent pushes fail until Legacy Admin Approval Mode (TypeOfAdminApprovalMode = 1) is set on target clients.

2. SEPM Database Backup Error: "Invalid TLS padding data" on SQL Server

Per Broadcom TechDocs, when the Microsoft SQL Server hosting the SEPM database has SEP 14.3 RU6–RU9 installed with IPS Out-of-Band scanning enabled alongside hardened Windows Server TLS updates (such as Server 2025 KB5126646), SEPM logs: One Time Backup failed due to a database access error: Invalid TLS padding data. Workaround: Disable Out-of-Band scanning in the SEPM IPS policy for the SQL Server.

3. Windows Server 2025 Requires SEPM 14.3 RU10+ (Security Center Bug)

Broadcom System Requirements (KB154575) mandate SEPM and SEP Client 14.3 RU10 (14.3.27665.10000) or 14.4 (14.4.387.0000) for Windows Server 2025 and SQL Server 2025 support. Even on 14.3 RU10 and 14.4, Broadcom documents a known issue where Windows Security Center in Windows Server 2025 does not recognize the installed SEP agent.

4. Win 11 ARM64 Auto-Upgrade Failure (SEPM-9686) & Apache/Tomcat CVE Advisories

In SEPM 14.4, auto-upgrading Windows 11 ARM64 clients fails because the client reports an unrecognized OS version to SEPM (SEPM-9686 — manual upgrade required). Also note Broadcom advisories KB457006 (Sept 25, 2026) and KB457304 (Sept 28, 2026) confirming that vulnerability scanners flagging SEPM’s bundled Apache/Tomcat for CVE-2026-29167 and CVE-2026-76183 are false positives (SEPM 14.5 is slated for late Oct 2026).

Verified Sources: Broadcom TechDocs (Known Issues for SEP 14.4 & 14.3 RU10) ↗ Broadcom KB154575 (SEPM Versions & Server 2025 Requirements) ↗ Broadcom KB457006 (SEPM Apache 2026 CVEs & SEPM 14.5 Note) ↗ Broadcom KB457304 (SEPM Tomcat CVE-2026-76183) ↗