Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday Zero-day

KB5122878

KB5122878: Cumulative update for Windows 10, versions 21H2 and 22H2, September 2026. Windows ALPC flaw under attack; remote audio issue addressed

In short

An actively exploited Windows ALPC flaw is among the security fixes. The update also addresses Remote Desktop audio and a BitLocker recovery-key issue.

Does it affect you? Applies to: Windows 10 version 22H2 devices enrolled in ESU, and Windows 10 version 21H2 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 devices.

Builds
19044.7725 · 19045.7725
Security
578 fixed · 49 critical · 1 exploited
Restart
Required

What changes

Improvements 4 changes

Secure Boot

Gradual rollout Verified in package

For: supported PCs and non-managed business devices

  • More eligible PCs can receive new Secure Boot certificates automatically. Certificate deployment continues over the coming months.1
    Adds high-confidence device-targeting data to increase coverage of devices eligible to automatically receive new Secure Boot certificates.

Date and Time

For: devices using Morocco Standard Time

  • The local time in Morocco reflects the change to permanent UTC+00:00 on September 20, 2026.2
    Adjusts Morocco Standard Time for the transition to permanent UTC+00:00.

OMA DM protocol

For: devices connecting to an OMA DM server

  • More debug details are saved when a device connects to a server.3
    Improves logging in the OMA DM Client (omadmclient.exe) component.

Windows Code Integrity policies

  • Apps are more compatible during Windows certificate changes.4
    Recognizes Microsoft Windows Production PCA 2026 RSA2048-SHA256 as equivalent to PCA 2011 during certificate-authority rotation.

Fixes 2 changes

Remote Desktop

Verified in package

For: devices using Remote Desktop audio redirection

  • Remote session audio might play on the local computer again in some configurations.5
    Addresses an issue affecting Remote Desktop audio redirection; audio might not play on the local computer in certain configurations.

BitLocker Group Policy

  • Some devices with a BitLocker policy issue might no longer ask for a recovery key.6
    Addresses the known issue where devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key.

Known issues

  1. Mitigated Affects: Everyone

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might fail to start or produce sound. KB5129236 resolves the symptoms with 8-channel or 3D audio, but other symptoms remain.7

    How to apply the workaround Workaround

    Some customers report restoring audio by switching to 2-channel mode. IT administrators can contact Microsoft Support for Business about symptoms not covered by the update.7

  2. Resolved Affects: Everyone Resolved by KB5126657

    File History might stop working after installing September 2026 Windows update

    Some File History users might be unable to create or update backups, and might see a false drive-reconnect message. KB5126657 and later updates resolve this issue.8

    Resolution Fixed in KB5126657

    Install KB5126657 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Organizations and IT administrators Resolved by KB5129236

    Remote Desktop Services might stop responding after September 2026 security update

    Some organizations might see Remote Desktop connections fail, sign-in problems, or servers hang after the September update. KB5129236 and later updates resolve this issue.9

    Resolution Fixed in KB5129236

    Install KB5129236 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5120249, KB5099539, KB5094127, KB5087544
+38 earlier KB5082200, KB5078885, KB5075912, KB5078129, KB5077796, KB5073724, KB5074976, KB5071546, KB5068781, KB5066791, KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by
KB5129236
VersionBuildChannel
21H2 19044.7725 General availability
22H2 19045.7725 General availability

Security

578 vulnerabilities fixed
1 exploited 49 critical 529 important
VulnerabilitySeverityCVSS
CVE-2026-85880 Exploited
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-69579
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69590
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69769
Windows HTTP Print Provider Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69829
Windows Shell Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70296
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72982
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72983
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73009
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-77493
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69499
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69518
Windows Remote Desktop Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69601
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69603
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69676
Windows Kerberos Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69784
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-69860
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70203
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70586
Windows Paint Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72950
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72959
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72960
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72986
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73006
DirectWrite Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73013
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73018
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73023
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77495
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77504
Microsoft Office Word Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-81955
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69820
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69846
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69874
Windows ALPC Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69906
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72961
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72962
Windows USB Video Driver Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-81354
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72981
IP Helper Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78449
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69725
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69799
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69864
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69710
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-69789
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69852
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69890
Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-73017
Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-81355
Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69501
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-72980
Windows Hello Security Feature Bypass Vulnerability
 Critical 4.4

The table lists the 50 exploited, publicly disclosed or critical vulnerabilities. See all 578 vulnerabilities →

Updated components

3,674 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio50
Bluetooth47
Graphics and display46
Networking46
Remote Desktop45
Printing33
Secure Boot30
Security and sign-in26
Storage and file systems19
Search17
Kernel16
Hyper-V and virtualization14

Verified in package: changed files confirm Secure Boot, Remote Desktop.

Page history

  1. Added CVE-2026-88239 (Important)

    Added CVE-2026-95877 (Important)

    Added CVE-2026-96127 (Important)

  2. Added CVE-2026-69283 (Important)

    Added CVE-2026-70583 (Important)

    Added CVE-2026-71339 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (9)
  1. 1. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. This update adjusts Morocco Standard Time to reflect Morocco's transition to permanent UTC+00:00 effective September 20, 2026. support.microsoft.com
  3. 3. This update improves the logging features of the OMA DM Client (omadmclient.exe) component. More debug information is now saved when connecting to a server. support.microsoft.com
  4. 4. Improves application compatibility during Windows certificate-authority rotation by recognizing Microsoft Windows Production PCA 2026 RSA2048-SHA256 as equivalent to PCA 2011. support.microsoft.com
  5. 5. This update addresses an issue that affects Remote Desktop audio redirection. Audio from the remote session might not play on the local computer in certain configurations. support.microsoft.com
  6. 6. This update addresses the "Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key" known issue. support.microsoft.com
  7. 7. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026, (KB5129236), and updates released after this date. learn.microsoft.com
  8. 8. This issue is resolved in Windows updates released on and after October 13, 2026 such as KB5126657. support.microsoft.com
  9. 9. This issue is resolved in Windows updates released on and after September 14, 2026 such as KB5129236. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake