KB5129195 Fixes Windows 11 RDS, Hyper-V and USB Audio Failures

September 2026 Patch Tuesday set the record, though counts differ​

Every major tracker calls September a record. The exact number depends on the counting method. Tenable says Microsoft patched 964 CVEs in September, the most ever in a Patch Tuesday release in its history. CrowdStrike puts it at 972 vulnerabilities in its September 2026 security update release, over double the number of CVEs released in August. Automox counts 973, and Splashtop and The Cyber Express both report 974. Computerworld's figure is 963 CVEs requiring customer action, 106 rated critical.

Security Affairs explains the gap. Depending on how researchers count external and Chromium bugs, Microsoft fixed between 966 and 997 CVEs in this update. The Cyber Express adds that factoring in fixes for 25 non-Microsoft CVEs, the combined total for this Patch Tuesday September 2026 cycle reaches 999 resolved vulnerabilities. Security Affairs also notes that the company also fixed another 204 vulnerabilities earlier in September across Azure, Entra ID, Edge, and other services. The Spiceworks figure of 974 is reasonable, but it is one count among several, and none of them is official.

The trend matters more than the exact figure, and the monthly counts differ too. The Cyber Express reports 457 CVEs were addressed in August, 663 in July, 220 in June, and 161 in May. Automox puts July at 576 and August at 428. Whichever tally you use, Automox's conclusion holds: the last three releases are now the three largest Microsoft has ever shipped, and none of this one is padding: every entry is a 2026 CVE. The ZDI's Dustin Childs, quoted by Security Affairs, was blunt: "AI-assisted vulnerability discovery shows no signs of slowing down."

The fixes reach far beyond Windows. The Cyber Express breakdown shows Windows accounted for 723 of the fixed flaws, while the Office suite received patches for 222 issues, 111 of which affected Office 2016 specifically. SQL Server products saw 62 CVEs resolved, Developer Tools had 22, SharePoint Server received 16 fixes, Azure had 12, Skype for Business had 10, and Exchange Server accounted for 9. Tenable's list of affected components includes GitHub Copilot and Visual Studio Code, Power Automate, Dynamics 365, Azure Arc, Xbox Gaming Services and dozens of Windows kernel, networking and storage drivers.

Microsoft's VEX statements separate the CVE count from the update count​

On the same day as the record release, Microsoft's Security Response Center (MSRC) said it now publishes Vulnerability Exploitability eXchange statements for all Microsoft-assigned CVEs. VEX is a machine-readable format that tells security tools whether a product is actually affected by a given vulnerability. MSRC went out of its way to say what the change does not do. It said publishing the statements "does not increase the number of security updates customers need to deploy," because many Microsoft updates are cumulative or bundled, so one package can close many vulnerabilities.

That is the key fact behind the "fat Patch Tuesday" argument. Windows uses a rollup model: a Windows 11 25H2 machine gets one monthly cumulative update, not hundreds of separate fixes. According to the patch-analytics firm Senserva, the September 2026 Microsoft Patch Tuesday shipped 60 updates (KB articles) fixing 1,169 CVEs. Senserva's CVE total is higher than anyone else's because it counts more broadly, but the ratio makes the point. The deployable unit is the KB, and on any single machine only a few of them apply.

The Spiceworks piece makes the same point operationally. A device count is not enough "when hundreds of CVEs may map to a few dozen underlying updates." It recommends component-level inventory covering Windows roles, Office versions, SharePoint, Exchange, SQL Server, Hyper-V, Azure Arc, developer tooling and Copilot extensions. That list is the author's suggestion, not a Microsoft checklist. Still, it fits how the Security Update Guide is organised. Microsoft's FAQ says the guide retired the old MS16-style bulletin IDs and now pivots on CVE and KB numbers. It also offers downloadable affected-software spreadsheets and a REST API for pulling release data into your own tools.

One more warning from Microsoft's records: advisory data changes after release. MSRC's September release notes show it revised information on 38 existing vulnerabilities on September 8 alone. If you export the data once on Patch Tuesday and never pull it again, your triage list is out of date by midweek.

Exploited flags and the Exploitability Index beat CVSS scores for September triage​

September shows clearly why severity ratings alone mislead. Both zero-days were rated Important, not Critical. Tenable describes CVE-2026-81963 as an elevation-of-privilege (EoP) bug in the Windows Update Stack where since 2022, seven Windows Update Stack EoP vulnerabilities have been patched across Patch Tuesday releases, but CVE-2026-81963 is the first to have been exploited in the wild as a zero-day. The second, CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC), received a CVSSv3 score of 7.8 and is rated as important. According to Microsoft, this vulnerability was exploited in the wild, making it one of two zero-days addressed in the September Patch Tuesday release. Successful exploitation would allow an attacker to gain SYSTEM level privileges. The Cyber Express reports that both were added to CISA's Known Exploited Vulnerabilities catalog. Splashtop draws the lesson: the ratings reinforce why exploit status should take priority over severity labels alone.

Microsoft's Security Update Guide provides the signals for this. For each CVE it lists impact, severity, CVSS score, a "Publicly Disclosed" flag, an "Exploited" flag, and an Exploitability Index rating for Important and Critical bugs. Tenable's September analysis uses the index's current labels: Exploitation More Likely, Exploitation Less Likely and Exploitation Unlikely. Actively exploited bugs are marked separately. Microsoft's older bulletin guidance said an applicable vulnerability marked "Exploitation Detected" should get the highest priority. The Spiceworks essay repeats that advice.

The Exchange Server bugs show how CVSS alone can steer you wrong. Tenable notes that CVE-2026-69380, an Exchange EoP that could let a low-privilege mailbox user read and send mail as other users, scored CVSSv3 8.1. Yet Microsoft rated it "Exploitation Less Likely." The Windows DNS Server bug CVE-2026-69730 is the opposite case. It is a 9.8 Critical remote code execution (RCE) flaw that an unauthenticated attacker can trigger with a crafted packet, and Microsoft rates it "Exploitation More Likely." Eight other DNS Server RCEs that month carried lower exploitability ratings. The Remote Desktop Services RCE CVE-2026-69525 scored 9.8 and was also rated More Likely.

Exposure is the third factor. CrowdStrike counted at least 17 CVEs across core infrastructure services including Domain Name System (DNS), Dynamic Host Configuration Protocol (DHCP), Microsoft Message Queuing (MSMQ), Network File System (NFS), and Secure Socket Tunneling Protocol (SSTP) VPN that are unauthenticated RCEs reachable over the network. Those are serious only where the role is installed and reachable. A domain controller running DNS belongs in the emergency lane. A laptop fleet with no DNS Server role does not need it at all. Microsoft Defender Vulnerability Management can help with this sorting: it shows exploit availability, association with exploit kits, and an EPSS (Exploit Prediction Scoring System) probability score alongside Microsoft's own ratings.

The September 14 out-of-band fix makes the case for canary rings​

Rolling out in stages is not overcaution. September showed why. Six days after Patch Tuesday, Microsoft's Windows message center said some devices had problems after installing the September security update. On affected machines, host folder shares could be unavailable in Hyper-V-based Linux virtual machines. Remote Desktop Services could stop responding and block new sessions and sign-ins. Some USB Audio Class 1.0 devices could fail in multichannel audio modes. The Windows 11 26H1 known-issues page also lists a problem with some Credential Guard-protected domain accounts.

Microsoft shipped an out-of-band (OOB) update on September 14. For most versions it is a cumulative update, so it includes everything from September 8 and you do not need to install the original first. The KBs are:

Scope differs by version. On Windows 11 26H1, 25H2 and 24H2 the OOB release is itself a security update that installs automatically through Windows Update, Windows Update for Business and WSUS. It fixes CVE-2026-62721, and on 26H1 it also fixes CVE-2026-85921. On Windows 11 23H2 and Windows 10 22H2 (ESU) it is an optional non-security update that someone has to install. Devices enrolled in hotpatch need the September security update installed before they will receive KB5129241 automatically.

This is where Spiceworks' point about canary groups pays off: a pilot group made up only of clean IT laptops "proves very little." The September failures hit RDS session hosts, Hyper-V hosts running Linux guests, and specific audio hardware. Those are the unusual configurations a good canary ring should include.

Autopatch, hotpatch and Cluster-Aware Updating keep a big month from becoming a big outage​

Microsoft's tools already support staged rollouts, and some of those tools are changing right now. The Windows message center says Windows Autopatch is expanding to cover quality updates, supported .NET Framework updates and quick machine recovery updates in one place. Admins can choose automatic or manual approval by update type, set deferrals, pause individual releases and track device-level status. That rollout began September 1 and should reach all tenants by October 15, 2026. Per Microsoft's Autopatch documentation, deferrals for automatically approved quality updates run from 0 to 30 days, and Microsoft recommends automatic approval for security updates. Autopatch groups require at least two rings. Spiceworks argues that at 2026 volumes two is the minimum, and suggests lab, canary, early production, broad production and high-consequence rings, with each step gated on health data rather than elapsed time.

On Windows Server, hotpatching reduces reboots but does not eliminate them. Microsoft's schedule puts a cumulative baseline update, which requires a restart, in January, April, July and October. The two months in between get security hotpatches that normally need no restart. Microsoft warns that security needs can force an unplanned baseline, and a device that is behind on baselines may receive both. Rolling back a bad hotpatch means returning to a working baseline and rebooting. October is a baseline month, so hotpatch-enrolled servers need a restart window for the October 13 release.

For clustered workloads, Cluster-Aware Updating works through failover-cluster nodes one at a time. It drains a node, moves its roles, patches, restarts and moves on. Microsoft says continuously available Hyper-V and SMB workloads can be updated with no client-visible impact, but only when live migration or transparent failover actually works in that configuration. In Azure, Microsoft documents a maximum guest maintenance window of 3 hours 55 minutes for Azure Update Manager. Dynamic scopes can automatically pull matching Azure VMs and Azure Arc-enabled servers into a schedule, so newly built machines don't fall outside the patch program. Spiceworks advises sizing windows by how many machines can download, install, reboot and pass health checks within the time available, and splitting the fleet when that leaves no margin for rollback.

What this means for you: triage exploited flaws first, then run the rings​

Treat September as the new normal, not a one-off to get through. Patch the exploited and exposed flaws within hours or days, and let everything else move through rings gated on health checks. Spiceworks proposes a cadence that is editorial advice, not Microsoft policy, but it fits the September evidence:

1. In the first four hours after the 10:00 a.m. Pacific release, pull MSRC data, flag exploited and publicly disclosed CVEs, and map affected products against your inventory or exposure platform.
2. On days 0–1, apply mitigations and patch lab machines plus a representative canary group that includes VPN clients, unusual hardware and line-of-business apps.
3. On days 1–3, move urgent fixes to a small production ring. Watch boot success, authentication failures, crash telemetry and help-desk volume.
4. On days 3–7, expand by workload and failure domain, and pause automatically when health thresholds are breached.
5. On days 7–14, deploy routine security updates broadly, and chase offline and remote endpoints as a separate compliance task.
6. By day 30, close documented exceptions, confirm compensating controls, and report actual deployment coverage, not approvals.

Splashtop makes a point that fits step 6: sending an update does not prove that every device is protected. Systems may be offline, installations may fail, or endpoints may miss a deployment window. Spiceworks also recommends treating Intune, Configuration Manager, WSUS, Azure Update Manager and automation accounts as privileged systems, with separate admin identities and peer review for fleet-wide releases. That matters more this month, because one of the zero-days sits in the Windows Update Stack.

• If you have not yet deployed September's security update, install the September 14 OOB cumulative update for your version instead. It includes the September 8 fixes and resolves the RDS, Hyper-V and USB audio problems.
• Rank Windows DNS Server, Remote Desktop Services and Kerberos hosts by exposure first, and confirm that CVE-2026-81963 and CVE-2026-85880 are closed on every Windows endpoint.
• Use Microsoft's Exploited flag and Exploitability Index together with your own exposure data. A high CVSS score on a component you don't run, or one rated Exploitation Less Likely, can wait for the normal ring.
• Pull Security Update Guide data through its API or spreadsheets more than once a month, because Microsoft revises CVE entries after release.
• Book reboot windows for October 13: it is a hotpatch baseline month, and memory integrity enablement and AD FS DKM enforcement also begin in October.
• Measure time to patch exploited and internet-facing flaws, plus the age of exceptions. Raw CVE closure counts tell you very little.

Microsoft's own documentation, including the VEX guidance, rollup servicing, Autopatch rings and hotpatch baselines, shows that a thousand-CVE month still reaches each machine as a small number of cumulative updates. The workload that grows is triage and verification, not the number of patch buttons. Teams that automate the mapping and health gates now will be ready for October 13. That release lands on a hotpatch baseline month and on the end of updates for Windows 11 24H2 Home and Pro, with no sign that volumes will drop.