All posts

Six Days After Patch Tuesday, Microsoft Shipped the Fix for the Fix

September 14, 2026 · Mark Shavlik

Senserva Watch

Join Senserva Watch and get Three Free Unlimited Audits with our full Claude MCP, a fresh audit credit every quarter, alerts when a CVE or KB you follow changes, critical security updates when they land, the Patch Tuesday wire on release day, and 20% off when you buy.

Join Senserva Watch

One email address. No tenant connection, no agent, no call.

September 14, 2026: eleven out-of-band Windows updates, six days after Patch Tuesday, for Remote Desktop, Hyper-V and USB audio; Windows Server is catalog only, the audio fix is partial

Six days after the September 2026 Patch Tuesday, Microsoft shipped a second set of Windows updates to fix what the first set broke. Eleven out-of-band updates landed on September 14, 2026, one per Windows version, for three regressions the September 8 security update introduced: Remote Desktop Services stopping, Hyper-V host folder shares disappearing inside Linux virtual machines, and USB audio devices going silent. This is the story of how a routine Patch Tuesday turned into a week of "please wait" screens, and what to do about it now.

What broke

Microsoft opened the first known issue on Friday, September 11, three days after the release. By the end of that day there were three, all originating from the same cumulative update, KB5124008 on Windows 11 and its siblings on every other supported build.

Remote Desktop Services. In Microsoft's words, "RDS might become unstable, resulting in RDP connections failing after several minutes, sign-in issues, or servers hanging at 'Please wait for the Remote Desktop Configuration'." Microsoft Management Console, the RDS Licensing Diagnoser and File Explorer could hang alongside it, and the Windows Update page could sit on a spinner forever. The affected list is every supported client and every supported server, Windows Server 2012 through Windows Server 2025. For an organization that signs in through Remote Desktop Session Hosts, this is the kind of failure that takes the help desk down with it.

Hyper-V Plan9 shares. Applications that share a Windows host folder into a Linux virtual machine over Plan9 found the share missing after the update. The virtual machine boots, the folder is not there. Microsoft names the Windows Subsystem for Linux and Claude Cowork as two affected applications; ordinary Hyper-V virtual machines that do not use Plan9 are fine. Windows 10 and Windows 11 clients only.

USB Audio Class 1.0 devices. Some USB speakers and headsets stopped working after the update: "This device cannot start (Code 10)" in Device Manager, no audio output, volume controls stuck at zero, or a device that works in stereo and fails in 8-channel or 3D modes. Every supported client and server is on the affected list. Some users found that switching a multichannel device to 2-channel mode brought the sound back.

What Microsoft shipped, and for which Windows

The fix is a full cumulative update for each version, which means it carries everything the September 8 update carried plus the three repairs. Microsoft's release health notice says it plainly: "This OOB update is cumulative and includes all improvements and security protections contained in previous Windows updates." Installing it is not a rollback; it is the September update done right.

  • Windows 11, version 26H1: KB5129194
  • Windows 11, versions 24H2 and 25H2: KB5129195
  • Windows 11, versions 22H2 and 23H2: KB5129241 and KB5129242
  • Windows 10, versions 21H2 and 22H2: KB5129236
  • Windows 10, version 1809, and Windows Server 2019: KB5129238
  • Windows 10, version 1607, and Windows Server 2016: KB5129239
  • Windows Server 2022: KB5129237
  • Windows Server 2025: KB5129235
  • Windows Server 2012 and 2012 R2: KB5129243 and KB5129244. We have no page for these two, because they carry no CVE and Microsoft's security feed does not list them; the links go to Microsoft's own release notes, and the Windows message center notice of September 14 names them alongside the nine above.

The two things to know before you deploy

The Windows Server updates do not arrive on their own. Open the release notes for KB5129237 or KB5129235 and the "How to get this update" table reads Windows Update: No. Windows Update for Business: No. WSUS: No. Microsoft Update Catalog: Yes. The client updates for Windows 10 and Windows 11 are offered through Windows Update automatically. The server ones, which is where Remote Desktop Services actually runs, have to be downloaded from the catalog and installed by hand or pushed through your own tooling. If your Remote Desktop Session Hosts are waiting for Windows Update to bring the fix, they will wait until the October cumulative update.

The audio fix is partial. Microsoft's release health entry for the USB audio issue was updated to "Mitigated", not "Resolved", and the text says why: the out-of-band update "resolves the symptoms experienced on devices using 8-channel or 3D audio modes" and "we are working to address the other symptoms." A headset showing Code 10 or producing no sound at all after the September 8 update may still show Code 10 after this one. Microsoft points administrators who need an immediate workaround at Support for Business.

One more detail that changes how to classify this. Microsoft's release data now lists three of the Windows 11 out-of-band updates, KB5129194, KB5129195 and KB5129241, against CVE-2026-62721, a Windows User-Mode Power Service elevation of privilege vulnerability first published in August. The KB5129195 release notes name the same CVE in their security improvements. On Windows 11, this out-of-band update is a security update, not only a bug fix, and it should be tracked as one. The Windows Server articles are marked non-security.

And if you worked around the Hyper-V issue with the Group Policy mitigation Microsoft offered on September 11, re-enable that policy before installing the out-of-band update; Microsoft's resolution text says the mitigation and the fix do not combine. The Remote Desktop mitigation needs no such step.

What to do this week

  • Remote Desktop hosts first, from the catalog. Download the update for each server build from the Microsoft Update Catalog and install it in the next maintenance window, or sooner if sessions are already dropping. Do not wait for Windows Update on a server.
  • Let the clients take it. Windows 10 and Windows 11 get the update through Windows Update; the restart is the only thing to schedule.
  • Do not uninstall the September 8 update to escape the bugs. That removes the fixes for the two Windows zero-days that were already being exploited on release day, CVE-2026-81963 and CVE-2026-85880. The out-of-band update keeps both fixes and removes the regressions.
  • Expect the audio tickets to continue. If a USB headset still shows Code 10 after the out-of-band update, that is the part Microsoft has not finished. Keep the ticket open and watch the release health page for the rest of the fix.
  • Check that the update actually landed. A catalog download that sits in a folder fixes nothing. Each KB page above carries the copy-paste PowerShell check for whether the update is installed.

Why the timeline matters

The September 8 update was released on a Tuesday. Microsoft acknowledged the Remote Desktop and Hyper-V issues on Friday, September 11, and the audio issue that evening. The fix shipped Monday, September 14, at 10:00 Pacific. Six days, a weekend in the middle, and for three of those days the only official text about the update said it had no known issues. That last part is the one we want to fix on our side.

Our KB pages carry Microsoft's own known-issues section for each update, attributed and linked, and until today they refreshed it once a week. For the September update that meant the "not currently aware of any issues" line stayed on the page through the weekend while Microsoft's own page listed three. As of this post, an update released in the last two weeks has its known-issues text re-read on every refresh, and the site refreshes twice a day again, morning and afternoon US Central, so an afternoon notice from Microsoft is on the page the same day rather than the next morning.

The research behind this page

The September 2026 release page holds the release itself: Microsoft's Severity split, both zero-days, and every one of the 60 update articles, worst first. The Patch Tuesday hub carries the press coverage of the out-of-band update as it arrived and 27 months of releases measured the same way. Each out-of-band KB page linked above shows the builds it applies to, the download link, the known-issues text and the CVEs it carries, and the September 8 KB pages now show the three known issues with the out-of-band fix named in each. What a release looks like when the corrections have landed is the subject of Patch Day 2; this month it took six days.

Get told when this changes, free

This is the third item in six days that a September patch reader needed to know about: the release, the KEV additions two days later, and now the fix for the fix. Senserva Watch tells you when it changes. It is free, it takes one email address, and it covers the CVEs and updates you follow: a new known issue on an update you deployed, an out-of-band fix, a KEV addition with a deadline attached. Members also get three free unlimited audits of the whole Microsoft 365 tenant. And if the question this page leaves you with is which of your servers still have the broken update and which have the fixed one, that is what Siemserva by Senserva answers: your patch state, every device, ranked by what is being exploited.

Sources

Every KB and CVE named above resolves to Microsoft's own release notes or release data as read on September 14, 2026, and every source is on our trusted list. Figures as of September 14; the KB pages update twice a day as Microsoft revises the known-issues text.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.

All posts