Skip to the content
The Update Bureau
Windows 11 26H1 Windows 11 26H1 Out-of-band security update
Out-of-band

KB5129194

KB5129194: Cumulative update for Windows 11, version 26H1, September 2026. Secure Kernel protections and fixes for Remote Desktop and USB audio

In short

Secure Kernel protections address a critical elevation-of-privilege flaw. The release also fixes Remote Desktop failures and some USB audio modes, while other USB audio problems remain.

Does it affect you? Applies to: Devices running Windows 11, version 26H1, on x64 or Arm64. The AI component updates apply only to Copilot+ PCs.

Build
28000.2956
Security
2 fixed · 1 critical
Restart
Required

What changes

Improvements 4 changes

Security

Verified in package 2 items
  • Adds protection against a flaw that could let someone gain higher access to the PC.1
    Adds protections for CVE-2026-62721, a Windows User-Mode Power Service elevation-of-privilege vulnerability.
  • Adds protection against a critical flaw that could let someone gain higher access to the PC.2
    Adds protections for CVE-2026-85921, a Windows Secure Kernel Mode elevation-of-privilege vulnerability.

AI components

  • Updates four AI components. These updates apply only to Copilot+ PCs.3
    Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2608.951.0.

Servicing stack update

For: Windows 11 devices

  • Includes an update that improves the reliability of installing Windows updates.4
    Includes KB5125104, build 28000.2950.

Fixes 3 changes

Remote Desktop Services

Verified in package

For: Remote Desktop environments

  • Remote Desktop connections and sign-ins can fail in affected environments. Related tools might also stop responding.5
    Addresses instability after KB5124012, including RDP connection and sign-in failures, servers becoming unresponsive during Remote Desktop configuration, and related tools such as MMC, RDS Licensing Diagnoser, File Explorer, and Windows Update.

Hyper-V

For: Devices sharing folders with Linux virtual machines

  • Folders shared from Windows might not appear or open in some Linux virtual machines. This is fixed.6
    Fixes issues in applications using HCS-managed virtual machines when sharing host folders with Linux VMs using Plan9.

8-channel or 3D audio modes

Verified in package

For: Devices with USB Audio Class 1.0 devices

  • Some USB audio devices can use 8-channel or 3D audio modes again.7
    Resolves the multichannel audio symptom for some USB Audio Class 1.0 devices. Other USB audio symptoms are not resolved in this update.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5132059

    USB audio devices might fail to start or produce no sound

    Some USB Audio Class 1.0 devices might fail to start, produce sound, or respond to volume and sound settings. This update fixes the 8-channel and 3D audio symptom, but other symptoms remain unresolved.8

    How to apply the workaround Workaround

    Some customers can restore sound in multichannel cases by switching to 2-channel mode. IT administrators can contact Microsoft Support for Business for help with symptoms not addressed by this update.8

  2. Resolved Affects: Everyone Resolved by KB5127646

    Devices might experience a black screen or desktop loading issues after sign-in

    Some devices, mainly Azure Virtual Desktop hosts using FSLogix, might show a black screen after sign-in. KB5127646 or later updates resolve this.9

    Resolution Fixed in KB5127646

    Install KB5127646 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Everyone Resolved by KB5124006

    File History might stop working after installing September 2026 Windows update

    Some people using File History might be unable to create or update backups, even when a working backup drive is connected. KB5124006 or later updates resolve this.10

    Resolution Fixed in KB5124006

    Install KB5124006 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  4. Resolved Affects: Organizations and IT administrators Resolved by KB5124010

    Domain-joined devices might lose their secure trust relationship with the domain

    Some devices with Credential Guard protected machine accounts might lose their trust relationship with an on-premises domain. KB5124006 or later updates resolve this.11

    How to apply the workaround Group Policy

    For devices still affected on updates released before KB5124006, administrators can apply the Known Issue Rollback policy, set it to Disabled, and restart.11

    Step-by-step workaround instructions
    3 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Install the special KB5124012 260915_17122 Known Issue Rollback Group Policy for Windows 11, version 26H1.
    2. Set the policy under Computer Configuration > Administrative Templates > KB5124012 260915_17122 Known Issue Rollback > Windows 11, version 26H1 to Disabled.
    3. Restart the affected devices.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5124012, KB5120996, KB5121000, KB5101681
+11 earlier KB5101649, KB5095091, KB5095051, KB5089570, KB5089548, KB5083806, KB5083768, KB5079489, KB5079466, KB5077239, KB5077179
Replaced by
KB5127646
VersionBuildChannel
26H1 28000.2956 General availability
26H1 28000.2956 Release Preview Channel

Security

2 vulnerabilities fixed
1 critical 1 important
VulnerabilitySeverityCVSS
CVE-2026-85921
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-62721
Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability
 Important 7.8

Updated components

87 files changed since the previous update for the same versions.

Top changed componentsFiles
Secure Boot5
Kernel4
Audio2
Hyper-V and virtualization2
Remote Desktop2

Verified in package: changed files confirm Security, Remote Desktop Services, 8-channel or 3D audio modes.

Page history

  1. Known issue resolved: USB Audio Class 1.0 devices with error Code 10 or no output (KB5129194)

Sources

Updated
Cited passages from Microsoft's official notes (11)
  1. 1. This update includes protections documented in CVE-2026-62721, which refers to a Windows User-Mode Power Service (UMPS) Elevation of Privilege vulnerability. support.microsoft.com
  2. 2. This update includes protections documented in CVE-2026-85921, which refers to a Windows Secure Kernel Mode Elevation of Privilege vulnerability. support.microsoft.com
  3. 3. This release updates the following AI components to version 1.2608.951.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model. support.microsoft.com
  4. 4. Includes KB5125104 (Build 28000.2950), which improves the reliability of the Windows update installation process. support.microsoft.com
  5. 5. In affected environments, RDS might become unstable, causing RDP connection and sign-in failures or servers to become unresponsive during Remote Desktop configuration. support.microsoft.com
  6. 6. Folders shared from the Windows host using Plan9 did not appear or could not be accessed in the guest environment. support.microsoft.com
  7. 7. Some USB Audio Class 1.0 devices functioning as expected in standard stereo configurations failed when using multichannel audio features, including 8-channel or 3D audio modes. support.microsoft.com
  8. 8. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes (last bullet point in the list of symptoms documented in this entry). We are working to address the other symptoms learn.microsoft.com
  9. 9. This issue is resolved in Windows updates released on and after October 13, 2026 such as KB5127646. support.microsoft.com
  10. 10. This issue is resolved in Windows updates released on and after September 22, 2026 such as KB5124006. support.microsoft.com
  11. 11. After installing the Group Policy, configure the value for setting KB5124012 260915_17122 Known Issue Rollback to Disabled and restart your device(s) to apply the Group Policy setting. learn.microsoft.com
Checked automatically: 8 of 8 checks passed, 11 quoted passages · compared with Microsoft's page on Nov 13, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake