Skip to the content
The Update Bureau
Windows 11 24H2 / 25H2 Windows 11 24H2 / 25H2 Security update
Patch Tuesday Zero-day

KB5124008

KB5124008: Cumulative update for Windows 11, versions 24H2 and 25H2, September 2026. Windows Update flaw exploited; mouse and desktop display fixes

In short

An actively exploited flaw in the Windows Update stack gets a security fix, alongside fixes for mouse settings, black desktop backgrounds, and app crashes on Arm64 PCs.

Does it affect you? Applies to: Devices running Windows 11, versions 24H2 and 25H2. The 24H2 Home and Pro editions reach end of updates on October 13, 2026; Enterprise and Education editions remain supported until October 12, 2027.

Builds
26100.9445 · 26200.9445
Security
642 fixed · 54 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • Known issues The issue affects some Credential Guard-protected machine accounts configured for Machine Identity Isolation, particularly when they are not connected to Windows Server 2025 domain controllers.
  • Known issues For devices on an update released before September 22, 2026, administrators can use a workaround if the device has this issue. Devices updated on or after September 22 do not need a workaround.

The official sources are linked at the end of the page.

What changes

Improvements 6 changes

Security updates

  • The Windows Update stack gets a fix for a flaw that attackers are already using to gain higher privileges.1
    Addresses CVE-2026-81963, a Windows Update Stack Elevation of Privilege vulnerability.

Secure Boot

Gradual rollout Verified in package

For: Supported PCs and non-managed business devices

  • More eligible PCs can automatically receive new Secure Boot certificates over the coming months.2
    Adds high-confidence device targeting data for certificate deployment on supported PCs and non-managed business devices.

Date and Time

For: Devices set to Morocco Standard Time

  • Clocks show Morocco’s correct local time after the country moves to permanent UTC+00:00 on September 20, 2026.3
    Adjusts Morocco Standard Time to reflect Morocco's transition to permanent UTC+00:00 effective September 20, 2026.

OMA-DM Client Logging

  • More diagnostic details are available to help find device management server connection problems.3
    Improves diagnostic logging for the OMA-DM client.

AI components

Verified in package

For: Windows Copilot+ PCs

  • Several AI components are updated to version 1.2608.951.0.4
    Updates Image Search, Content Extraction, Semantic Analysis, and Settings Model. These components apply only to Windows Copilot+ PCs.

Servicing stack

  • An included update improves the reliability of installing Windows updates.5
    Includes servicing stack update KB5124007, build 26100.9441.

Fixes 4 changes

Mouse

Verified in package
  • Selected mouse pointer styles and colors display correctly again.6
    Addresses an issue that prevented customized mouse cursor settings, including pointer style and color, from displaying correctly.

Personalization

Verified in package
  • Desktop backgrounds and other personalization settings load correctly instead of sometimes leaving a black background.6
    Addresses an issue where desktop background and other personalization settings might not load correctly.

Teams and Outlook on Arm64 PCs

For: Devices with Arm64 processors

  • Microsoft Teams and Microsoft Outlook no longer unexpectedly close on affected Arm64 PCs.6
    Addresses an issue that could cause Microsoft Teams and Microsoft Outlook to unexpectedly close on Arm64-based PCs.

Remote Desktop Audio Redirection

Verified in package
  • Audio from some Remote Desktop sessions can play on the local device again.3
    Addresses an issue that could prevent audio from a remote session from playing on the local device in certain configurations.

Known issues

  1. Mitigated Affects: Everyone

    USB audio devices might fail to start or produce no sound

    Some USB Audio Class 1.0 devices might fail to start or play sound. KB5129195 fixes 8-channel and 3D audio symptoms, but other symptoms remain.7

    How to apply the workaround Workaround

    Some customers report restoring audio by switching affected devices using multichannel audio to 2-channel mode.7

  2. Resolved Affects: Everyone Resolved by KB5127648

    Devices might experience a black screen or desktop loading issues after sign-in

    Some devices might show a black screen after sign-in or fail to load the desktop. KB5127648 resolves this issue.8

    Resolution Fixed in KB5127648

    Install KB5127648 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Everyone Resolved by KB5124010

    File History might stop working after installing September 2026 Windows update

    File History might fail to create or update backups and show a false drive warning. KB5124010 resolves this issue.9

    Resolution Fixed in KB5124010

    Install KB5124010 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  4. Resolved Affects: Organizations and IT administrators Resolved by KB5124010

    Domain-joined devices might lose their secure trust relationship with the domain

    Some PCs connected to a work domain might lose their secure link to it. Signing in with a domain account might fail; KB5124010 resolves this issue.10

    How to apply the workaround Group Policy

    On devices still using an update released before September 22, 2026, administrators can apply the Known Issue Rollback policy and restart the devices.10

    Step-by-step workaround instructions
    3 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Install the special policy for the affected Windows version.
    2. In Computer Configuration > Administrative Templates > KB5124008 260915_17123 Known Issue Rollback > Windows 11, version 24H2, 25H2, set the policy to Disabled.
    3. Restart the affected devices.
  5. Resolved Affects: Everyone Resolved by KB5129195

    Host folder shares might be unavailable in Hyper-V-based Linux VMs

    Shared host folders might not appear or open in some Linux virtual machines using Hyper-V and Plan9. KB5129195 resolves this issue.11

    Resolution Fixed in KB5129195

    Install KB5129195 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  6. Resolved Affects: Organizations and IT administrators Resolved by KB5129195

    Remote Desktop Services might stop responding after September 2026 security update

    In some organizations, Remote Desktop Services might stop responding or connections might fail. KB5129195 resolves this issue; Windows 365 and Azure Virtual Desktop are not affected.12

    Resolution Fixed in KB5129195

    Install KB5129195 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5120998, KB5121003, KB5101684, KB5121767
+59 earlier KB5101650, KB5095093, KB5094126, KB5089573, KB5089549, KB5083631, KB5083769, KB5086672, KB5079391, KB5085516, KB5079473, KB5077241, KB5077181, KB5074105, KB5078127, KB5077744, KB5074109, KB5072033, KB5070311, KB5068861, KB5067036, KB5070773, KB5066835, KB5065789, KB5068221, KB5065426, KB5064081, KB5063878, KB5062660, KB5064489, KB5062553, KB5060829, KB5063060, KB5060842, KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5129195
VersionBuildChannel
24H2 26100.9445 General availability
25H2 26200.9445 General availability
26H2 26300.9445 Release Preview Channel

Security

642 vulnerabilities fixed
1 exploited 54 critical 588 important
VulnerabilitySeverityCVSS
CVE-2026-81963 Exploited
Windows Update Stack Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-69579
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69590
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69769
Windows HTTP Print Provider Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69829
Windows Shell Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70296
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72982
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72983
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73009
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-77493
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69499
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69518
Windows Remote Desktop Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69601
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69603
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69676
Windows Kerberos Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69740
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-69784
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-69860
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70203
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70586
Windows Paint Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72950
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72959
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72960
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72986
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73006
DirectWrite Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73013
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73018
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73023
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77495
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77504
Microsoft Office Word Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-80083
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-81955
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69820
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69846
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69874
Windows ALPC Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69906
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72958
Windows Credential Guard Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72961
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72962
Windows USB Video Driver Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-81354
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72981
IP Helper Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78449
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69725
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69799
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69864
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-83498
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69710
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-69789
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69852
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69890
Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-73017
Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-81355
Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69501
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-83501
Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability
 Critical 5.5
CVE-2026-72980
Windows Hello Security Feature Bypass Vulnerability
 Critical 4.4

The table lists the 55 exploited, publicly disclosed or critical vulnerabilities. See all 642 vulnerabilities →

Updated components

3,709 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio38
Networking36
Remote Desktop34
Graphics and display29
Printing28
Bluetooth22
Security and sign-in19
Secure Boot16
Storage and file systems16
File Explorer and shell15
Search14
Hyper-V and virtualization12

Verified in package: changed files confirm Secure Boot, AI components, Mouse, Personalization, Remote Desktop Audio Redirection.

Page history

  1. Added CVE-2026-102868 (Important)

    Added CVE-2026-88239 (Important)

    Added CVE-2026-95877 (Important)

    Added CVE-2026-96127 (Important)

  2. Added CVE-2026-69283 (Important)

    Added CVE-2026-70583 (Important)

    Added CVE-2026-71339 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (12)
  1. 1. This update provides security improvements. For more information about the security vulnerabilities resolved by this update, see the Security Update Guide support.microsoft.com
  2. 2. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  3. 3. This update addresses an issue affecting Remote Desktop audio redirection that could prevent audio from a remote session from playing on the local device in certain configurations. support.microsoft.com
  4. 4. This release updates the following AI components to version 1.2608.951.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model. support.microsoft.com
  5. 5. Includes KB5124007 (Build 26100.9441), which improves the reliability of the Windows update installation process. support.microsoft.com
  6. 6. Fixed: This update addresses an issue that prevented customized mouse cursor settings, including pointer style and color, from displaying correctly. support.microsoft.com
  7. 7. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes learn.microsoft.com
  8. 8. This issue is resolved in Windows updates released on and after October 13, 2026 such as KB5127648. support.microsoft.com
  9. 9. This issue is resolved in Windows updates released on and after September 22, 2026 such as KB5124010. support.microsoft.com
  10. 10. This issue was resolved by Windows updates released September 22, 2026 (KB5124010), and updates released after that date. learn.microsoft.com
  11. 11. This issue is resolved in Windows updates released on and after September 14, 2026 such as KB5129195. support.microsoft.com
  12. 12. This issue is resolved in Windows updates released on and after September 14, 2026 such as KB5129195. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 12 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake