Microsoft's September 8 security update broke Remote Desktop Services on every supported version of Windows, client and server, from Windows Server 2012 to Windows 11 26H1. Six days later, on September 14, Microsoft shipped an emergency update to fix it. That update does not fix the USB audio failure from the same batch, and Microsoft's advice for admins who need audio back now is to open a support case.
The month started with a record. CrowdStrike counted 972 CVEs in the September Patch Tuesday release, more than double August and the largest single month in the history of the program. 113 of them are rated critical. Two were already being exploited: CVE-2026-81963 in the Windows Update stack and CVE-2026-85880, a heap overflow in ALPC. Both let a local attacker escalate privileges. Other trackers put the total between 964 and 997 depending on how they count, but nobody disputes the size.
What broke
Microsoft opened three known issues on September 11, all traced to KB5124008 on Windows 11 and its equivalents on other versions (KB5122871 on Windows Server 2025, KB5122880 on 23H2).
The Remote Desktop one is the bad one. Per Microsoft's release health page, RDS "might become unstable, resulting in RDP connections failing after several minutes, sign-in issues, or servers hanging at 'Please wait for the Remote Desktop Configuration'." MMC, the RDS Licensing Diagnoser, File Explorer, and the Windows Update settings page can hang with it, which means the machine you're trying to fix can't tell you whether the fix installed. The affected platforms list is the whole supported catalog: Windows 10 21H2 through Windows 11 26H1, the LTSC 2016 and 2019 builds, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.
The second issue is USB audio. USB Audio Class 1.0 devices fail to start after the update with "This device cannot start (Code 10)" in Device Manager, or they start and produce nothing. Volume controls stick at zero. Sound settings hang. Some devices work in stereo and die in 8-channel or 3D modes. Same platform list as RDS, servers included.
The third is Plan9 host folder shares in Linux VMs managed through HCS. Folders shared from the Windows host stop appearing in the guest. Microsoft names WSL and Claude Cowork as affected apps. Standard Hyper-V VMs that don't use Plan9 are fine.
Then there is Excel. The KB5002914 security update for Excel, released the same day, breaks paste in Excel 2016, 2019, 2021, and 2024. You copy a range, you paste, and nothing happens. No beep, no error, the source stays selected and the destination stays empty. BleepingComputer reports Microsoft has confirmed it and has no hotfix date as of September 15. Paste Special with Values works. Uninstalling the update works. Regular paste does not.
The fix for the fix
KB5129195 landed on September 14 for Windows 11 24H2 and 25H2, moving the builds to 26100.9457 and 26200.9457. KB5129235 is the Server 2025 equivalent. Microsoft calls it an out-of-band update and lists four changes: the RDS fix, the Plan9 fix, the multichannel audio fix, and a new security fix for CVE-2026-62721, an elevation of privilege bug in the User-Mode Power Service. It's cumulative, so installing it also installs everything from September 8. It comes down through Windows Update automatically, through Windows Update for Business on your normal policy, through the Update Catalog as a standalone MSU, and through WSUS if you sync the Windows 11 Security Updates classification.
The audio fix is partial. Microsoft's exact wording is that the update "resolves the symptoms experienced on devices using 8-channel or 3D audio modes" and that they are "working to address the other symptoms." The other symptoms are the Code 10 error and the devices that produce no sound at all, which is most of the complaints. For those, the release health page says admins "should contact Microsoft Support for Business for assistance." No timeline.
Two details for admins who used the interim Group Policy mitigations. For the RDS issue, you can install the emergency update without touching the policy. For the Plan9 issue, you have to re-enable the policy first, then install, then reboot. Microsoft added that note to the resolution section on September 14.
Windows Latest has a longer list of reported problems Microsoft has not confirmed: File History no longer detecting external backup drives, explorer.exe crashes in environments running Citrix UPM, FSLogix, Horizon, or ProfileUnity, and AMD Radeon driver timeouts with black screens. None of those are on the release health page and none are in the emergency update. Treat them as unconfirmed, but if you run FSLogix on RDS hosts, you have two reasons to test before you roll this out.
Twenty-two years of Patch Tuesday and this still happens
I've run Windows servers through a lot of update cycles. The pattern here is the one that always hurts: the bug is in the thing you use to get to the box. When RDS hangs on "Please wait for the Remote Desktop Configuration," you're working from the console or the hypervisor. If you patched a fleet on Tuesday night and RDP started dropping Wednesday morning, every one of those hosts became a manual job.
972 CVEs in one release is two or three normal quarters landing on a single Tuesday, tested on the same schedule as any other month. The RDS regression showed up in the field within three days. Microsoft's own testing didn't catch that Remote Desktop Services stops accepting connections after a few minutes on Windows Server, which is about the most common Windows Server workload there is.
The zero-days make the usual advice, wait a week and let someone else find the bugs, harder to follow. Both are local privilege escalation, so they need a foothold first. On a server that isn't running untrusted code, a week's delay on the September 8 update was the right call, and anyone who took it can now go straight to the September 14 cumulative and skip the broken build. On shared hosts and terminal servers, anywhere users run their own code, you were stuck choosing between an exploited kernel bug and a broken RDP stack. That's a choice Microsoft's QA should have made unnecessary.
Practical steps, in order:
- Check whether your RDS hosts already got KB5124008 or KB5122871. If they did and RDP is flaky, install the emergency update from the console. Don't wait for Windows Update to offer it. Pull the MSU from the Catalog.
- If you used the RDS Group Policy workaround, leave it alone and patch. If you used the Plan9 one, re-enable the policy first.
- Hold the Excel KB5002914 update on any machine where paste matters. That's every machine with Excel. There's no fix.
- If you have USB audio devices on Windows and they're dead, the emergency update helps only if they were failing in multichannel mode. Otherwise open a case or roll back.
Windows 11 24H2 Home and Pro leave support on October 13, which is also October's Patch Tuesday. My guess is that October's CVE count is a third of September's and that the Code 10 audio bug gets its real fix in that release, not before. If Microsoft ships a second emergency update before then, it'll be for the FSLogix crashes.
