Windows Server 26100.33451 → 26100.33674

2 releases · 0 breaking changes · 44 security fixes · 36 advisories fixed

44security0breaking0deprecated4feature1fix

Is 26100.33451 affected?

Vulnerabilities fixed by this upgrade

9.8 CVE-2026-100202 Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
7.8 CVE-2026-100215 Microsoft Graphics Component Remote Code Execution Vulnerability
9.8 CVE-2026-100219 Microsoft QUIC Remote Code Execution Vulnerability
8.8 CVE-2026-100220 Windows Media Video Decoder Remote Code Execution Vulnerability
7.0 CVE-2026-102211 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
8.8 CVE-2026-102214 Windows Hyper-V Remote Code Execution Vulnerability
8.8 CVE-2026-102225 Windows Text Shaping Remote Code Execution Vulnerability
9.8 CVE-2026-105016 Microsoft QUIC Remote Code Execution Vulnerability
8.8 CVE-2026-105733 Windows Hyper-V Remote Code Execution Vulnerability
7.8 CVE-2026-108130 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
7.5 CVE-2026-108131 Active Directory Federation Services (AD FS) Spoofing Vulnerability
7.2 CVE-2026-108399 Windows Hyper-V Elevation of Privilege Vulnerability
8.1 CVE-2026-108457 Microsoft Windows PDF Remote Code Execution Vulnerability
8.1 CVE-2026-108460 Windows Message Queuing Remote Code Execution Vulnerability
8.8 CVE-2026-108467 Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
8.1 CVE-2026-69802 Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability
9.8 CVE-2026-70147 Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
9.8 CVE-2026-70153 Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
8.1 CVE-2026-70187 Windows Remote Desktop Services Remote Code Execution Vulnerability
8.1 CVE-2026-70229 Windows Active Directory Domain Services Remote Code Execution Vulnerability
8.8 CVE-2026-70250 Windows DHCP Client Remote Code Execution Vulnerability
7.0 CVE-2026-83917 Windows ALPC Elevation of Privilege Vulnerability
8.8 CVE-2026-83934 Windows GDI+ Remote Code Execution Vulnerability
8.8 CVE-2026-88073 Windows Graphics Kernel Elevation of Privilege Vulnerability
8.1 CVE-2026-88117 Windows DHCP Server Remote Code Execution Vulnerability
8.1 CVE-2026-88119 Windows DHCP Server Remote Code Execution Vulnerability
8.1 CVE-2026-88120 Windows DHCP Server Remote Code Execution Vulnerability
8.1 CVE-2026-88171 Windows DHCP Server Remote Code Execution Vulnerability
8.1 CVE-2026-88174 Windows Deployment Services Remote Code Execution Vulnerability
7.4 CVE-2026-96222 Active Directory Federation Services (AD FS) Spoofing Vulnerability
8.8 CVE-2026-96913 Windows Kernel Elevation of Privilege Vulnerability
8.8 CVE-2026-96914 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
9.8 CVE-2026-96934 Windows DHCP Server Remote Code Execution Vulnerability
8.8 CVE-2026-96951KEV Windows Shell Security Feature Bypass Vulnerability
8.8 CVE-2026-96952 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
9.8 CVE-2026-97814 Windows Text Shaping Remote Code Execution Vulnerability

Breaking changes

None in the release notes.

Security changes

security Security update: includes the October 2026 Security Updates in 26100.33674
security Fixes CVE-2026-96951: Windows Shell Security Feature Bypass Vulnerability in 26100.33650
security Fixes CVE-2026-100202: Windows Message Queuing Queue Manager Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-100219: Microsoft QUIC Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-105016: Microsoft QUIC Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-70147: Microsoft PostScript Printer Driver Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-70153: Microsoft PostScript Printer Driver Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-96934: Windows DHCP Server Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-97814: Windows Text Shaping Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-100220: Windows Media Video Decoder Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-102214: Windows Hyper-V Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-102225: Windows Text Shaping Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-105733: Windows Hyper-V Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-108467: Microsoft PostScript Printer Driver Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-70250: Windows DHCP Client Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-83934: Windows GDI+ Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-88073: Windows Graphics Kernel Elevation of Privilege Vulnerability in 26100.33650
security Fixes CVE-2026-96913: Windows Kernel Elevation of Privilege Vulnerability in 26100.33650
security Fixes CVE-2026-96914: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability in 26100.33650
security Fixes CVE-2026-96952: Microsoft Windows Media Foundation Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-108457: Microsoft Windows PDF Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-108460: Windows Message Queuing Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-69802: Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-70187: Windows Remote Desktop Services Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-70229: Windows Active Directory Domain Services Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-88117: Windows DHCP Server Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-88119: Windows DHCP Server Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-88120: Windows DHCP Server Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-88171: Windows DHCP Server Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-88174: Windows Deployment Services Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-100215: Microsoft Graphics Component Remote Code Execution Vulnerability in 26100.33650
security Fixes CVE-2026-108130: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability in 26100.33650
security Fixes CVE-2026-108131: Active Directory Federation Services (AD FS) Spoofing Vulnerability in 26100.33650
security Fixes CVE-2026-96222: Active Directory Federation Services (AD FS) Spoofing Vulnerability in 26100.33650
security Fixes CVE-2026-108399: Windows Hyper-V Elevation of Privilege Vulnerability in 26100.33650
security Fixes CVE-2026-102211: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability in 26100.33650
security Fixes CVE-2026-83917: Windows ALPC Elevation of Privilege Vulnerability in 26100.33650
security Security update: includes the October 2026 Security Updates in 26100.33650
security [ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening… in 26100.33650
security [Security] This update adds support for ML-KEM post-quantum key exchange in Transport Layer Security (TLS) 1.3, helping protect encrypted connections against future quantum-computing threats. in 26100.33650
security [Security] This update upgrades the version of cURL included with Windows to version 8.21.0. in 26100.33650
security [Emoji] This update improves security for emoji search in the Expressive Input Panel by updating the libraries used by EmojiSearchData. in 26100.33650
security [Distributed Key Manager (DKM)] This update automatically remediates insecure DKM container ACL configurations in AD FS by default. Administrators can opt out of automatic remediation by setting RemediateDkmAcl to 0. This change helps address an elevation of privilege vulnerability that can occur… in 26100.33650
security [Authentication] This update strengthens NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not set. Windows now uses Enforce mode (1) instead of Audit mode (0), blocking the generation of NTLMv1-derived credentials for Single Sign-On (SSO). This… in 26100.33650

Every release in between

26100.33674 Oct 26, 2026 Release notes ↗

securitySecurity update: includes the October 2026 Security Updates

other[Certificates] This update includes an updated trusted root certificate payload in the Windows cumulative update for devices that cannot access Microsoft’s certificate-update service and devices where automatic certificate trust list (CTL) updates are disabled. To learn more, see Certificates and…

26100.33650 Oct 13, 2026 Release notes ↗

securityFixes CVE-2026-96951: Windows Shell Security Feature Bypass Vulnerability

securityFixes CVE-2026-100202: Windows Message Queuing Queue Manager Remote Code Execution Vulnerability

securityFixes CVE-2026-100219: Microsoft QUIC Remote Code Execution Vulnerability

securityFixes CVE-2026-105016: Microsoft QUIC Remote Code Execution Vulnerability

securityFixes CVE-2026-70147: Microsoft PostScript Printer Driver Remote Code Execution Vulnerability

securityFixes CVE-2026-70153: Microsoft PostScript Printer Driver Remote Code Execution Vulnerability

securityFixes CVE-2026-96934: Windows DHCP Server Remote Code Execution Vulnerability

securityFixes CVE-2026-97814: Windows Text Shaping Remote Code Execution Vulnerability

securityFixes CVE-2026-100220: Windows Media Video Decoder Remote Code Execution Vulnerability

securityFixes CVE-2026-102214: Windows Hyper-V Remote Code Execution Vulnerability

securityFixes CVE-2026-102225: Windows Text Shaping Remote Code Execution Vulnerability

securityFixes CVE-2026-105733: Windows Hyper-V Remote Code Execution Vulnerability

securityFixes CVE-2026-108467: Microsoft PostScript Printer Driver Remote Code Execution Vulnerability

securityFixes CVE-2026-70250: Windows DHCP Client Remote Code Execution Vulnerability

securityFixes CVE-2026-83934: Windows GDI+ Remote Code Execution Vulnerability

securityFixes CVE-2026-88073: Windows Graphics Kernel Elevation of Privilege Vulnerability

securityFixes CVE-2026-96913: Windows Kernel Elevation of Privilege Vulnerability

securityFixes CVE-2026-96914: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

securityFixes CVE-2026-96952: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

securityFixes CVE-2026-108457: Microsoft Windows PDF Remote Code Execution Vulnerability

securityFixes CVE-2026-108460: Windows Message Queuing Remote Code Execution Vulnerability

securityFixes CVE-2026-69802: Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability

securityFixes CVE-2026-70187: Windows Remote Desktop Services Remote Code Execution Vulnerability

securityFixes CVE-2026-70229: Windows Active Directory Domain Services Remote Code Execution Vulnerability

securityFixes CVE-2026-88117: Windows DHCP Server Remote Code Execution Vulnerability

securityFixes CVE-2026-88119: Windows DHCP Server Remote Code Execution Vulnerability

securityFixes CVE-2026-88120: Windows DHCP Server Remote Code Execution Vulnerability

securityFixes CVE-2026-88171: Windows DHCP Server Remote Code Execution Vulnerability

securityFixes CVE-2026-88174: Windows Deployment Services Remote Code Execution Vulnerability

securityFixes CVE-2026-100215: Microsoft Graphics Component Remote Code Execution Vulnerability

securityFixes CVE-2026-108130: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

securityFixes CVE-2026-108131: Active Directory Federation Services (AD FS) Spoofing Vulnerability

securityFixes CVE-2026-96222: Active Directory Federation Services (AD FS) Spoofing Vulnerability

securityFixes CVE-2026-108399: Windows Hyper-V Elevation of Privilege Vulnerability

securityFixes CVE-2026-102211: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

securityFixes CVE-2026-83917: Windows ALPC Elevation of Privilege Vulnerability

securitySecurity update: includes the October 2026 Security Updates

feature[Quick machine recovery] New! Quick machine recovery is now supported on Windows Server 2025. During outages, Quick machine recovery helps recover devices from critical boot failures by using Windows Recovery Environment (WinRE) to find and apply targeted remediations from Windows Update. The…

security[ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening…

security[Security] This update adds support for ML-KEM post-quantum key exchange in Transport Layer Security (TLS) 1.3, helping protect encrypted connections against future quantum-computing threats.

+12 more items in the release notes