Microsoft emergency Windows updates address RDS failures

Microsoft released a set of out-of-band updates on 14 September 2026 to stop a critical Remote Desktop Services (RDS) regression introduced by the September cumulative roll-out. The regression caused RDP sign-in failures, server lock-outs and UI hangs across MMC, File Explorer and the Windows Update page. Enterprises that rely on remote administration faced a stark choice: operate with a broken console or remain exposed to unpatched vulnerabilities.

What broke and why

The September 2026 cumulative updates (KB5122871 for Server 2025 and KB5122882 for Server 2022) unintentionally altered the RDS kernel driver stack. The change manifested as intermittent connection drops, login loops and, in worst-case scenarios, complete server lock-out. Administrators who uninstalled the September patches restored RDP but also stripped the latest security mitigations, leaving systems vulnerable to known exploits. Microsoft initially issued Group Policy work-arounds, but those mitigations only masked symptoms without fixing the underlying code path.

Microsoft emergency Windows updates by version

The out-of-band releases are:

  • Windows 10 21H2 & 22H2 – KB5129236
  • Windows 11 24H2 & 25H2 – KB5129195
  • Windows 11 26H1 – KB5129194
  • Windows Server 2019 – KB5129238
  • Windows Server 2022 – KB5129237
  • Windows Server 2025 – KB5129235

All patches are distributed through Windows Update, Windows Update for Business, the Microsoft Update Catalog and WSUS where applicable. Server updates are only on the Update Catalog, so on-prem administrators must manually download the CAB files.

Hyper-V and USB-audio side effects

While the primary goal was to stabilize RDS, the same out-of-band builds also address two ancillary regressions:

  1. Hyper-V host-compute service (HCS) bug – Virtual machines that shared host folders with Linux guests via Plan9 saw missing or inaccessible shares. The fix restores folder visibility without requiring a VM reboot.
  2. USB Audio Class 1.0 multichannel glitch – Devices that switch to 8-channel or 3-D audio modes could fail to start, report Code 10 in Device Manager, or produce no sound. The patch restores functionality in these modes, but Microsoft admits that some Class 1.0 devices still exhibit stereo-only behavior.

Immediate actions for IT teams

  1. Deploy the correct KB to every affected endpoint – Use WSUS or SCCM to push the updates; verify installation status in the Windows Update History.
  2. Validate RDP connectivity – After patching, run a quick RDP health check (e.g., qwinsta and query session) on a sample of servers.
  3. Retain September security fixes – Do not roll back the September cumulative updates; the emergency patches are built to coexist with them.
  4. Monitor audio devices – Test critical USB audio hardware in multichannel mode; keep a list of devices that still fail and plan for a future driver update.

Market ripple effects

The outage hit several cloud-hosting providers that expose RDP gateways to customers. Short-term downtime translated into a dip in the market cap rankings for cloud-service-related tokens, as investors reacted to the operational risk. More importantly, the incident underscores the fragility of large-scale patch cycles; enterprises may now demand staggered roll-outs or extended testing windows, a trend that could reshape Microsoft’s Patch Tuesday cadence.

Regulatory and compliance lens

For organizations under GDPR, HIPAA or PCI-DSS, an RDP outage that forces administrators to temporarily disable remote access could be interpreted as a breach of availability controls. Regulators expect documented mitigation steps; the Group Policy work-arounds published by Microsoft provide a defensible interim measure, but they must be logged and reviewed during audits.

Incentives, consequences and risk outlook

Microsoft’s incentive to issue an out-of-band fix is twofold: protect its reputation for enterprise reliability and avoid churn to competing remote-access solutions. The consequence of delayed remediation is lost productivity, potential SLA penalties and heightened exposure to ransomware that exploits RDP. Risks remain for organizations that postpone patching due to change-management fatigue; legacy hardware may encounter compatibility issues with the new driver stack, prompting a need for hardware refresh cycles.

What to watch next

  • Follow-up audio fix – Microsoft has promised a second wave of USB-audio patches within the next month.
  • Server 2025 cumulative update revision – A revised KB5122871 is expected before the end of Q4 2026.
  • Enterprise telemetry – Microsoft will likely publish telemetry on RDS crash rates post-deployment; a sharp decline will confirm the fix’s effectiveness.
  • Patch policy shifts – Watch for announcements on revised Patch Tuesday timelines or optional early-release channels for high-risk regressions.

Trusted source

For the original announcement and technical details, see the report on BleepingComputer: Microsoft releases emergency Windows updates to fix RDS failures.

Which Windows versions need the emergency patch?

All supported Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1) editions, plus Windows Server 2019, 2022 and 2025, must install the corresponding KBs listed above to restore RDS stability.

Can I safely uninstall the September 2026 updates?

Uninstalling the September cumulative updates will bring RDP back online but also removes critical security patches, exposing systems to known vulnerabilities. Microsoft advises applying the out-of-band fixes instead of rolling back.

Do the emergency updates fix all USB-audio issues?

No. The patches address the most common multichannel failure for Class 1.0 devices, but Microsoft acknowledges that some audio problems persist and will be fixed in a later release.

Explore more on this topic