Skip to the content
The Update Bureau
Windows 11 26H1 Windows 11 26H1 Security update
Patch Tuesday Zero-day Known issues

KB5124012

KB5124012: Cumulative update for Windows 11, version 26H1, September 2026. An exploited Windows Update Stack flaw is closed

In short

An actively exploited Windows Update Stack flaw gets a security fix, and Teams and Outlook crashes on Arm64 PCs are addressed. The update also changes Morocco time and improves remote-session audio.

Does it affect you? Applies to: Devices running Windows 11, version 26H1, on x64 or Arm64.

Build
28000.2954
Security
640 fixed · 54 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues For the rollback policy workaround, set the policy to Disabled and restart the device. Reset the secure channel only after manually disabling Machine Identity Isolation.

The official sources are linked at the end of the page.

What changes

Improvements 6 changes

Security updates

  • The update includes security improvements.1
    Security fixes address CVE-2026-81963, an exploited Windows Update Stack elevation-of-privilege vulnerability.

Secure Boot

Gradual rollout Verified in package

For: Eligible supported PCs and non-managed business devices

  • More eligible PCs can receive new Secure Boot certificates automatically as deployment continues over the coming months.2
    Adds high-confidence device-targeting data for devices eligible to automatically receive new Secure Boot certificates. Deployment continues across supported PCs and non-managed business devices.

Date and Time

For: Devices using Morocco Standard Time

  • Morocco local time reflects the country's move to permanent UTC+00:00 on September 20, 2026.3
    Adjusts Morocco Standard Time for the transition to permanent UTC+00:00 effective September 20, 2026.

OMA-DM Client Logging

  • Device management logs include more details to help administrators troubleshoot connection problems.4
    Adds certificate chain information for server connections to OMA-DM client diagnostic logging.

AI components

Verified in package

For: Windows Copilot+ PCs

  • Four AI components receive an update on applicable Copilot+ PCs.5
    Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2608.951.0. The components apply only to Windows Copilot+ PCs.

Servicing stack

  • The update includes a change that improves Windows update installation reliability.6
    Includes KB5125104, build 28000.2950.

Fixes 2 changes

Teams and Outlook on Arm64 PCs

For: Devices with Arm64 processors

  • Teams and Outlook are less likely to close unexpectedly on Arm64 PCs.7
    Addresses an issue that could cause Microsoft Teams and Microsoft Outlook to unexpectedly close on Arm64-based PCs.

Remote Desktop Audio Redirection

Verified in package
  • Audio from some remote sessions can play on the local device again.8
    Addresses an issue that could prevent audio from a remote session from playing on the local device in certain configurations.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5132059

    USB audio devices might fail to start or produce no sound

    Some USB Audio Class 1.0 devices might fail to start or produce no sound. The 8-channel and 3D audio symptoms are resolved by KB5129194; KB5132059 and later updates resolve the remaining symptoms.9

    How to apply the workaround Workaround

    Some customers reported restoring audio in multichannel cases by switching to 2-channel mode.9

  2. Resolved Affects: Everyone Resolved by KB5127646

    Devices might experience a black screen or desktop loading issues after sign-in

    Some devices might show a black screen or fail to load the desktop after sign-in. Updates released on or after October 13, 2026, such as KB5127646, resolve this issue.10

    Resolution Fixed in KB5127646

    Install KB5127646 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Everyone Resolved by KB5124006

    File History might stop working after installing September 2026 Windows update

    Some File History users might be unable to create or update backups, even when a working backup drive is connected. Updates released on or after September 22, 2026, such as KB5124006, resolve this issue.11

    Resolution Fixed in KB5124006

    Install KB5124006 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  4. Resolved Affects: Organizations and IT administrators Resolved by KB5124010

    Domain-joined devices might lose their secure trust relationship with the domain

    Some Credential Guard protected machine accounts might lose their secure connection to an on-premises domain, blocking interactive sign-in. KB5124006 and later updates resolve this issue.12

    How to apply the workaround Group Policy / Intune

    The rollback or disabling Machine Identity Isolation stops its enforcement, which prevents the affected domain trust problem. The rollback policy must be set to Disabled, and the device must be restarted.12

    Step-by-step instructions, command & download kit
    4 steps powershell.exe · Administrator Power-User Kit (.zip)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. For the rollback option, install the special Group Policy for Windows 11, version 26H1, set its KB5124012 rollback policy to Disabled, and restart the devices.
    2. Alternatively, disable Machine Identity Isolation using the same method that enabled it: Intune policy, Group Policy, or the registry.
    3. If using the registry, check either listed key. Change MachineIdentityIsolation from 2 to 0 only when its current value is 2.
    4. Restart the device, then repair the secure channel with the PowerShell command.
    powershell.exe · Administrator 
    > Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
  5. Resolved Affects: Everyone Resolved by KB5129194

    Host folder shares might be unavailable in Hyper-V-based Linux VMs

    Host folders shared with some Linux virtual machines might not appear or open. Updates released on or after September 14, 2026, such as KB5129194, resolve this issue.13

    Resolution Fixed in KB5129194

    Install KB5129194 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  6. Resolved Affects: Organizations and IT administrators Resolved by KB5129194

    Remote Desktop Services might stop responding after September 2026 security update

    Some organizations might see Remote Desktop connections fail, sign-in problems, or unresponsive tools and servers. Updates released on or after September 14, 2026, such as KB5129194, resolve this issue. Windows 365 and Azure Virtual Desktop are not affected.14

    Resolution Fixed in KB5129194

    Install KB5129194 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5120996, KB5121000, KB5101681, KB5101649
+10 earlier KB5095091, KB5095051, KB5089570, KB5089548, KB5083806, KB5083768, KB5079489, KB5079466, KB5077239, KB5077179
Replaced by
KB5129194
VersionBuildChannel
26H1 28000.2954 General availability
26H1 28000.2954 Release Preview Channel

Security

640 vulnerabilities fixed
1 exploited 54 critical 586 important
VulnerabilitySeverityCVSS
CVE-2026-81963 Exploited
Windows Update Stack Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-69579
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69590
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69769
Windows HTTP Print Provider Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69829
Windows Shell Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70296
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72982
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72983
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73009
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-77493
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69499
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69518
Windows Remote Desktop Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69601
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69676
Windows Kerberos Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69740
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-69784
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-69860
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70203
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70586
Windows Paint Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72950
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72959
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72960
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72986
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73006
DirectWrite Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73013
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73018
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73023
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77495
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77504
Microsoft Office Word Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-80083
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-81955
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69820
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69846
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69874
Windows ALPC Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69906
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72958
Windows Credential Guard Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72961
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72962
Windows USB Video Driver Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-81354
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-83939
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72981
IP Helper Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78449
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69725
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69799
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69864
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-83498
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-69710
Windows Hello Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-69789
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69852
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69890
Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-73017
Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-81355
Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69501
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-83501
Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability
 Critical 5.5
CVE-2026-72980
Windows Hello Security Feature Bypass Vulnerability
 Critical 4.4

The table lists the 55 exploited, publicly disclosed or critical vulnerabilities. See all 640 vulnerabilities →

Updated components

3,443 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio38
Bluetooth33
Networking32
Remote Desktop31
Graphics and display28
Printing25
Security and sign-in19
Storage and file systems18
Secure Boot17
File Explorer and shell15
Search15
Hyper-V and virtualization9

Verified in package: changed files confirm Secure Boot, AI components, Remote Desktop Audio Redirection.

Page history

  1. Added CVE-2026-88239 (Important)

    Added CVE-2026-95877 (Important)

    Added CVE-2026-96127 (Important)

  2. Added CVE-2026-69283 (Important)

    Added CVE-2026-70583 (Important)

    Added CVE-2026-71339 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (14)
  1. 1. This update provides security improvements. support.microsoft.com
  2. 2. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  3. 3. This update adjusts Morocco Standard Time to reflect Morocco's transition to permanent UTC+00:00 effective September 20, 2026. support.microsoft.com
  4. 4. This update improves diagnostic logging for the OMA-DM client by adding certificate chain information for server connections, helping administrators troubleshoot device management connectivity issues. support.microsoft.com
  5. 5. This release updates the following AI components to version 1.2608.951.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model. support.microsoft.com
  6. 6. Includes KB5125104 (Build 28000.2950), which improves the reliability of the Windows update installation process. support.microsoft.com
  7. 7. Fixed: This update addresses an issue that could cause Microsoft Teams and Microsoft Outlook to unexpectedly close on Arm64-based PCs. support.microsoft.com
  8. 8. This update addresses an issue affecting Remote Desktop audio redirection that could prevent audio from a remote session from playing on the local device in certain configurations. support.microsoft.com
  9. 9. The remaining symptoms are resolved in the Windows security update released on November 10, 2026 (KB5132059) and later updates. learn.microsoft.com
  10. 10. This issue is resolved in Windows updates released on and after October 13, 2026 such as KB5127646. support.microsoft.com
  11. 11. This issue is resolved in Windows updates released on and after September 22, 2026 such as KB5124006. support.microsoft.com
  12. 12. If you are using an update released before September 22, 2026, and have this issue, you have the option to apply one of the following workarounds. learn.microsoft.com
  13. 13. This issue is resolved in Windows updates released on and after September 14, 2026 such as KB5129194. support.microsoft.com
  14. 14. This issue is resolved in Windows updates released on and after September 14, 2026 such as KB5129194. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 14 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake