Skip to the content
The Update Bureau
Windows 10 1809 Windows 10 1809 Security update
Patch Tuesday Zero-day Known issues

KB5122876

KB5122876: Cumulative update for Windows 10, version 1809, September 2026. Exploited ALPC flaw patched; remote-session audio addressed

In short

Attackers are exploiting a Windows ALPC flaw to gain higher access. Remote-session audio also gets a fix, though some USB audio problems remain.

Does it affect you? Applies to: This update applies to Windows 10 Enterprise LTSC 2019, version 1809.

Build
17763.9245
Security
622 fixed · 55 critical · 1 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 4 changes

Secure Boot

Verified in package

For: Supported PCs and non-managed business devices

  • More eligible PCs can automatically receive new Secure Boot certificates.1
    Includes additional high confidence device targeting data. Certificate deployment continues across supported PCs and non-managed business devices in the coming months.

Date and Time

For: Devices using Morocco Standard Time

  • Morocco's local time will display correctly after the September 20, 2026, time change.2
    Adjusts Morocco Standard Time to permanent UTC+00:00, effective September 20, 2026.

Windows Code Integrity policies

  • Apps work more smoothly during Windows certificate-authority changes.3
    Recognizes Microsoft Windows Production PCA 2026 RSA2048-SHA256 as equivalent to PCA 2011 during certificate-authority rotation.

Servicing stack update

For: Devices hosted on Azure

  • Azure-hosted devices get improved checks during the update process.4
    The included SSU, KB5122875, improves Azure hosting verification logic and uses an updated certificate chain for validation.

Fix 1 change

Remote Desktop

Verified in package
  • Audio from some remote sessions can play on the local computer again.5
    Addresses an issue that could stop Remote Desktop audio redirection in certain configurations.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5131085

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might show Code 10, produce no sound, or have unresponsive volume and sound settings. The September 14 update fixes symptoms in 8-channel or 3D audio modes, but other symptoms remain.6

    How to apply the workaround Workaround

    For 8-channel or 3D audio problems, some customers report that switching to 2-channel mode restores sound. For other symptoms not fixed by the September 14 update, IT administrators can contact Microsoft Support for Business.6

  2. Resolved Affects: Everyone Resolved by KB5126651

    File History might stop working after installing September 2026 Windows update

    Some File History users might be unable to create or update backups. KB5126651 resolves this issue.7

    Resolution Fixed in KB5126651

    Install KB5126651 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Organizations and IT administrators Resolved by KB5129238

    Remote Desktop Services might stop responding after September 2026 security update

    Some organizations might see Remote Desktop connections fail, sign-in problems, or servers hang. KB5129238 resolves this issue.8

    Resolution Fixed in KB5129238

    Install KB5129238 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5120238, KB5099538, KB5094123, KB5087538
+22 earlier KB5091573, KB5082123, KB5078752, KB5075904, KB5078131, KB5077795, KB5073723, KB5074975, KB5071544, KB5068791, KB5066586, KB5065428, KB5066187, KB5063877, KB5062557, KB5060531, KB5061978, KB5058392, KB5059091, KB5058922, KB5050008, KB5037425
Replaced by
KB5129238
VersionBuildChannel
1809 17763.9245 General availability

Security

622 vulnerabilities fixed
1 exploited 55 critical 567 important
VulnerabilitySeverityCVSS
CVE-2026-85880 Exploited
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-69579
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69590
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69730
Windows DNS Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69769
Windows HTTP Print Provider Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69829
Windows Shell Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69845
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70296
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72979
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72982
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72983
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73009
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73010
Microsoft Failover Cluster Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-77493
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69499
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69518
Windows Remote Desktop Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69601
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69603
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69676
Windows Kerberos Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69860
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70203
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70586
Windows Paint Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72950
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72959
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72960
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72986
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73006
DirectWrite Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73013
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73018
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73023
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77495
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77504
Microsoft Office Word Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-81955
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69846
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69874
Windows ALPC Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69906
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72961
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72962
Windows USB Video Driver Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-81354
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69530
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69813
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69827
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72981
IP Helper Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72987
Windows DNS Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-77505
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78444
Microsoft Failover Cluster Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78449
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78450
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72957
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-69789
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69852
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69890
Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-72954
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-73017
Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-81355
Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-72980
Windows Hello Security Feature Bypass Vulnerability
 Critical 4.4

The table lists the 56 exploited, publicly disclosed or critical vulnerabilities. See all 622 vulnerabilities →

Updated components

2,784 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio37
Networking32
Remote Desktop28
Graphics and display24
Security and sign-in23
Storage and file systems22
Secure Boot21
Printing20
Bluetooth12
Hyper-V and virtualization10
Search8
Kernel7

Verified in package: changed files confirm Secure Boot, Remote Desktop.

Page history

  1. Added CVE-2026-88239 (Important)

    Added CVE-2026-95877 (Important)

    Added CVE-2026-96127 (Important)

  2. Added CVE-2026-69283 (Important)

    Added CVE-2026-70583 (Important)

    Added CVE-2026-71339 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. This update adjusts Morocco Standard Time to reflect Morocco's transition to permanent UTC+00:00 effective September 20, 2026. support.microsoft.com
  3. 3. Improves application compatibility during Windows certificate-authority rotation by recognizing Microsoft Windows Production PCA 2026 RSA2048-SHA256 as equivalent to PCA 2011. support.microsoft.com
  4. 4. This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. support.microsoft.com
  5. 5. This update addresses an issue that affects Remote Desktop audio redirection. Audio from the remote session might not play on the local computer in certain configurations. support.microsoft.com
  6. 6. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026, (KB5129238), and updates released after this date. learn.microsoft.com
  7. 7. This issue is resolved in Windows updates released on and after October 13, 2026 such as KB5126651. support.microsoft.com
  8. 8. This issue is resolved in Windows updates released on and after September 14, 2026 such as KB5129238. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake