Skip to the content
The Update Bureau
Windows Server 2019 Windows Server 2019 Security update
Patch Tuesday Zero-day Known issues

KB5122876

KB5122876: Cumulative update for Windows Server, version 2019, September 2026. An exploited ALPC flaw is patched; Remote Desktop audio is addressed

In short

An exploited Windows ALPC flaw is patched, and Remote Desktop audio redirection is addressed for some configurations. USB Audio Class 1.0 devices can still have sound problems.

Does it affect you? Applies to: Devices running Windows Server 2019. The package is for x64 systems.

Build
17763.9245
Security
626 fixed · 59 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues The issue can affect USB Audio Class 1.0 devices, including devices used at home. The advice to contact Microsoft Support for Business is specifically for IT administrators seeking an immediate workaround.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 4 changes

Secure Boot

Gradual rollout Verified in package

For: Supported PCs and non-managed business devices

  • More eligible devices can receive new Secure Boot certificates automatically over the coming months.1
    Adds high-confidence device-targeting data. Certificate deployment continues across supported PCs and non-managed business devices.

Date and Time

For: Devices using Morocco Standard Time

  • Morocco's local time will stay correct after the country moves to UTC+00:00 on September 20, 2026.2
    Adjusts Morocco Standard Time for the transition to permanent UTC+00:00.

Windows Code Integrity policies

For: Devices using Windows Code Integrity policies

  • Some apps work more smoothly during Windows certificate changes.3
    Recognizes Microsoft Windows Production PCA 2026 RSA2048-SHA256 as equivalent to PCA 2011 during certificate-authority rotation.

Servicing stack

For: Azure-hosted devices

  • The update process better checks whether a device is hosted on Azure.4
    The servicing stack update includes enhanced Azure-hosting verification logic that uses an updated certificate chain.

Fix 1 change

Remote Desktop

Verified in package
  • Audio from some Remote Desktop sessions can play on the local computer again.5
    Addresses an issue affecting Remote Desktop audio redirection in certain configurations.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5131085

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might fail to start or produce sound. The September 14, 2026 update fixes the issue for devices using 8-channel or 3D audio modes, but other symptoms are not yet resolved.6

    How to apply the workaround Workaround

    For symptoms not fixed by the out-of-band update, contact Microsoft Support for Business for help.6

  2. Resolved Affects: Organizations and IT administrators Resolved by KB5129238

    Remote Desktop Services might stop responding after September 2026 security update

    Some organizations might have Remote Desktop Services instability after the September 2026 security update. KB5129238 and later updates resolve the issue. It does not affect Windows 365 or Azure Virtual Desktop.7

    Resolution Fixed in KB5129238

    Install KB5129238 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5120238, KB5099538, KB5094123, KB5087538
+23 earlier KB5091573, KB5082123, KB5078752, KB5075904, KB5078131, KB5077795, KB5073723, KB5074975, KB5071544, KB5068791, KB5070883, KB5066586, KB5065428, KB5066187, KB5063877, KB5062557, KB5060531, KB5061978, KB5058392, KB5059091, KB5058922, KB5050008, KB5037425
Replaced by
KB5129238
VersionBuildChannel
2019 17763.9245 General availability

Security

626 vulnerabilities fixed
1 exploited 59 critical 567 important
VulnerabilitySeverityCVSS
CVE-2026-85880 Exploited
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-69579
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69590
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69595
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69730
Windows DNS Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69769
Windows HTTP Print Provider Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69829
Windows Shell Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69845
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70296
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72979
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72982
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72983
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73009
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73010
Microsoft Failover Cluster Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-77493
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-78445
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69499
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69518
Windows Remote Desktop Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69601
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69603
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69676
Windows Kerberos Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69712
Windows Key Distribution Center Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69860
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70203
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70586
Windows Paint Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72950
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72959
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72960
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72986
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73006
DirectWrite Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73013
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73018
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73023
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77495
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77504
Microsoft Office Word Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-81955
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69846
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69874
Windows ALPC Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69906
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72961
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72962
Windows USB Video Driver Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-81354
Windows Hello Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69530
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69813
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69827
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72981
IP Helper Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72987
Windows DNS Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-77505
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78444
Microsoft Failover Cluster Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78449
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78450
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72957
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-69789
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69852
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69890
Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
 Critical 7.5
CVE-2026-72954
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-73017
Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-81355
Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-70585
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 7.0
CVE-2026-72980
Windows Hello Security Feature Bypass Vulnerability
 Critical 4.4

The table lists the 60 exploited, publicly disclosed or critical vulnerabilities. See all 626 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2019
857.2 MB
windows10.0-kb5122876-x64.msu Main update · KB5122876 SHA-1: 86ff6d10…caf0aa

Updated components

1,520 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio19
Networking16
Remote Desktop14
Graphics and display12
Security and sign-in12
Secure Boot11
Storage and file systems11
Printing10
Hyper-V and virtualization7
Bluetooth6
Kernel4
Search4

Verified in package: changed files confirm Secure Boot, Remote Desktop.

Page history

  1. Added CVE-2026-88239 (Important)

    Added CVE-2026-95877 (Important)

    Added CVE-2026-96127 (Important)

  2. Added CVE-2026-69283 (Important)

    Added CVE-2026-70583 (Important)

    Added CVE-2026-71339 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. This update adjusts Morocco Standard Time to reflect Morocco's transition to permanent UTC+00:00 effective September 20, 2026. support.microsoft.com
  3. 3. Improves application compatibility during Windows certificate-authority rotation by recognizing Microsoft Windows Production PCA 2026 RSA2048-SHA256 as equivalent to PCA 2011. support.microsoft.com
  4. 4. This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. support.microsoft.com
  5. 5. This update addresses an issue that affects Remote Desktop audio redirection. Audio from the remote session might not play on the local computer in certain configurations. support.microsoft.com
  6. 6. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026, (KB5129238), and updates released after this date. learn.microsoft.com
  7. 7. This issue is resolved in Windows updates released on and after September 14, 2026 such as KB5129238. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake