Microsoft releases KB5132061 and KB5131087 for Windows 11 versions 23H2 to 26H2

On Nov. 10, 2026, Microsoft issued KB5132061 and KB5131087 as the cumulative updates for this month’s Patch Tuesday on Windows 11 versions 23H2, 24H2, 25H2 and 26H2.

Microsoft calls the updates mandatory because they bundle the November 2026 Patch Tuesday security fixes for hundreds of vulnerabilities found in earlier months. The cycle marks the eleventh Patch Tuesday update of 2026.

Microsoft said it was not aware of new problems with this month’s Patch Tuesday release. The update also fixed a long-standing issue that blocked USB audio on some computers.

Administrators can install the updates through Start, Settings and Windows Update by clicking Check for Updates, or download them manually from the Microsoft Update Catalog. The package builds on Windows 11 version 24H2, so versions 25H2 and 26H2 receive the same update with no exclusive changes.

Users saw installation failures for KB5132061 with error codes 0x800f0993 and 0x800f0989 after the release. Microsoft had not logged any anomaly on the official known issues list for the update when reporting occurred.

Past Windows 11 updates failed with error 0x800f0845, and the October update caused installation problems on some machines. Administrators can try DISM.exe, the Windows image repair tool, and sfc /scannow, the system file checker, run the Windows Update troubleshooter, or wait if a Microsoft server bug caused the failure. KB5131096 for Windows 10 also ships in the November 2026 cycle.

File Explorer’s context menu now opens faster with less clutter, and users can toggle built-in commands, add commands, pick app extensions, or show file commands directly in the menu. The updated AutoPlay dialog supports dark mode, adjusts to text scaling and display settings, and sends notifications to notification center.

In File Explorer, search results display name, location and date in a uniform layout, the address bar accepts the tilde symbol for user profile navigation, and Folder Options works with dark mode. The main Settings Privacy and security page groups Camera, Microphone and Location controls, and it shows usage details from linked pages on that page.

Gaming Task View in Xbox mode received a refreshed navigation bar with quick access to Exit to Desktop and Power Options. The Device Info card, introduced in preview update KB5079391 in March 2026, is expanding to more markets for users signed in with a Microsoft account. In the Start menu’s Recent section, Phone Link users can hover over a recent message or notification to preview its content.

Taskbar animations for app window previews improved, and taskbar settings now persist across multiple monitor connections and disconnections. Magnifier includes a contrast theme toggle using a dark contrast theme by default, per-monitor zoom turned on by default, and viewport locking switched with Ctrl + Windows key + K. Live Captions added an Include screen reader audio setting that is off by default.

Narrator can read and navigate math equations in supported Microsoft 365 apps such as Word and PowerPoint, and on supported web content with Microsoft Edge version 153.0.4234.32 or newer or Google Chrome version 153.0.8010.18 or newer. Narrator math reading works in English United States, English United Kingdom, Traditional Chinese, Finnish, German and Spanish.

Family Safety messaging improved for cases where age-restricted parental controls block applications. During cloud rebuild or quick machine recovery, Windows Recovery Environment can automatically reuse eligible stored Wi-Fi profiles, including networks that use certificates. The feature is on by default, and IT administrators can turn it off.

Cloud rebuild reinstalls Windows 11 using a Windows image and device drivers pulled through Windows Update, with no USB flash drive or custom image required, and adds drive sanitization plus remote management through the Recovery CSP (the configuration service provider for remote recovery management).

After Windows restores a backup profile to a new device, a Restore Summary appears showing what was successfully restored, including Windows settings and Microsoft Store apps. The adaptive hibernate policy hibernates less when battery is above 80 percent and hibernates sooner when battery is below 10 percent. Memory integrity protection, also called HVCI, expands across eligible devices and may turn on during updates while honoring existing user or administrator choices.

Windows added IPv6 CLAT support on Wi-Fi and Ethernet interfaces with client-side 464XLAT translation, allowing IPv4-only applications to reach IPv4 services from IPv6-only networks. Routers advertise PREF64 by default, with DNS ipv4only.arpa as a fallback for prefix discovery. CLAT works with SLAAC-based IPv6 addressing but not with DHCPv6 Prefix Delegation or Windows Subsystem for Linux.

The Data Protection API displays a warning before protect and unprotect operations that use prompts, and says the prompt-based experience will be retired in April 2027. Windows Spotlight received underlying platform changes to improve reliability on the lock screen. Windows added text shaping support for Unicode 17.0, which introduced 4,803 characters and four newly encoded scripts: Beria Erfe, Sidetic, Tai Yo and Tolong Siki.

Microsoft changed the name of Windows Backup for Organizations to Windows settings backup and restore, calling it an evolution into a baseline resilience capability across Windows. Starting with Windows 11 version 26H2, Windows settings backup turns on by default for eligible devices.

Once the transition period ended in June 2026, administrators manage Enterprise State Roaming using Windows settings backup and restore policies, while supported settings stay the same and licensing requirements continue to apply. Enterprise State Roaming keeps eligible Windows settings consistent across devices tied to a user’s Microsoft Entra ID account, and the feature stores supported Windows settings along with the Microsoft Store apps installed on the device. IT teams can keep existing policy settings, Cloud Solution Providers and Group Policy paths because renaming the feature does not require policy migration or reconfiguration.

Windows continues to honor policies that explicitly turn backup on or off; organizations can turn backup off by policy, and administrators must configure restore separately. Microsoft added first sign-in restore soon after launch to extend support to additional device types and hybrid-managed environments. The restore summary displays restored personalization settings and the Microsoft Store app list, opens in a browser with an export option, and is available starting with Windows 11 version 24H2. After device setup finishes, a restore summary remains accessible for seven days, appearing about one hour after the restore succeeds.

Microsoft offers the WindowsBackupAdmin PowerShell module for managing backup profiles. The scripts rely on Microsoft Graph beta APIs, and Microsoft distributes them through the PowerShell Gallery and GitHub; the module gives access to profile information only. Microsoft deployed backup policies across its own organization. Brian Fielder said the change will “free IT teams from the heavy lifting of device reimaging.”