KB5123099: Cumulative update for Windows 10, version 1607, September 2026. Windows ALPC flaw under attack; Remote Desktop audio addressed

Attackers are exploiting a Windows ALPC privilege flaw. The update also addresses Remote Desktop audio problems and adds Secure Boot certificate targeting data.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSB 2016 or Windows 10 IoT Enterprise 2016 LTSB, version 1607.

Review notes Additional details from the official release notes (2) Read notes

In detail Microsoft reports the File History problem after installing September 2026 security update KB5124008. Microsoft is working on a fix.
Known issues Microsoft reports the File History problem after installing September 2026 security update KB5124008. Microsoft is working on a fix.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 3 changes

Secure Boot

Gradual rollout Verified in package

For: supported PCs and non-managed business devices

More eligible PCs can receive new Secure Boot certificates automatically.¹
Adds high-confidence device-targeting data to increase coverage of devices eligible to receive new Secure Boot certificates automatically. Certificate deployment continues across supported PCs and non-managed business devices in the coming months.

Date and Time

For: devices set to Morocco Standard Time

Morocco's local time will reflect its move to permanent UTC+00:00 on September 20, 2026.²
Adjusts Morocco Standard Time for Morocco's transition to permanent UTC+00:00.

Windows Code Integrity policies

Application compatibility improves during Windows certificate-authority changes.³
Recognizes Microsoft Windows Production PCA 2026 RSA2048-SHA256 as equivalent to PCA 2011 during Windows certificate-authority rotation.

Fix 1 change

Remote Desktop

Verified in package

For: Remote Desktop users in certain configurations

Addresses cases where audio from a Remote Desktop session might not play on the local computer.⁴
Addresses Remote Desktop audio redirection problems in certain configurations.

Known issues

Open Affects: Everyone

File History might stop working after installing September 2026 Windows update

Some people using File History might be unable to create or update backups. A connected backup drive might still appear to need reconnecting, and old files might show no previous version.⁵

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Resolved Affects: Organizations and IT administrators Resolved by KB5129239

Remote Desktop Services might stop responding after September 2026 security update

Some organizations might see Remote Desktop connections fail, sign-in problems, or servers hang. KB5129239 resolves this issue.⁶

Resolution Fixed in KB5129239

Install KB5129239 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Resolved Affects: Everyone Resolved by KB5131096

USB audio devices might fail to start or produce no sound

Some USB Audio Class 1.0 devices might fail to start or produce sound. KB5129239 resolves the 8-channel and 3D-audio symptoms, but other symptoms are still being addressed.⁷

How to apply the workaround Workaround

IT administrators can contact Microsoft Support for Business for an immediate workaround for symptoms not addressed by KB5129239.⁷

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-09-08
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5120418, KB5099535, KB5094122, KB5087537

+22 earlier
KB5091572, KB5082198, KB5078938, KB5075999, KB5073722, KB5074974, KB5071543, KB5068864, KB5066836, KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by: KB5129239

Version	Build	Channel
1607	14393.9512	General availability

Security

559 vulnerabilities fixed

1 exploited 45 critical 514 important

Vulnerability	Severity	CVSS
CVE-2026-85880 Exploited Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-69579 Windows Message Queuing Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-69590 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-69730 Windows DNS Server Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-69769 Windows HTTP Print Provider Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-69829 Windows Shell Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-69845 Windows DHCP Server Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-70296 Windows Imaging Component Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-72979 Windows DHCP Server Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-72982 Windows Netlogon Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-72983 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-73009 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-77493 Windows Graphics Component Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-69499 Windows Imaging Component Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-69518 Windows Remote Desktop Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-69601 Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-69603 Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-69676 Windows Kerberos Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-69860 Windows Imaging Component Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-70203 Windows Media Player Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-70586 Windows Paint Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-72950 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-72959 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-72960 Windows Media Player Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-72986 Graphic Fonts Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-73006 DirectWrite Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-73013 Windows Imaging Component Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-73018 Graphic Fonts Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-73023 Windows Imaging Component Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-77495 Windows Imaging Component Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-77504 Microsoft Office Word Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-69846 Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	8.2
CVE-2026-69906 Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	8.2
CVE-2026-72961 Windows Hyper-V Elevation of Privilege Vulnerability	Critical	8.2
CVE-2026-69813 Windows DNS Server Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-69827 Windows DNS Server Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-72981 IP Helper Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-72987 Windows DNS Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-77505 Windows DNS Server Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-78449 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.1
CVE-2026-72957 Windows Deployment Services Remote Code Execution Vulnerability	Critical	7.8
CVE-2026-69789 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	7.5
CVE-2026-69852 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Critical	7.5
CVE-2026-72954 Windows Deployment Services Remote Code Execution Vulnerability	Critical	7.5
CVE-2026-81355 Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability	Critical	7.5
CVE-2026-72980 Windows Hello Security Feature Bypass Vulnerability	Critical	4.4

The table lists the 46 exploited, publicly disclosed or critical vulnerabilities. See all 559 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 1607

1.8 GB

windows10.0-kb5123099-x64.msu Main update · KB5123099 SHA-1: 28560cfa…40bc58

x86 1607

1.0 GB

windows10.0-kb5123099-x86.msu Main update · KB5123099 SHA-1: db193ed8…fd33da

Updated components

2,633 files changed since the previous update for the same versions.

Top changed components	Files
Networking	36
Audio	25
Remote Desktop	25
WPF	22
Secure Boot	20
Printing	18
Graphics and display	14
Security and sign-in	13
Storage and file systems	12
Search	8
Kernel	7
Windows Update	7

Verified in package: changed files confirm Secure Boot, Remote Desktop.

Page history

Nov 11, 2026

Added CVE-2026-88239 (Important)

Added CVE-2026-95877 (Important)

Added CVE-2026-96127 (Important)
Nov 9, 2026

Added CVE-2026-69283 (Important)

Added CVE-2026-70583 (Important)

Added CVE-2026-71339 (Important)

Sources

Updated Nov 11, 2026

Cited passages from Microsoft's official notes (7)

1. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
2. This update adjusts Morocco Standard Time to reflect Morocco's transition to permanent UTC+00:00 effective September 20, 2026. support.microsoft.com
3. Improves application compatibility during Windows certificate-authority rotation by recognizing Microsoft Windows Production PCA 2026 RSA2048-SHA256 as equivalent to PCA 2011. support.microsoft.com
4. This update addresses an issue that affects Remote Desktop audio redirection. Audio from the remote session might not play on the local computer in certain configurations. support.microsoft.com
5. After installing the September 2026 Windows security update KB5124008, some customers using File History, might be unable to create or update backups. support.microsoft.com
6. This issue is resolved in Windows updates released on and after September 14, 2026 such as KB5129239. support.microsoft.com
7. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes learn.microsoft.com

Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Sep 25, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake