Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5122882

KB5122882: Cumulative update for Windows Server, version 2022, September 2026. Exploited ALPC flaw patched; Hyper-V restart issue fixed

In short

Patches an actively exploited flaw in Windows ALPC and fixes a Hyper-V issue that could unexpectedly restart some virtual machines.

Does it affect you? Applies to: Devices running Windows Server 2022 on x64. The update package is for this version.

Build
20348.5622
Security
651 fixed · 61 critical · 1 exploited
Restart
Required

What changes

Improvements 5 changes

Certificates

For: Devices during certificate-authority updates

  • Applications are more likely to keep working during certificate updates.1
    Improves application compatibility during Windows certificate-authority updates as Microsoft moves to newer signing certificates.

Date and Time

For: Systems using Morocco Standard Time

  • Morocco's local time stays correct after its time change on September 20, 2026.2
    Adjusts Morocco Standard Time for the transition to permanent UTC+00:00 effective September 20, 2026.

Networking

Verified in package

For: Windows Server systems

  • Network connections respond faster when an adapter disconnects, helping storage and file access keep working.3
    Improves network failover on Windows Server systems when a network adapter is disconnected.

Remote desktop

Verified in package

For: Remote Desktop users

  • Audio from remote sessions plays more reliably on the local device.4
    Improves Remote Desktop audio redirection.

Servicing stack

  • The component that installs Windows updates gets quality improvements.5
    The update includes servicing stack update KB5122881, build 20348.5614.

Fix 1 change

Hyper-V

For: Some Windows Server 2022 virtual machines

  • A limited number of virtual machines no longer risk an unexpected restart from stop error 0x139.6
    Addresses an issue that might cause a limited number of Windows Server 2022 virtual machines to intermittently encounter stop error 0x139.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not show synchronization error details after KB5070884 or later updates. Microsoft temporarily removed this function to address CVE-2025-59287.7

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Resolved Affects: Everyone Resolved by KB5129237

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might show Code 10, have no sound, or lose multichannel audio. KB5129237 resolves the 8-channel or 3D audio symptoms; KB5126655 resolves the remaining symptoms.8

    Resolution Fixed in KB5129237

    Install KB5129237 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Organizations and IT administrators Resolved by KB5129237

    Remote Desktop Services might stop responding after September 2026 security update

    Some organizations might see Remote Desktop connections fail, sign-in problems, or servers hang after the September security update. KB5129237 resolves this issue; Windows 365 and Azure Virtual Desktop are not affected.9

    Resolution Fixed in KB5129237

    Install KB5129237 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5120242, KB5099540, KB5094128, KB5087545
+40 earlier KB5091575, KB5082142, KB5078766, KB5082314, KB5075906, KB5078136, KB5077800, KB5073457, KB5071547, KB5068787, KB5070884, KB5066782, KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5129237
VersionBuildChannel
2022 20348.5622 General availability

Security

651 vulnerabilities fixed
1 exploited 61 critical 590 important
VulnerabilitySeverityCVSS
CVE-2026-85880 Exploited
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-69579
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69590
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69595
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69730
Windows DNS Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69769
Windows HTTP Print Provider Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69829
Windows Shell Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69845
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70296
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72979
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72982
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72983
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73009
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73010
Microsoft Failover Cluster Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-77493
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-78445
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69499
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69518
Windows Remote Desktop Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69601
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69603
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69676
Windows Kerberos Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69712
Windows Key Distribution Center Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69860
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70203
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70586
Windows Paint Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72950
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72959
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72960
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72986
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73006
DirectWrite Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73013
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73018
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73023
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77495
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77504
Microsoft Office Word Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-80083
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-81955
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69846
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69874
Windows ALPC Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69906
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72961
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72962
Windows USB Video Driver Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69530
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69813
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69827
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69858
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72981
IP Helper Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72987
Windows DNS Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-77505
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78444
Microsoft Failover Cluster Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78449
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78450
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72957
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-69789
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69852
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69890
Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-72954
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-73017
Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-81355
Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69501
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-70585
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 7.0
CVE-2026-72980
Windows Hello Security Feature Bypass Vulnerability
 Critical 4.4

The table lists the 62 exploited, publicly disclosed or critical vulnerabilities. See all 651 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
562.6 MB
windows10.0-kb5122882-x64.msu Main update · KB5122882 SHA-1: 4432fee3…0a4b5e

Updated components

1,258 files changed since the previous update for the same versions.

Top changed componentsFiles
Remote Desktop18
Audio17
Networking17
Secure Boot11
Graphics and display10
Printing10
Security and sign-in10
Storage and file systems7
Bluetooth6
Hyper-V and virtualization6
Kernel5
Search5

Verified in package: changed files confirm Networking, Remote desktop.

Page history

  1. Added CVE-2026-88239 (Important)

    Added CVE-2026-95877 (Important)

    Added CVE-2026-96127 (Important)

  2. Added CVE-2026-69283 (Important)

    Added CVE-2026-70583 (Important)

    Added CVE-2026-71339 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (9)
  1. 1. [Certificates] This update improves application compatibility during Windows certificate-authority updates, helping applications continue to work as expected as Microsoft transitions to newer signing certificates. support.microsoft.com
  2. 2. [Date and Time] This update adjusts Morocco Standard Time to reflect Morocco's transition to permanent UTC+00:00 effective September 20, 2026. support.microsoft.com
  3. 3. [Networking] This update improves network failover on Windows Server systems by helping connections respond more quickly when a network adapter is disconnected. support.microsoft.com
  4. 4. [Remote desktop] This update improves Remote Desktop audio redirection, helping audio from remote sessions play correctly on the local device. support.microsoft.com
  5. 5. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  6. 6. [Hyper-V] This update addresses an issue that might cause a limited number of Windows Server 2022 virtual machines to intermittently encounter a stop error 0x139 resulting in an unexpected restart. support.microsoft.com
  7. 7. After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. support.microsoft.com
  8. 8. The symptoms experienced on devices using 8-channel or 3D audio modes (last bullet point in the list of symptoms documented in this entry) are resolved in the out-of-band (OOB) update released on September 14, 2026, (KB5129237), and updates released after this date. learn.microsoft.com
  9. 9. This issue is resolved in Windows updates released on and after September 14, 2026 such as KB5129237. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake