October 2026 Windows updates: the Windows Server update can take Exchange offline, and NTLMv1 enforcement breaks MS-CHAPv2 Wi-Fi and VPN sign-in

Updated 2026-11-11 · source: Microsoft Windows release health, the Exchange Team blog and the October KB articles, re-read 2026-10-17; Always On VPN and Exchange re-checked 2026-10-23; RDP, Smart App Control, Always On VPN and Excel re-checked 2026-11-03; every open item re-checked 2026-11-11 against the November 10 updates

🔄 Updated 2026-11-11: the November 10 updates close almost everything on this page. The Exchange outage is Resolved on every Windows Server version by the November 10 updates (KB5131080 / KB5131090 / KB5131085 / KB5131291; Microsoft says the registry value can stay but is no longer required). On Windows 11 24H2, KB5132061 fixes the Remote Desktop 0xC000000D failure and the Smart App Control toggle, and carries the October preview fixes (including Always On VPN) that 24H2 never got. RD Web Access is fixed by the November server updates. The one item that stays is the NTLMv1 / MS-CHAPv2 enforcement, which Microsoft calls a planned change, not an issue. November's own page is here.

The October 2026 updates fix one actively exploited Windows vulnerability (the Windows Shell Mark-of-the-Web bypass, KEV deadline 2026-10-16). They also brought one Exchange outage, one deliberate hardening change that breaks a common Wi-Fi and VPN setup, and two known issues that were fixed on Windows 11 25H2 and 26H2 by the optional 2026-10-28 preview update and on 24H2 by the November 10 update. The September Always On VPN regression followed the same path. This page is the second half of the picture our monthly patch brief gives you: that one says what to patch, this one says what to watch when you do. We update it as Microsoft's status changes, and every change is listed at the end.

✅ Fixed by the November 10 Windows Server updates: the October Windows Server update could take Exchange Server offline

Updated 2026-11-11: Resolved. Microsoft's release-health pages for Windows Server 2025 (KB5131080), Windows Server 2022 (KB5131090), Windows Server 2019 (KB5131085) and Windows Server 2016 (KB5131291) now read "Resolved: 2026-11-10", and add: "If you install an update released November 10, 2026 (KB5131080) or later, you do not need to use a workaround for this issue." The Exchange Team's November 2026 SU post says: "Customers who have created the registry key to address the issue in October can leave the registry key in place, but the key is not required once November 2026 Windows Server updates are installed. It does not matter in which order November 2026 Exchange Server vs. Windows Server updates are installed." The same post ships November security updates for Exchange Server Subscription Edition only and says Exchange 2016 and 2019 should be considered "permanently vulnerable". The history below is how October went.

Updated 2026-10-21: Microsoft says no fix is coming soon, so install now and set the registry value, before installing if you like. In a FAQ added to its post on 2026-10-20, the Exchange Team says there is "no imminent follow-up release from either Windows or Exchange", and that you should not wait for one. It also says the registry value can be created before the October update is installed: Windows reads it only once the update is in place, and the value survives installation. Microsoft has not yet seen a case that needed a value above 65536. Release health is unchanged (Mitigated, last updated 2026-10-16).

Updated 2026-10-17: Microsoft now has a workaround, and says do not uninstall the update. On 2026-10-16 Microsoft opened a release-health entry, status Mitigated: "Users might be unable to sign in to OWA or send emails on Exchange Server". The Exchange Team published Exchange servers may become unstable after installation of October 2026 Windows updates.

Cause (Microsoft): the October update "introduced a default limit on the amount of memory used by Endpoint Mapper when handling Endpoint Lookup calls". For Exchange, the default of 512 simultaneous Endpoint Lookup calls "might not be sufficient under heavy load". Severity and timing depend on server load, and "some servers might never see a problem".

Symptoms (Microsoft):

users cannot sign in to Outlook on the web (OWA);
messages stay in the Outlook Outbox;
mail queues grow during the day;
mailbox replication and DAG quorum problems;
OWA can fail with MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142), with event ID 1006 in the Application log.

A reboot can clear it temporarily. Exchange Server 2016, 2019 and Subscription Edition are affected. Installing the October Exchange security update is not required for this to happen, and it is not the cause.

Platform	October update
Windows Server 2025	KB5126646
Windows Server 2022	KB5126655
Windows Server 2019	KB5126651
Windows Server 2016	KB5126868

Microsoft's recommendation:

Do not uninstall the October 2026 Windows Server updates.
On each affected Exchange server, from an elevated command prompt:

reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f

Restart the server.
Monitor. If the problem comes back, raise the value further; Microsoft says it has not yet seen a case where that was needed. Microsoft says this has solved the problem in the customer cases it has assisted so far.

The setting raises the number of simultaneous Endpoint Lookup calls, and so the memory Endpoint Mapper may use. Microsoft calls it a temporary mitigation. It also offers an additional mitigation through Microsoft Support for business. There is no fix update, and Microsoft says none is imminent; both teams are still analysing it long-term.

What to do:

If you have installed the update and see the symptoms: apply the registry value and restart. Keep alerting on event 1006, ec=1142 and queue growth to confirm it holds.
If you held the update on Exchange servers: install it now. Microsoft says the October Windows Server updates "carry a significant security payload" and should not be delayed for this one issue, and it confirms you can create the registry value before installing. Set the value, install, restart and monitor. That closes the gap on the October Windows security fixes, including the actively exploited Windows Shell bug.
Don't wait for a fix update. Microsoft says none is imminent. If one ships, the registry value should be revisited; we will note it here.

🟠 By design, no fix coming: Wi-Fi, wired 802.1X and VPN using MS-CHAPv2 stop connecting automatically

This is the one most likely to reach your service desk as "the Wi-Fi broke after patching". KB5127648 (Windows 11 24H2, 25H2 and 26H2) and Microsoft's NTLMv1 article KB5066470 (updated 2026-10-14) say the October update changes a default. If the BlockNtlmv1SSO registry value is not set, Windows now uses Enforce mode instead of Audit mode, and blocks NTLMv1-derived credentials for Single Sign-On. KB5066470 names KB5127648 and KB5126646 (Windows Server 2025) as the updates that make the change.

Who it hits: devices where Credential Guard is disabled, connecting to Wi-Fi, wired networks or VPNs that use MS-CHAPv2: PEAP-MSCHAPv2 and EAP-MSCHAPv2. Those connections stop connecting on their own. Typing credentials in by hand still works, but Microsoft's Credential Guard guidance says they cannot be saved for future use. Devices with Credential Guard on already blocked this and are unaffected.

Fix status: there will be no fix. Microsoft calls this a planned security change, not a known issue.

What Microsoft recommends:

Move off MS-CHAPv2 to certificate-based EAP-TLS or PEAP-TLS. This is the durable answer. Microsoft's Credential Guard guidance says MS-CHAPv2 endpoints are "subject to similar attacks as for NTLMv1".
As a temporary bridge only: create BlockNtlmv1SSO as a REG_DWORD under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 and set it to 0 to return to Audit mode. Windows then logs event 4024 in the Microsoft-Windows-NTLM/Operational log, which shows you what still depends on it. When those dependencies are gone, set it to 1; blocked requests then log event 4025.

⚠️ The registry value turns a security control back off. Treat it as a documented, time-limited exception, not as the fix. Do not hold the October update to avoid this: the same update carries the fix for the exploited Windows Shell vulnerability.

✅ Fixed on every version: non-admin Remote Desktop connections fail with 0xC000000D on hosts with Administrator protection

Update 2026-11-11: fixed on 24H2 too. Microsoft's Windows 11 24H2 release health now reads "Resolved: 2026-11-10" by KB5132061, and KB5127648's known-issues entry says the issue "was resolved for Windows 11, version 24H2, by Windows updates released on or after November 10, 2026 (KB5132061)". Once KB5132061 is installed, the Administrator protection workaround can be removed.

Update 2026-11-03: fixed by the 2026-10-28 preview updates, except on 24H2. Microsoft's release-health pages now mark this Resolved on 2026-10-28: on Windows 11 25H2 and 26H2 by KB5127936, and on 26H1 by KB5127653. Both are optional non-security preview updates ("resolved by Windows updates released October 28, 2026 … and later"). On Windows 11 24H2 the issue is still Mitigated (24H2 release health, last updated 2026-10-13); Microsoft no longer ships preview updates for 24H2, so keep the workaround below there.

Microsoft opened this on 2026-10-13 with status Mitigated (Windows 11 25H2 release health). After KB5124010 (the 2026-09-22 preview) or later updates, including October's KB5127648, non-admin users may be unable to connect over Remote Desktop to hosts that have Administrator protection enabled. The error is 0xC000000D, "The token that was passed to the function is invalid."

Affected: Windows 11 26H2, 26H1, 25H2 and 24H2 as Remote Desktop hosts. No server platforms. KB5127648 also lists it as a known issue.

Why it matters this month: Microsoft notes that Administrator protection is on by default in the Windows 11 24H2/25H2/26H2 security baselines, so estates that adopt the October baselines are the likeliest to hit it.

Workaround: temporarily turn off Administrator protection on the affected hosts, by resetting the "User Account Control Type Of Admin Approval Mode" policy in Intune or Group Policy. Microsoft says a fix will come in a future update. If you are rolling out the October baselines, decide about Administrator protection on Remote Desktop hosts first.

✅ Fixed on every version: Smart App Control can't be turned back on after the October update

Update 2026-11-11: fixed on 24H2 too. KB5127648's known-issues entry now says: "This issue was resolved for Windows 11, version 24H2, by Windows updates released on or after November 10, 2026 (KB5132061)." The registry and Group Policy workarounds below are no longer needed once KB5132061 is installed.

Update 2026-11-03: fixed on 25H2 and 26H2 by the 2026-10-28 preview. KB5127936 lists "[Smart App Control (Known issue)] Fixed", and KB5127648's known-issues entry now says the issue "was resolved for Windows 11, versions 26H2 and 25H2, by Windows updates released on and after October 27, 2026 (KB5127936)". (Microsoft's two pages differ by a day; KB5127936 itself is dated October 28.) On 24H2, use the workaround below.

KB5127648 lists this as a known issue (KB5127648, known issues section). After the October update, some devices might be unable to turn on Smart App Control in the Windows Security app if it had been turned off. The option may be grayed out. Devices where Smart App Control is already on "are not affected and remain protected", so no protection is lost. You just can't switch it back on.

Affected: Windows 11 24H2, 25H2 and 26H2.

Workaround (Microsoft):

Registry: from an elevated command prompt, set the DWORD values 2883193997 and 2850574478 to 1 under HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides, then restart.
Managed devices: install both special Group Policies Microsoft links from the KB ("KB5074105 261015_19222 Feature Preview" and "KB5074105 261015_19221 Feature Preview"), set both to Enabled, and restart.

Microsoft said on 2026-10-16 that it was working on a resolution; that resolution is KB5127936 for 25H2 and 26H2.

✅ Fixed by the November 10 Windows Server updates: RD Web Access fails to load when browsers disable XSLT (KB5130994)

Update 2026-11-11: fixed. The November Windows Server updates (KB5131080, KB5131090) say RD Web Access "pages are now rendered on the server and no longer depend on browser XSLT support". KB5130994 now adds: "If you deployed any of the three workarounds in this article, we still recommend that you install the November 2026 Windows security update. If you re-enabled XSLT as a workaround, you should disable it again."

KB5130994 (published 2026-10-06) says RD Web Access on Windows Server 2016 through 2025 fails to render when XSLT is disabled in Microsoft Edge or Google Chrome, because the portal relies on the browser's XSLT processor. The trigger is the browser change, not a Windows update. Microsoft lists workarounds, including re-enabling XSLT through the XSLTEnabled browser policy, and says it "is working on a fix". As of 2026-10-15 there is no fixed update.

✅ Always On VPN: fixed on 25H2, 26H2 and 26H1 by the 2026-10-28 preview; reaches 24H2 with the November 10 update

Update 2026-11-11: 24H2. KB5132061's notes for Windows 11 24H2 say the update "includes improvements and fixes from the November 2026 security update, along with those previously released for Windows 11, versions 25H2 and 26H2, in the October 2026 non-security preview update (KB5127936)", and KB5127936 carried this fix. Microsoft does not name Always On VPN in KB5132061, and the public release-health pages still have no entry for the issue, so this is a fix by inclusion rather than an explicit statement. Test automatic protocol selection on a 24H2 pilot before removing the single-protocol workaround.

Update 2026-11-03: fixed, except on 24H2. Both 2026-10-28 preview updates, KB5127936 (25H2 and 26H2) and KB5127653 (26H1), list the fix: affected connections "could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed", with "The specified port is already in use" on later attempts. Microsoft's release-health record in the Microsoft 365 admin center shows the 26H1 and 25H2 entries (WI1477233, WI1477234) resolved by those updates. Neither KB covers 24H2, and no 24H2 resolution is listed, so keep single-protocol profiles on 24H2. The public Learn release-health pages still have no entry for this issue. The history below is how the status moved in October.

What happened in October: Microsoft withdrew its first fix claim, and the workaround stayed in place. The September update (KB5124008) can leave Always On VPN connections stuck "Connecting", or failing with "The specified port is already in use" after a first failed attempt, when automatic protocol selection or fallback (for example IKEv2 and SSTP) is configured.

What KB5127648 says now: nothing about a fix. On 2026-10-20 Microsoft changed KB5127648: its change log says it "removed information about a fix for an Always On VPN connection issue" and that "this change will be included in a future release" (re-read 2026-10-23). Only the October notice in the Windows message center still lists the fix (re-read 2026-10-23).
What Microsoft's release-health record says: Mitigated, not resolved. On 2026-10-19 Microsoft returned the record to Mitigated (message IDs WI1477233, WI1477234, WI1477235 and WI1482218, in the Windows release health section of the Microsoft 365 admin center). It says the 2026-10-13 change to Resolved was a mistake, and that a fix is planned for an update "in the coming weeks". No resolved KB is listed for any version, and Windows 11 26H2 is now on the affected list. The public release-health pages on Microsoft Learn have no entry for this issue.
Workaround (Microsoft's): change the Always On VPN profile from automatic protocol selection to a single protocol, SSTP only or IKEv2 only, whichever suits your environment.

What to do now: on 25H2, 26H2 and 26H1, automatic protocol selection is safe again once the 2026-10-28 preview (or a later update) is installed. On 24H2, leave single-protocol profiles in place.

✅ Office: Excel 2016 paste failure came back in the October update, now fixed by a re-release of KB5002934

KB5002934, the October 13 security update for Excel 2016 (MSI), brought back September's paste bug. Microsoft's article now says: "This article originally described build 16.0.5574.1005. This release is now updated to build 16.0.5574.1006." The new build "fixes the issue that was reintroduced in 16.0.5574.1005, in which paste operations might fail if the workbook contains conditional formatting." The Microsoft Update Catalog has new "Update for Microsoft Excel 2016 (KB5002934)" entries dated 2026-10-28. Microsoft's article does not say whether WSUS carries the re-release, so if your Excel 2016 machines are still on build 16.0.5574.1005, import the 2026-10-28 update from the Catalog. Microsoft 365 Apps are not covered by this KB.

✅ What the October update fixes — the case against blanket deferral

First, it closes the actively exploited Windows Shell Mark-of-the-Web bypass (CVE-2026-96951). CISA's deadline for federal agencies is 2026-10-16. See the monthly brief. Deferral is a decision to stay exposed to a bug in active use.

Second, KB5127648 (Windows 11 24H2/25H2/26H2) is itself the fix for several earlier regressions (KB5127648 itself no longer claims the Always On VPN fix; that fix arrived in the 2026-10-28 preview, see the section above):

Black screen or desktop loading problems after sign-in in some virtual desktop environments (Azure Virtual Desktop / FSLogix, from KB5120998): Resolved.
Applications that use Windows' built-in AC-3 (Dolby Digital) decoding closing unexpectedly (from KB5124010): Resolved.

Third, the October updates for Windows 11 23H2 (KB5126653), Windows 10 21H2/22H2 (KB5126657), Windows 10 1809 / Server 2019 (KB5126651) and Windows 10 1607 / Server 2016 (KB5126868) fix the September File History backup failure on those platforms. The newer Windows 11 versions were fixed in September.

And from September, now closed on one more platform: the USB Audio Class 1.0 "Code 10" / no-sound issue is marked Resolved by KB5129237 on Windows Server 2022 (updated 2026-10-13, Server 2022 release health). On the other platforms it was still Mitigated until the November 10 updates; release health now marks the remaining symptoms Resolved: 2026-11-10 on Windows 11 24H2 and 25H2 (KB5132061), Windows Server 2025 (KB5131080), 2019 (KB5131085) and 2016 (KB5131291), and Windows 10 22H2 (KB5131096).

What to actually do

Everywhere: if you are still on the October update, go straight to the November 10 update; it carries every fix below plus November's own.
Exchange servers: install the November Windows Server update. The EpmapSavedContextCap registry value can stay in place; Microsoft says it is no longer required. If you held the October update, you no longer need the workaround at all: install November.
Enterprise Wi-Fi, wired 802.1X and VPN on MS-CHAPv2: unchanged, and permanent. Plan the move to EAP-TLS, and if you must, use the registry value as a dated exception.
Always On VPN with automatic protocol selection: fixed on 25H2, 26H2 and 26H1 since the 2026-10-28 preview; on 24H2, install KB5132061 and test on a pilot before removing single-protocol profiles.
Remote Desktop hosts with Administrator protection: fixed on every version once the 2026-10-28 preview (25H2, 26H2, 26H1) or KB5132061 (24H2) is installed. Remove the workaround after confirming.
Devices where Smart App Control was off and you want it on: fixed on every version by the same updates. Remove the registry or Group Policy workaround after confirming.
RD Web Access: install the November Windows Server update, then turn XSLT back off in Edge and Chrome if you re-enabled it.
Excel 2016 (MSI): make sure machines have the re-released KB5002934 (build 16.0.5574.1006).

Decide per workload, not per estate: each of these hits a specific role and leaves the rest of the fleet alone.

What changed on this page

2026-11-11: Exchange outage. Was: Mitigated, registry workaround, "don't wait for a fix". Now: Resolved on Windows Server 2025, 2022, 2019 and 2016 by the November 10 updates (KB5131080 / KB5131090 / KB5131085 / KB5131291); the registry value can stay but is not required. Remote Desktop 0xC000000D and Smart App Control: was fixed on 25H2/26H2/26H1 only; now also fixed on 24H2 by KB5132061. Always On VPN: 24H2 receives the KB5127936 fixes through KB5132061 (by inclusion; Microsoft does not name it). RD Web Access XSLT: was open; now fixed by the November server updates (server-side rendering). USB audio: now Resolved on the remaining platforms. "What to do" rewritten; pointer to the November page.

2026-11-03: Remote Desktop 0xC000000D, Smart App Control and Always On VPN. Was: Mitigated / not fixed, workarounds only. Now: fixed by the optional 2026-10-28 preview updates KB5127936 (25H2, 26H2) and KB5127653 (26H1; it does not cover Smart App Control, which never affected 26H1). Still not fixed on 24H2, which gets no preview updates; keep the workarounds there. Added the Excel 2016 paste regression in KB5002934 and its re-release.

2026-10-23: Always On VPN. Was: "Microsoft's sources disagree"; KB5127648 still claimed the fix. Now: Microsoft removed the fix claim from KB5127648 on 2026-10-20 ("this change will be included in a future release"), so the KB and the release-health record agree it is not fixed; only the message center still lists it. Advice unchanged: keep single-protocol profiles.

2026-10-21: Exchange outage. Was: Mitigated, registry workaround, "watch for the fix update"; setting the value before installing was our suggestion. Now: still Mitigated, but Microsoft's FAQ (2026-10-20) says no follow-up release from Windows or Exchange is imminent, and confirms the value can be set before installing. Advice changed from "watch for the fix" to "don't wait".

2026-10-20: Always On VPN. Was: listed under "What the October update fixes", sourced to KB5127648. Now: its own caution section. Microsoft's release-health record went back to Mitigated on 2026-10-19: Microsoft says the earlier Resolved status was a mistake and a fix is still to come. KB5127648 still claims the fix, so keep the single-protocol workaround.

2026-10-17: Exchange outage. Was: under investigation, no workaround; decide per estate whether to hold the Windows Server update. Now: Mitigated. Microsoft's release-health entry (2026-10-16) and Exchange Team post give the cause (Endpoint Mapper lookup limit), the EpmapSavedContextCap registry workaround and "do not uninstall"; no fix update yet. Added the Smart App Control known issue listed in KB5127648 (workaround available).

2026-10-15: first published.

Updated 2026-11-11 from Microsoft's Windows release health documentation, the October and November 2026 KB articles and the Exchange Team blog (re-read 2026-10-17; Exchange re-checked 2026-10-23; RDP, Smart App Control, Always On VPN and Excel re-checked 2026-11-03; all open items re-checked 2026-11-11). Known-issue status, affected platforms and fix availability change without notice. Verify against Microsoft's current page before acting on anything here. Prepared for practitioners. Not affiliated with, or endorsed by, Microsoft.

Sources

Microsoft documentation below was read on 2026-10-15 and re-read on 2026-10-17.

Exchange servers may become unstable after installation of October 2026 Windows updates, Exchange Team blog (Microsoft, 2026-10-16). Source for the symptoms, "do not uninstall", the EpmapSavedContextCap registry workaround and the advice to raise it if the problem recurs. Its FAQ (added 2026-10-20) is the source for "no imminent follow-up release" and for setting the value before installing.
Windows Server 2025 known issues and notifications (Microsoft; the same entry appears on the Server 2022, 2019 and 2016 pages). Source for "Users might be unable to sign in to OWA or send emails on Exchange Server": status Mitigated, opened 2026-10-16, the Endpoint Mapper cause and the 512-call default, the Microsoft Support mitigation, and "investigating".
Released: October 2026 Exchange Server Security Updates, Exchange Team blog (Microsoft). Original source for the Windows Server update / Exchange outage: the "Update October 15, 2026" banner, the error, event ID and the four Windows Server KBs, now pointing to the post above. Comments by administrators on that post are community reports.
KB5127648: October 13, 2026 security update for Windows 11 24H2 / 25H2 / 26H2 (Microsoft). Source for the NTLMv1 Enforce default, the 2026-10-20 change-log entry withdrawing the Always On VPN fix claim (re-read 2026-10-23), and the known-issues list, including Smart App Control.
Windows release health in the Microsoft 365 admin center: "Always On VPN connections might fail after installing the September 2026 update" (Microsoft; message IDs WI1477233 / WI1477234 / WI1477235 / WI1482218, visible to tenant admins; status as of 2026-10-19). Source for Mitigated, "mistakenly updated to Resolved on October 13", the planned fix and the single-protocol workaround.
Windows message center (Microsoft). The October 2026 update notice still lists the Always On VPN fix (re-read 2026-10-23).
KB5066470: changes to NTLMv1 in Windows (Microsoft; updated 2026-10-14). Source for the BlockNtlmv1SSO behaviour, the updates that make the change (KB5127648, KB5126646), the Credential Guard exemption, events 4024/4025, and the fact that no restart is needed.
Considerations and known issues when using Credential Guard: Wi-Fi and VPN (Microsoft Learn). Source for "can't save the credentials", the MS-CHAPv2 risk statement, and the PEAP-TLS / EAP-TLS recommendation.
KB5127936: October 28, 2026 preview for Windows 11 25H2 / 26H2 (Microsoft; read 2026-11-03). Source for the Remote Desktop, Smart App Control and Always On VPN fixes on 25H2 and 26H2.
KB5127653: October 28, 2026 preview for Windows 11 26H1 (Microsoft; read 2026-11-03). Source for the Remote Desktop and Always On VPN fixes on 26H1.
Windows 11, version 24H2 known issues and notifications (Microsoft; read 2026-11-03). Source for the RDP 0xC000000D issue still Mitigated on 24H2.
KB5002934: security update for Excel 2016, October 13, 2026 and the Microsoft Update Catalog (Microsoft; read 2026-11-03). Source for the build 1005 regression and the 1006 re-release.
Windows 11, version 25H2 known issues and notifications (Microsoft). Source for the RDP 0xC000000D entry (Resolved 2026-10-28 by KB5127936; Mitigated when first published), the AVD black-screen and AC-3 resolutions, and USB audio still Mitigated on 25H2.
Windows Server 2022 known issues and notifications (Microsoft). Source for USB audio Resolved by KB5129237 on Server 2022.
October 13, 2026 updates KB5126653, KB5126657, KB5126651 and KB5126868 (Microsoft). Each lists "[File History (known issue)] Fixed".
KB5130994: RD Web Access fails to load when XSLT is disabled (Microsoft). Source for the RD Web Access issue, its workarounds, and (re-read 2026-11-11) the advice to install the November update and disable XSLT again.
KB5132061: November 10, 2026 security update for Windows 11 24H2 / 25H2 / 26H2, KB5131080: November 10, 2026 security update for Windows Server 2025 and KB5131090: November 10, 2026 security update for Windows Server 2022 (Microsoft; read 2026-11-11). Source for the Exchange fix, the RD Web Access server-side rendering, the USB audio fix and the 24H2 note that KB5132061 includes the KB5127936 fixes.
Windows release health for Windows Server 2025, Windows Server 2022, Windows Server 2019 and Windows Server 2016 (Microsoft; read 2026-11-11). Source for the Exchange and USB audio entries "Resolved: 2026-11-10" and the resolving KB per platform.
Released: November 2026 Exchange Server Security Updates, Exchange Team blog (Microsoft; read 2026-11-11). Source for "the key is not required", the install-order statement and "permanently vulnerable".

Compiled by patchtriage.com. We verify against vendor primary sources and say so when we cannot.