Windows Update Watch, November 2026: Deploy Now, Except SQL Servers With Linked Servers

Four days after Patch Tuesday, here is our answer to the question every Windows admin asks: is November’s update safe to deploy? For almost everyone, yes. Microsoft’s own known-issues data shows nothing new that the November update itself breaks, and it fixes three problems from earlier months, including the October bug that stopped on-premises Exchange servers sending email. One group should wait: SQL Servers that use linked servers to reach Oracle, PostgreSQLThe KBY LexiconPostgreSQLPostgreSQL is an open-source relational database management system queried with SQL. Read Full Context and other external databases. Microsoft has confirmed a connection leak there and promised an out-of-band fix.

#Our verdicts

• Windows 11, versions 24H2, 25H2 and 26H2 (KB5132061) and 26H1 (KB5132059): Deploy now. No open known issue starts with this update. Check signed PowerShell scripts first if you enforce script signing (below), and expect some devices to need a retry to install.
• Windows 10, version 22H2 with ESU (KB5131096): Deploy now. Windows 10 22H2 is not on Microsoft’s list of versions affected by the SQL Server issue.
• Windows Server 2022 (KB5131090) and Windows Server 2025 (KB5131080): Deploy, but hold back SQL Servers that use linked servers until Microsoft ships its out-of-band fix. Exchange servers go first: this update fixes the October mail problem.

None of the Windows vulnerabilities fixed this month is known to be exploited; the one exploited flaw in November’s release is in Outlook and is fixed through Office updates, which should go out first. Our Patch Tuesday story has the full order. But the Windows updates carry Critical fixes for Active DirectoryThe KBY LexiconActive DirectoryActive Directory is Microsoft's directory service for identity, access and policy management. This entry defines its LDAP/Kerberos architecture, security boundary role and key distinctions from Microsoft Entra ID. Read Full Context , TCP/IPThe KBY LexiconTCP/IPTCP/IP is the layered protocol suite providing addressing, routing and reliable delivery for networked communication, including the internet. Read Full Context , the SMB server and Message Queuing, so we would not leave them waiting for long.

#The one open issue: SQL Server linked servers

Windows release health says that after Windows updates released on 13 October (KB5127648 for Windows 11) and later are installed on server devices, connections made by SQL Server linked server queries “might remain open after the queries complete”. Connections to external databases build up instead of closing, which can slow servers down over time. It affects linked servers that use OLE DB providers; Microsoft names Oracle and PostgreSQL connections among those affected.

• Who is affected: Microsoft lists Windows Server 2025, 2022, 2016, 2012 R2, 2012 and version 1809, and every Windows 11 version from 23H2 to 26H2, among others. Windows 10 22H2 is not on the list.
• How to tell: a rising number of open connections to the external database, even when no linked server queries are running.
• What Microsoft offers: a mitigation through Microsoft Support for business. Closing idle connections or restarting the SQL service relieves it for a while, but Microsoft warns that can interrupt active queries and the problem comes back.
• The fix: Microsoft says it will release an out-of-band update “in the next few days”. It had not appeared when we checked on Saturday morning.

Our view: the issue started with October’s update, and November’s still carries it. If a SQL Server with linked servers already has October’s update, November’s adds no new risk, so install it and keep watching connection counts. If it is still on September’s update, hold it until the fix arrives, but no later: it is missing two months of security fixes.

#What November fixes

• Exchange Server sign-in and mail flow. After October’s Windows Server updates, some on-premises Exchange servers could not sign users in to Outlook on the web, and mail sat in Outlook’s Outbox. Microsoft says the October update added a default limit on Endpoint Mapper memory that heavy workloads such as Exchange could hit. The November updates for Windows Server 2025 (KB5131080) and 2022 (KB5131090) resolve it, and the registry workaround is no longer needed once they are installed.
• USB audio. Some USB Audio Class 1.0 devices failed to start (Code 10) or produced no sound after September’s update. Resolved in KB5132061 and the matching updates for other versions.
• Remote Desktop error 0xC000000D for non-admin users connecting to devices with Administrator protection enabled: resolved for Windows 11 24H2 in KB5132061, and for 25H2 and 26H2 by the October preview update that November’s includes.

#Before you deploy: three things to check

1. Signed PowerShell scripts. Microsoft’s KB5132061 notes say Windows now checks a script’s encoding more strictly when signing and verifying it; IT-Connect reports that a script with invalid UTF-8 bytes that verified yesterday can fail today and not run under an AllSigned policy. Microsoft’s fix is to save affected scripts as UTF-8 with a byte order mark and sign them again. Scan your signed scripts before this reaches servers that run them.
2. Install failures on Windows 11. Windows Latest reported on 11 November that KB5132061 was failing for some users with errors 0x800f0993, 0x80070306 and 0x800f0989. Microsoft’s KB page now lists the failure for Windows 11 24H2 Enterprise and Education and says a repair is rolling out automatically through Windows Update, reaching affected devices within 24 to 48 hours from 11 November. Windows Latest reports the failures may be linked to Windows Sandbox. If you deploy through WSUS or Intune, watch for devices stuck retrying.
3. Activation scripts. Microsoft says some licensing and activation commands using slmgr can fail with error 0x80041008 after the November update; devices already activated stay activated. It released optional out-of-band updates on Friday 13 November, including KB5136489 (Server 2025), KB5136487 (Server 2022) and KB5136493 (Windows 10 22H2 ESU). Install them only where you hit the error or your build process runs slmgr.

#What this update does not fix

IT-Connect reports that a researcher published a working exploit on 10 November, called SignDrop, for a Windows privilege escalation flaw in the Common Log File System driver. According to IT-Connect, there is no CVE or patch yet and Microsoft has not confirmed it. It is not a reason to delay November’s update, which neither causes nor fixes it, and IT-Connect advises against turning off the CLFS protection involved.

Also note: IT-Connect reports that November’s update (KB5131087) is the last for Windows 11 23H2 Enterprise and Education. Devices still on 23H2 need moving.

#Known issues in the November cycle

From Windows release health, issues originating in or opened since Patch Tuesday (10 November), as of 14 November:

#How we track this

Each month we read every Windows release health status page (Windows 11 24H2 and later, Windows 10 22H2, Windows Server 2022 and 2025) and list the known issues in that month’s cycle: those caused by an update released on or after Patch Tuesday, and older ones that Microsoft only acknowledged since then. We check each against Microsoft’s KB articles and independent reports, then give our verdict. This is the first edition for November; we will update it on Tuesday 17 November and Tuesday 24 November with any new issues, fixes and changed verdicts.