Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday Zero-day

KB5122871

KB5122871: Cumulative update for Windows Server, version 2025, September 2026. Windows Update Stack flaw under active attack

In short

An actively exploited Windows Update Stack flaw is among the security fixes. The update also improves networking, Remote Desktop audio, and Sysmon.

Does it affect you? Applies to: This update applies to devices running Windows Server 2025.

Build
26100.33438
Security
690 fixed · 64 critical · 1 exploited
Restart
Required

What changes

Improvements 9 changes

Certificates

  • Applications are more likely to keep working as Windows moves to newer signing certificates.1
    Improves application compatibility during Windows certificate-authority updates.

Date and Time

For: devices using Morocco Standard Time

  • Morocco’s local time reflects its move to permanent UTC+00:00 on September 20, 2026.2
    Adjusts Morocco Standard Time for the transition to permanent UTC+00:00.

Networking

Verified in package

For: Windows Server systems

  • Network connections respond faster when a network adapter disconnects, helping network storage and file access keep working.3

Remote Desktop

Verified in package

For: devices using Remote Desktop

  • Audio from a remote session plays more reliably on the local device.4
    Improves Remote Desktop audio redirection.

Sysmon

Verified in package 4 items
  • Sysmon is less likely to report normal Windows activity as tampering.5
    Prevents false Event ID 25 alerts for normal Windows Session Manager (smss.exe) activity.
  • File monitoring is more reliable when archive folders are unavailable, helping prevent unexpected system crashes.6
    Improves Sysmon reliability during file monitoring when archive directories are unavailable.
  • Sysmon checks executable files more reliably when looking for tampering.7
    Improves the reliability and consistency of executable file validation for Sysmon tampering detection.
  • Sysmon can complete monitored file operations more reliably when archive folders cannot be accessed.8
    Improves Sysmon file archiving reliability when archive directories cannot be accessed.

Servicing stack

For: Windows Server 2025 devices

  • The component that installs Windows updates gets reliability improvements.9
    The update includes servicing stack update KB5122870, build 26100.33434.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not show synchronization error details after KB5070881 or later updates. The error-reporting feature is temporarily removed to address CVE-2025-59287.10

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Mitigated Affects: Everyone

    USB Audio Class 1.0 devices with error Code 10 or no output

    After KB5122871, some USB Audio Class 1.0 devices might show Code 10, produce no sound, or have unresponsive controls. KB5129235 resolves the symptoms tied to 8-channel or 3D audio modes, but other symptoms remain.11

    How to apply the workaround Workaround

    Some customers reported restoring audio by switching to 2-channel mode for multichannel symptoms. For symptoms not addressed by the update, IT administrators can contact Microsoft Support for Business.11

  3. Resolved Affects: Organizations and IT administrators Resolved by KB5129235

    Remote Desktop Services might stop responding after September 2026 security update

    Some organizations might have had Remote Desktop Services issues after the September 2026 security update. KB5129235 resolves the issue.12

    Resolution Fixed in KB5129235

    Install KB5129235 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5120233, KB5099536, KB5094125, KB5087539
+28 earlier KB5091157, KB5082063, KB5078740, KB5075899, KB5078135, KB5077793, KB5073379, KB5072033, KB5072359, KB5068861, KB5070881, KB5070773, KB5066835, KB5068221, KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5044284, KB5043080
Replaced by
KB5129235
VersionBuildChannel
2025 26100.33438 General availability

Security

690 vulnerabilities fixed
1 exploited 64 critical 626 important
VulnerabilitySeverityCVSS
CVE-2026-81963 Exploited
Windows Update Stack Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-69579
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69590
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69595
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69730
Windows DNS Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69769
Windows HTTP Print Provider Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69829
Windows Shell Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69845
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70296
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72979
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72982
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72983
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73009
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73010
Microsoft Failover Cluster Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-77493
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-78445
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69499
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69518
Windows Remote Desktop Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69601
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69603
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69676
Windows Kerberos Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69712
Windows Key Distribution Center Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69860
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70203
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70586
Windows Paint Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72950
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72959
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72960
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72986
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73006
DirectWrite Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73013
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73018
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73023
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77495
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77504
Microsoft Office Word Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-80083
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-81955
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69846
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69874
Windows ALPC Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69906
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72958
Windows Credential Guard Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72961
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72962
Windows USB Video Driver Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69530
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69813
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69827
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69858
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72981
IP Helper Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72987
Windows DNS Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-77505
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78444
Microsoft Failover Cluster Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78449
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78450
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72957
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-83498
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69789
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69852
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69890
Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-72954
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-73017
Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-81355
Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69501
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-70585
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 7.0
CVE-2026-83501
Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability
 Critical 5.5
CVE-2026-72980
Windows Hello Security Feature Bypass Vulnerability
 Critical 4.4

The table lists the 65 exploited, publicly disclosed or critical vulnerabilities. See all 690 vulnerabilities →

Updated components

5,319 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings109
Graphics and display47
Networking46
Audio41
Security and sign-in40
Printing39
Remote Desktop36
Bluetooth33
Hyper-V and virtualization26
File Explorer and shell22
Storage and file systems20
Secure Boot19

Verified in package: changed files confirm Networking, Remote Desktop, Sysmon.

Page history

  1. Added CVE-2026-88239 (Important)

    Added CVE-2026-95877 (Important)

    Added CVE-2026-96127 (Important)

  2. Added CVE-2026-69283 (Important)

    Added CVE-2026-70583 (Important)

    Added CVE-2026-71339 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (12)
  1. 1. This update improves application compatibility during Windows certificate-authority updates, helping applications continue to work as expected as Microsoft transitions to newer signing certificates support.microsoft.com
  2. 2. This update adjusts Morocco Standard Time to reflect Morocco's transition to permanent UTC+00:00 effective September 20, 2026. support.microsoft.com
  3. 3. This update improves network failover on Windows Server systems by helping connections respond more quickly when a network adapter is disconnected. This helps network storage and file access continue to work as expected. support.microsoft.com
  4. 4. This update improves Remote Desktop audio redirection, helping audio from remote sessions play correctly on the local device. support.microsoft.com
  5. 5. This update improves Sysmon's Process Tampering detection by preventing false Event ID 25 alerts for normal Windows Session Manager (smss.exe) activity. support.microsoft.com
  6. 6. This update improves Sysmon reliability during file monitoring, helping prevent unexpected system crashes when archive directories are unavailable. support.microsoft.com
  7. 7. This update improves Sysmon tampering detection by making executable file validation more reliable and consistent. support.microsoft.com
  8. 8. This update improves Sysmon file archiving reliability, helping monitored file operations complete as expected even when archive directories cannot be accessed. support.microsoft.com
  9. 9. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  10. 10. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
  11. 11. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026, (KB5129235), and updates released after this date. learn.microsoft.com
  12. 12. This issue is resolved in Windows updates released on and after September 14, 2026 such as KB5129235. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 12 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake