Microsoft has confirmed that some Windows 11 devices cannot install the November 2026 security updates. The installation locks midway and then fails with 0x80070306, 0x800f0989 or 0x800f0993, and affected machines keep retrying the same failing update.
What happened
The fault is limited to devices that installed the October 2026 non-security preview update, KB5127936. Microsoft's service note says those devices may be unable to complete the November cumulative update, including KB5132061 for Windows 11, while devices without that preview update are unaffected.
Microsoft says it is repairing affected devices automatically over 24 to 48 hours from 11 November 2026, 10:00 PT. Once the repair lands, the device pulls and installs the November updates through Windows Update with no administrator action.
It is the third patch-deployment problem Microsoft has had to fix this year, after KB5079391 in March and the May 2026 update KB5089549. This one matters more than the previous two because the blocked release carries fixes for flaws already under attack, including the Outlook spoofing flaw CVE-2026-124194 and the Windows Search remote code execution flaw CVE-2026-116928.
Who is affected
Windows 11 fleets where the October preview update was approved, which in most companies means machines that sit on a pilot or early ring.
- Windows 11 devices that installed KB5127936 and are now stuck retrying the November cumulative update.
- Environments that auto-approve preview updates, where a test ring quietly becomes the production fleet.
- Any business that still needs the November fixes for CVE-2026-124194, which is exploited in the wild.
What to do now
Let the automatic repair arrive, then confirm the November cumulative update is actually installed rather than trusting the update policy report.
- Check the OS build and update history on a sample of endpoints; a device still retrying has no November fixes on it.
- Do not re-image machines or reset Windows Update components before 13 November, because the repair is already being pushed.
- Where the update still fails after 48 hours, open a case with Microsoft Support instead of looping manual retries.
- Stop auto-approving monthly preview updates on anything that is not an isolated test ring.
What this means for South African businesses
The real exposure is a fleet that looks compliant in the management console while the November fixes never applied, in the same month that an Outlook flaw is being used to capture NTLM hashes. Verify build numbers, not policy status. My judgement is that most local environments will not check, because the failure presents as a generic update error that users and technicians both dismiss as noise.
Source
Source: BleepingComputer, Microsoft confirms Windows security updates installation issues.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.