Microsoft's release notes also list a known issue with USB audio. Neowin's early report said there were no known issues. That is wrong for this release, and anyone who uses a USB DAC or headset should read the audio section below before installing.
Who gets KB5126657
Microsoft's support page lists three groups:
- Windows 10 ESU: version 22H2 PCs enrolled in Extended Security Updates
- Windows 10 Enterprise LTSC 2021
- Windows 10 IoT Enterprise LTSC 2021
BleepingComputer says that after installing this update, Windows 10 will be updated to build 19045.7807, and Windows 10 Enterprise LTSC 2021 will be updated to build 19044.7807.
Here's the background. On October 14, 2025, support for Windows 10 ended. Since then, Microsoft says, by enrolling in ESU, devices will receive monthly critical and important security updates, as defined by the Microsoft Security Response Center. Microsoft also says ESU is intended as a temporary solution and does not include new features, non-security updates, design change requests or technical support.
LTSC 2021 shops face a deadline too. Microsoft's KB page says free support for Windows 10 Enterprise LTSC 2021 ends January 12, 2027. That leaves three more Patch Tuesdays to finish migration planning.
Section summary: This update is for ESU-enrolled Windows 10 22H2 PCs and the two LTSC 2021 editions. An unenrolled consumer PC running 22H2 won't be offered it.
The security picture
KB5126657 is cumulative, so it carries this month's vulnerability fixes. BleepingComputer called it a record-breaking October 2026 Patch Tuesday, which fixed a massive 1,411 vulnerabilities across Microsoft's products, including one actively exploited zero-day flaw. That count covers Microsoft's whole product range, not just Windows 10. Microsoft's KB page does not list CVEs. It points to the Security Update Guide and the October 2026 security release for vulnerability details.
According to Microsoft, the package also includes everything from the September 8, 2026 update (KB5122878), the September 14, 2026 out-of-band update (KB5129236) and the ESU Licensing Preparation Package. If a device already has the earlier updates, it downloads only the new content.
What changed in this build
Time and date: Western Canada and Manitoba
Microsoft says the update turns on permanent Daylight Saving Time for British Columbia and Alberta starting in November 2026. It also adds a new time zone, Manitoba Standard Time "(UTC-5:00) Manitoba".
This matters more than it sounds. If a PC has stale time-zone data, calendar invites, scheduled tasks, log timestamps and shift systems can all end up an hour off. Organizations with users or servers in those provinces should get this update installed before the November clock change. Microsoft's note doesn't describe any extra configuration steps.
ReFS security on external storage
This is the change admins are most likely to notice. The update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. Microsoft's detailed guidance is in KB5130741.
In practice:
- Nothing is blocked yet. This release only adds auditing.
- Microsoft calls it preparation for future hardening. Changes like this often start as audit-only and move toward enforcement later. That's a general industry pattern; Microsoft hasn't published an enforcement date in this KB.
- Teams that use ReFS-formatted external drives for backup, imaging or data transfer should review the audit output now and read KB5130741. The KB5126657 page doesn't name the policy settings, so this article won't guess at them.
Storage Spaces Direct: disks that wouldn't come back
Microsoft fixed a problem where some Storage Spaces Direct virtual disks could stay offline after a Windows update. Microsoft says valid tiered-storage metadata was wrongly flagged as invalid during recovery. The affected virtual disks, and the workloads that depended on them, then couldn't come online. The release notes don't mention a separate workaround, so installing this update is the documented fix.
File History: the false "Reconnect your drive" message
This one is listed as a fixed known issue. File History could fail to back up or restore files on an external drive or network location. Affected devices might incorrectly display a "Reconnect your drive" message even when a compatible backup drive is connected and working properly.
If you hit this bug, File History may have stopped backing up without you noticing. Once the update is installed, open File History and check that the last backup time is recent. Don't assume older backups ran successfully.
Secure Boot certificates: rollout continues
This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. Deployment through Windows Update remains ongoing across supported device. Microsoft's support page says devices that haven't received the newer certificates yet can still start and get normal Windows updates. The original certificates began expiring in 2026.
The known issue: USB Audio Class 1.0
Microsoft says the update has a known issue affecting some USB Audio Class 1.0 devices after installing the September 2026 Windows security updates. The problem started with the September 8 update. KB5126657 didn't cause it, but it also doesn't fully fix it.
Symptoms reported by Microsoft:
- "This device cannot start (Code 10)" in Device Manager
- No audio output
- Volume controls that don't respond or stay at zero
- Sound settings that don't respond or aren't available
- Some devices may also work in standard stereo mode but fail when using 8-channel or 3D audio configurations.
Current status and workarounds, per Microsoft:
- The September 14 out-of-band update, KB5129236, fixed the 8-channel and 3D audio symptoms. It's rolled into KB5126657.
- If multichannel audio still fails, some customers got sound back by switching to 2-channel mode.
- Microsoft is still working on the other symptoms. IT admins who need a workaround now are told to contact Microsoft Support for Business.
If you rely on a USB Audio Class 1.0 DAC, mixer or headset, keep that in mind before installing. Skipping a security update isn't a good trade either, so the better approach is to install it and switch to stereo if you need to.
How to install it
Home and small-office PCs (ESU-enrolled): BleepingComputer notes that if you are running Windows 10 Enterprise LTSC or are enrolled in the ESU program, you can install this update like normal by going into Settings, clicking on Windows Update, and manually performing a 'Check for Updates.' Otherwise, it downloads and installs automatically. After the restart, run winver. You should see build 19045.7807 on 22H2 or 19044.7807 on 21H2 LTSC.
Managed environments: Microsoft lists Windows Update for Business, WSUS and the Microsoft Update Catalog. For WSUS sync, Microsoft specifies:
| Version | WSUS Product | Classification |
|---|---|---|
| Windows 10, version 22H2 | Windows 10, version 1903 and later | Security Updates |
| Windows 10, version 21H2 | Windows 10 LTSB | Security Updates |
Prerequisites:
- The package bundles servicing stack update KB5127308 (version 19041.7789). Microsoft says that without the latest SSU, the update may not be offered.
- Offline image servicing: If the image doesn't have the July 25, 2023 LCU (KB5028244) or later, install the standalone October 13, 2023 SSU (KB5031539) first.
- WSUS or standalone Catalog installs: If the device doesn't have the May 11, 2021 LCU (KB5003173) or later, install the standalone August 10, 2021 SSU (KB5005260) first.
- Dynamic Update to installation media: Include the boot.stl file. It must match the image's Windows version and architecture. If it's missing, devices may fail to boot from the media with error 0xc0430001. Microsoft recommends its Update WinPE script, or you can copy boot.stl from the device's
Windows\Boot\EFIfolder to the matching folder on the media.
Bottom line
KB5126657 has no new features, which is expected for ESU. It does have a lot of security fixes, time-zone updates that need to be in place before November, and a ReFS audit change that admins should look at now. The USB audio issue is still partly open, so check that before rolling it out. LTSC 2021 support ends in January, and ESU is temporary by design, so the move to Windows 11 is still the long-term plan.