Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5122880

KB5122880: Cumulative update for Windows 11, version 23H2, September 2026. An exploited Windows Update flaw gets an access fix

In short

An actively exploited Windows Update flaw could let attackers gain higher access. The update also addresses remote audio problems and adjusts Morocco's time zone.

Does it affect you? Applies to: Devices running Windows 11, version 23H2. Enterprise and Education editions reach the end of updates on November 10, 2026.

Build
22631.7582
Security
614 fixed · 53 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues The File History issue is described after installing KB5124008. Windows updates released on or after October 13, 2026, such as KB5126653, resolve it.

The official sources are linked at the end of the page.

What changes

Improvements 6 changes

Security updates

  • The Windows Update system gets protection against an actively exploited flaw that could let an attacker gain higher access.1
    Addresses CVE-2026-81963, the Windows Update Stack Elevation of Privilege Vulnerability.

Secure Boot

Gradual rollout Verified in package

For: eligible devices and non-managed business devices

  • More eligible devices can automatically receive new Secure Boot certificates. Delivery continues over the coming months.2
    Adds high-confidence device targeting data for automatic certificate delivery to supported PCs and non-managed business devices.

Date and Time

For: devices using Morocco Standard Time

  • Morocco's local time reflects its move to UTC+00:00, effective September 20, 2026.3
    Adjusts Morocco Standard Time for the transition to permanent UTC+00:00.

Cellular

For: devices using Telavox or Swisscom cellular profiles

  • Cellular settings get updated profiles for Telavox and Swisscom.4
    Updates COSA profiles for Telavox and Swisscom.

OMA DM

For: devices connecting to a server through OMA DM

  • More debug information is saved when a device connects to a server.5
    Improves logging in the Omadmclient component.

Servicing stack

  • The component that installs Windows updates gets reliability improvements.6
    Includes servicing stack update KB5122879, build 22621.7578.

Fix 1 change

Remote Desktop

Verified in package

For: devices using Remote Desktop audio redirection

  • The update addresses cases where audio from a remote session might not play on the local computer.7
    Addresses an issue affecting Remote Desktop audio redirection in certain configurations.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5132059

    USB audio devices might fail to start or produce no sound

    Some USB Audio Class 1.0 devices may show Code 10, produce no sound, or have unresponsive controls. The issue is only partly resolved: KB5129242 fixes the 8-channel and 3D audio symptoms, but other symptoms remain.8

    How to apply the workaround Workaround

    For symptoms not covered by the September 14 update, IT administrators can contact Microsoft Support for Business for assistance.8

  2. Resolved Affects: Everyone Resolved by KB5126653

    File History might stop working after installing September 2026 Windows update

    Some File History users could not create or update backups after the September security update. Windows updates released on or after October 13, 2026, such as KB5126653, resolve this issue.9

    Resolution Fixed in KB5126653

    Install KB5126653 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Open Affects: Everyone

    Host folder shares might be unavailable in Hyper-V-based Linux VMs

    After the update, some Linux virtual machines might not see or open folders shared from the Windows host. Regular Hyper-V virtual machines that do not use this folder-sharing feature are not affected.10

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  4. Resolved Affects: Organizations and IT administrators Resolved by KB5129242

    Remote Desktop Services might stop responding after September 2026 security update

    Some organizations had Remote Desktop Services problems after the September security update, including failed connections and sign-in issues. Windows updates released on or after September 14, 2026, such as KB5129242, resolve this issue.11

    Resolution Fixed in KB5129242

    Install KB5129242 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5120240, KB5099414, KB5093998, KB5087420
+55 earlier KB5082052, KB5078883, KB5075941, KB5078132, KB5077797, KB5073455, KB5071417, KB5070312, KB5068865, KB5067112, KB5066793, KB5065790, KB5065431, KB5064080, KB5066189, KB5063875, KB5062663, KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5129242
VersionBuildChannel
23H2 22631.7582 General availability

Security

614 vulnerabilities fixed
1 exploited 53 critical 561 important
VulnerabilitySeverityCVSS
CVE-2026-81963 Exploited
Windows Update Stack Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-69579
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69590
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69769
Windows HTTP Print Provider Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69829
Windows Shell Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70296
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72982
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72983
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73009
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-77493
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69499
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69518
Windows Remote Desktop Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69601
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69603
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69676
Windows Kerberos Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69740
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-69784
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-69860
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70203
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70586
Windows Paint Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72950
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72959
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72960
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72986
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73006
DirectWrite Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73013
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73018
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73023
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77495
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77504
Microsoft Office Word Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-80083
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-81955
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69820
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69846
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69874
Windows ALPC Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69906
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72961
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72962
Windows USB Video Driver Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-81354
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72981
IP Helper Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78449
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69725
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69799
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69864
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-83498
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69710
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-69789
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69852
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69890
Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-73017
Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-81355
Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69501
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-83501
Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability
 Critical 5.5
CVE-2026-72980
Windows Hello Security Feature Bypass Vulnerability
 Critical 4.4

The table lists the 54 exploited, publicly disclosed or critical vulnerabilities. See all 614 vulnerabilities →

Updated components

2,662 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio34
Networking34
Remote Desktop34
Graphics and display28
Printing22
Bluetooth18
Secure Boot18
Security and sign-in18
Storage and file systems16
Search12
File Explorer and shell9
Kernel9

Verified in package: changed files confirm Secure Boot, Remote Desktop.

Page history

  1. Added CVE-2026-88239 (Important)

    Added CVE-2026-95877 (Important)

    Added CVE-2026-96127 (Important)

  2. Added CVE-2026-69283 (Important)

    Added CVE-2026-70583 (Important)

    Added CVE-2026-71339 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (11)
  1. 1. This update provides security improvements. For more information about the security vulnerabilities resolved by this update, see the Security Update Guide. support.microsoft.com
  2. 2. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  3. 3. This update adjusts Morocco Standard Time to reflect Morocco's transition to permanent UTC+00:00 effective September 20, 2026. support.microsoft.com
  4. 4. Updating COSA profiles for Telavox and Swisscom. support.microsoft.com
  5. 5. This update improves the logging features of the Omadmclient component. More debug information is now saved when connecting to a server. support.microsoft.com
  6. 6. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  7. 7. This update addresses an issue that affects Remote Desktop audio redirection. Audio from the remote session might not play on the local computer in certain configurations. support.microsoft.com
  8. 8. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026, (KB5129242), and updates released after this date. learn.microsoft.com
  9. 9. This issue is resolved in Windows updates released on and after October 13, 2026 such as KB5126653. support.microsoft.com
  10. 10. Affected virtual machines start normally, but folders shared from the Windows host using Plan9 do not appear or cannot be accessed in the guest environment. support.microsoft.com
  11. 11. This issue is resolved in Windows updates released on and after September 14, 2026 such as KB5129242. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 11 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake