Microsoft released the Windows licensing fix that Citrix MCS catalog updates were waiting for. Patch the master image, then verify rearm and KMS activation on newly created pilot machines before promoting the snapshot.
What changed on November 13, 2026
Microsoft released cumulative out-of-band updates for error 0x80041008 on Windows Server 2019, 2022 and 2025. They include the November 10 security fixes and are available from the Microsoft Update Catalog. Use the package for the image’s OS and architecture and check the linked servicing prerequisites.
What changed November 12. Citrix published CTX697347 and CTX697342 for a Windows licensing regression after the November 10 security update. It affects Citrix DaaS and on-premises Citrix Virtual Apps and Desktops catalogs that use Machine Creation Services (MCS) with Windows rearm enabled. Image preparation can fail with 0x80041008 or finish with ImagePreparationOSRearmFailed. Clones made from an image that failed to rearm can share a KMS client ID and fail to meet the activation threshold. Already activated machines retain their activation.
| Windows Server | November build with MCS issue | November 13 licensing fix | Original October CVE fix |
|---|---|---|---|
| 2019 | KB5131085 / 17763.9487 | KB5136490 / 17763.9488 | KB5126651 / 17763.9376 |
| 2022 | KB5131090 / 20348.5870 | KB5136487 / 20348.5873 | KB5126655 / 20348.5761 |
| 2025 | KB5131080 / 26100.33822 | KB5136489 / 26100.33828 | KB5126646 / 26100.33650 |
Citrix ties the regression to a Windows change for CVE-2026-96300, an RPC Endpoint Mapper denial-of-service vulnerability originally published October 13. MSRC rates it Important, CVSS 3.1 5.9, with exploitation assessed as less likely and no known exploitation or public disclosure recorded. CISA KEV has no entry for it. The CTX697342 headline lists KB5130090. Its body, CTX697347 and Microsoft’s release notes identify KB5131090 for Windows Server 2022. The October builds above are MSRC’s original fixes for the CVE. They predate the November MCS regression and do not include the November security fixes.
What to do
Suggested MSP priority. Check affected image pipelines before the next catalog push. Prioritize catalogs with a blocked image rollout or new machines that still need KMS configuration. Apply the matching out-of-band package, then confirm rearm and activation in a pilot catalog.
- Inventory customer MCS catalogs with rearm enabled. Match the master image KB and build, then review the image preparation result and KMS activation in a pilot catalog.
- If rearm failed, pause promotion of that snapshot until a patched pilot passes. Review any clones built from it for shared KMS client IDs or activation failures. Track any images still on the temporary pre-November snapshot.
- Apply the matching November 13 fix to the master image, restart as required, shut it down, take a new snapshot and rerun the catalog update. Verify that image preparation finishes without the rearm warning and that pilot clones activate before wider rollout.
Windows client applicability. Microsoft also documents this licensing failure on eligible Windows 10 1809/LTSC 2019 builds covered by KB5136490, Windows 10 22H2 and LTSC 2021/21H2 on KB5136493 (19045.7850 and 19044.7850) and Windows 11 23H2 on KB5136483 (22631.7714). Verify the client’s edition, support eligibility and need for licensing commands before rollout.
Official sources. Citrix CTX697347, Citrix CTX697342, Microsoft CVE-2026-96300, MSRC October CVRF and CISA KEV catalog. Last verified November 13, 2026 UTC.