Updated 2026-10-17 · source: Microsoft Windows release health, the Exchange Team blog and the October KB articles, re-read 2026-10-17
The October 2026 updates fix one actively exploited Windows vulnerability (the Windows Shell Mark-of-the-Web bypass, KEV deadline 2026-10-16). They also bring one Exchange outage with a Microsoft workaround and no fix yet, one deliberate hardening change that breaks a common Wi-Fi and VPN setup, and two known issues with workarounds. This page is the second half of the picture our monthly patch brief gives you: that one says what to patch, this one says what to watch when you do. We update it as Microsoft's status changes, and every change is listed at the end.
Updated 2026-10-17: Microsoft now has a workaround, and says do not uninstall the update. On 2026-10-16 Microsoft opened a release-health entry, status Mitigated: "Users might be unable to sign in to OWA or send emails on Exchange Server". The Exchange Team published Exchange servers may become unstable after installation of October 2026 Windows updates.
Cause (Microsoft): the October update "introduced a default limit on the amount of memory used by Endpoint Mapper when handling Endpoint Lookup calls". For Exchange, the default of 512 simultaneous Endpoint Lookup calls "might not be sufficient under heavy load". Severity and timing depend on server load, and "some servers might never see a problem".
Symptoms (Microsoft):
MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142), with event ID 1006 in the Application log.A reboot can clear it temporarily. Exchange Server 2016, 2019 and Subscription Edition are affected. Installing the October Exchange security update is not required for this to happen, and it is not the cause.
| Platform | October update |
|---|---|
| Windows Server 2025 | KB5126646 |
| Windows Server 2022 | KB5126655 |
| Windows Server 2019 | KB5126651 |
| Windows Server 2016 | KB5126868 |
Microsoft's recommendation:
reg add "HKLM\
The setting raises the number of simultaneous Endpoint Lookup calls, and so the memory Endpoint Mapper may use. Microsoft calls it a temporary mitigation. It also offers an additional mitigation through Microsoft Support for business. There is no fix update yet; Microsoft is still investigating.
What to do:
ec=1142 and queue growth to confirm it holds.This is the one most likely to reach your service desk as "the Wi-Fi broke after patching". KB5127648 (Windows 11 24H2, 25H2 and 26H2) and Microsoft's NTLMv1 article KB5066470 (updated 2026-10-14) say the October update changes a default. If the BlockNtlmv1SSO registry value is not set, Windows now uses Enforce mode instead of Audit mode, and blocks NTLMv1-derived credentials for Single Sign-On. KB5066470 names KB5127648 and KB5126646 (Windows Server 2025) as the updates that make the change.
Who it hits: devices where Credential Guard is disabled, connecting to Wi-Fi, wired networks or VPNs that use MS-CHAPv2: PEAP-MSCHAPv2 and EAP-MSCHAPv2. Those connections stop connecting on their own. Typing credentials in by hand still works, but Microsoft's Credential Guard guidance says they cannot be saved for future use. Devices with Credential Guard on already blocked this and are unaffected.
Fix status: there will be no fix. Microsoft calls this a planned security change, not a known issue.
What Microsoft recommends:
BlockNtlmv1SSO as a REG_DWORD under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 and set it to 0 to return to Audit mode. Windows then logs event 4024 in the Microsoft-Windows-NTLM/Operational log, which shows you what still depends on it. When those dependencies are gone, set it to 1; blocked requests then log event 4025.⚠️ The registry value turns a security control back off. Treat it as a documented, time-limited exception, not as the fix. Do not hold the October update to avoid this: the same update carries the fix for the exploited Windows Shell vulnerability.
Microsoft opened this on 2026-10-13 with status Mitigated (Windows 11 25H2 release health). After KB5124010 (the 2026-09-22 preview) or later updates, including October's KB5127648, non-admin users may be unable to connect over Remote Desktop to hosts that have Administrator protection enabled. The error is 0xC000000D, "The token that was passed to the function is invalid."
Affected: Windows 11 26H2, 26H1, 25H2 and 24H2 as Remote Desktop hosts. No server platforms. KB5127648 also lists it as a known issue.
Why it matters this month: Microsoft notes that Administrator protection is on by default in the Windows 11 24H2/25H2/26H2 security baselines, so estates that adopt the October baselines are the likeliest to hit it.
Workaround: temporarily turn off Administrator protection on the affected hosts, by resetting the "User Account Control Type Of Admin Approval Mode" policy in Intune or Group Policy. Microsoft says a fix will come in a future update. If you are rolling out the October baselines, decide about Administrator protection on Remote Desktop hosts first.
KB5127648 lists this as a known issue (KB5127648, known issues section). After the October update, some devices might be unable to turn on Smart App Control in the Windows Security app if it had been turned off. The option may be grayed out. Devices where Smart App Control is already on "are not affected and remain protected", so no protection is lost. You just can't switch it back on.
Affected: Windows 11 24H2, 25H2 and 26H2.
Workaround (Microsoft):
2883193997 and 2850574478 to 1 under HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides , then restart.Microsoft says it is working on a resolution for an upcoming release.
KB5130994 (published 2026-10-06) says RD Web Access on Windows Server 2016 through 2025 fails to render when XSLT is disabled in Microsoft Edge or Google Chrome, because the portal relies on the browser's XSLT processor. The trigger is the browser change, not a Windows update. Microsoft lists workarounds, including re-enabling XSLT through the XSLTEnabled browser policy, and says it "is working on a fix". As of 2026-10-15 there is no fixed update.
First, it closes the actively exploited Windows Shell Mark-of-the-Web bypass (CVE-2026-96951). CISA's deadline for federal agencies is 2026-10-16. See the monthly brief. Deferral is a decision to stay exposed to a bug in active use.
Second, KB5127648 (Windows 11 24H2/25H2/26H2) is itself the fix for several earlier regressions:
Third, the October updates for Windows 11 23H2 (KB5126653), Windows 10 21H2/22H2 (KB5126657), Windows 10 1809 / Server 2019 (KB5126651) and Windows 10 1607 / Server 2016 (KB5126868) fix the September File History backup failure on those platforms. The newer Windows 11 versions were fixed in September.
And from September, now closed on one more platform: the USB Audio Class 1.0 "Code 10" / no-sound issue is marked Resolved by KB5129237 on Windows Server 2022 (updated 2026-10-13, Server 2022 release health). On the other platforms Microsoft still lists it as Mitigated (last updated 2026-09-29).
EpmapSavedContextCap registry workaround, as above, and watch for the fix update. Do not uninstall it.Decide per workload, not per estate: each of these hits a specific role and leaves the rest of the fleet alone.
2026-10-17: Exchange outage. Was: under investigation, no workaround; decide per estate whether to hold the Windows Server update. Now: Mitigated. Microsoft's release-health entry (2026-10-16) and Exchange Team post give the cause (Endpoint Mapper lookup limit), the EpmapSavedContextCap registry workaround and "do not uninstall"; no fix update yet. Added the Smart App Control known issue listed in KB5127648 (workaround available).
2026-10-15: first published.
Updated 2026-10-17 from Microsoft's Windows release health documentation, the October 2026 KB articles and the Exchange Team blog (re-read 2026-10-17). Known-issue status, affected platforms and fix availability change without notice. Verify against Microsoft's current page before acting on anything here. Prepared for practitioners. Not affiliated with, or endorsed by, Microsoft.
Microsoft documentation below was read on 2026-10-15 and re-read on 2026-10-17.
EpmapSavedContextCap registry workaround and the advice to raise it if the problem recurs.Compiled by patchtriage.com. We verify against vendor primary sources and say so when we cannot.