Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5123099

KB5123099: Cumulative update for Windows Server, version 2016, September 2026. Actively exploited ALPC flaw; Remote Desktop audio addressed

In short

An actively exploited ALPC flaw could let attackers gain higher privileges. The update also addresses remote-session audio problems, but some USB audio issues remain.

Does it affect you? Applies to: Systems running Windows Server 2016.

Build
14393.9512
Security
563 fixed · 49 critical · 1 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 3 changes

Secure Boot

Gradual rollout Verified in package

For: supported PCs and non-managed business devices

  • More eligible computers can receive new Secure Boot certificates automatically over the coming months.1
    Adds high-confidence device-targeting data to increase coverage of devices eligible to receive new Secure Boot certificates.

Date and Time

  • Devices using Morocco time display the correct local time after Morocco moves to UTC+00:00 on September 20, 2026.2
    Adjusts Morocco Standard Time to reflect the transition to permanent UTC+00:00.

Windows Code Integrity policies

  • App compatibility improves while Windows changes its certificate authorities.3
    Recognizes Microsoft Windows Production PCA 2026 RSA2048-SHA256 as equivalent to PCA 2011 during certificate-authority rotation.

Fixes 2 changes

Remote Desktop

Verified in package

For: devices using Remote Desktop audio redirection

  • Remote-session audio might not play on the local computer in some setups; this update addresses the problem.4
    Addresses Remote Desktop audio redirection problems in certain configurations.

Microsoft Compatibility Telemetry service

For: some Windows Server 2016 devices

  • This update fixes recurring Application Error events that some Server 2016 devices might generate after installing KB5120418.5
    Fixes recurring Application Error events (Event ID 1000, exception code 0xc0000409) associated with CompatTelRunner.exe after installing KB5120418.

Known issues

  1. Mitigated Affects: Everyone

    USB Audio Class 1.0 devices with error Code 10 or no output

    Some USB Audio Class 1.0 devices might fail to start, produce no sound, or show Code 10. KB5129239 resolves the 8-channel and 3D audio cases; other symptoms are not yet resolved.6

    How to apply the workaround Workaround

    For symptoms not addressed by the update, administrators can contact Microsoft Support. Some customers have restored audio in multichannel cases by switching to 2-channel mode.6

  2. Resolved Affects: Organizations and IT administrators Resolved by KB5129239

    Remote Desktop Services might stop responding after September 2026 security update

    Some organizations might have Remote Desktop Services connection or sign-in failures, or servers stuck at “Please wait for the Remote Desktop Configuration” after the September update. Updates released on or after September 14, 2026, such as KB5129239, resolve this issue; Windows 365 and Azure Virtual Desktop are not affected.7

    Resolution Fixed in KB5129239

    Install KB5129239 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5120418, KB5099535, KB5094122, KB5087537
+23 earlier KB5091572, KB5082198, KB5078938, KB5075999, KB5073722, KB5074974, KB5071543, KB5068864, KB5070882, KB5066836, KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5129239
VersionBuildChannel
2016 14393.9512 General availability

Security

563 vulnerabilities fixed
1 exploited 49 critical 514 important
VulnerabilitySeverityCVSS
CVE-2026-85880 Exploited
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-69579
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69590
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69595
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69730
Windows DNS Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69769
Windows HTTP Print Provider Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69829
Windows Shell Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69845
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70296
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72979
Windows DHCP Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72982
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-72983
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-73009
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-77493
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-78445
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-69499
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69518
Windows Remote Desktop Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69601
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69603
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69676
Windows Kerberos Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69712
Windows Key Distribution Center Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69860
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70203
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70586
Windows Paint Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72950
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72959
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72960
Windows Media Player Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-72986
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73006
DirectWrite Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73013
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73018
Graphic Fonts Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-73023
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77495
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-77504
Microsoft Office Word Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-69846
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69906
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-72961
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 8.2
CVE-2026-69813
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-69827
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72981
IP Helper Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72987
Windows DNS Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-77505
Windows DNS Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-78449
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-72957
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-69789
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-69852
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-72954
Windows Deployment Services Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-81355
Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-70585
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
 Critical 7.0
CVE-2026-72980
Windows Hello Security Feature Bypass Vulnerability
 Critical 4.4

The table lists the 50 exploited, publicly disclosed or critical vulnerabilities. See all 563 vulnerabilities →

Updated components

1,526 files changed since the previous update for the same versions.

Top changed componentsFiles
Networking18
Audio13
Remote Desktop13
WPF11
Secure Boot10
Printing9
Graphics and display7
Security and sign-in7
Storage and file systems6
Hyper-V and virtualization5
Windows Update5
Kernel4

Verified in package: changed files confirm Secure Boot, Remote Desktop.

Page history

  1. Added CVE-2026-88239 (Important)

    Added CVE-2026-95877 (Important)

    Added CVE-2026-96127 (Important)

  2. Added CVE-2026-69283 (Important)

    Added CVE-2026-70583 (Important)

    Added CVE-2026-71339 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. This update adjusts Morocco Standard Time to reflect Morocco's transition to permanent UTC+00:00 effective September 20, 2026. support.microsoft.com
  3. 3. Improves application compatibility during Windows certificate-authority rotation by recognizing Microsoft Windows Production PCA 2026 RSA2048-SHA256 as equivalent to PCA 2011. support.microsoft.com
  4. 4. This update addresses an issue that affects Remote Desktop audio redirection. Audio from the remote session might not play on the local computer in certain configurations. support.microsoft.com
  5. 5. Fixed: After installing Windows update KB5120418 released on August 11, 2026, some Windows Server 2016 devices might generate recurring Application Error events support.microsoft.com
  6. 6. This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026, (KB5129239), and updates released after this date. learn.microsoft.com
  7. 7. In some environments, RDS might become unstable, resulting in RDP connections failing after several minutes, sign-in issues, or servers hanging at "Please wait for the Remote Desktop Configuration". support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake