Microsoft has released emergency out-of-band updates to fix a Remote Desktop Services (RDS) failure that its own September 2026 security updates caused on Windows Server. Administrators had reported servers that worked for a few hours and then stopped accepting Remote Desktop connections, in some cases until a hard reset. The fix arrived on Monday, September 14, six days after the faulty updates went out on Patch Tuesday.
What happened
The trouble began after the September 8 Patch Tuesday updates. By September 10, BleepingComputer was reporting that admins on Reddit and in its comments section saw RDS servers fail after a few hours: new Remote Desktop connections hung and then timed out, and existing sessions could not disconnect or log off properly. One administrator who debugged a Windows Server 2022 machine suspected a deadlock between the Remote Desktop service and the Local Session Manager, but Microsoft did not confirm that explanation.
Microsoft told BleepingComputer it was investigating. It then added the problem to its Windows release health page as a known issue (BleepingComputer says Friday, September 11; Microsoft's own change log dates the entry September 12). Microsoft described RDP connections failing after several minutes, sign-in problems, and servers stuck at "Please wait for the Remote Desktop Configuration". It also warned that the Microsoft Management Console, the RDS Licensing Diagnoser, File Explorer and the Windows Update page might stop responding.
Who is affected
Microsoft says the issue affects Windows Server 2012 and later, as well as Windows 10 and Windows 11 devices. It does not affect Windows 365 or Azure Virtual Desktop. Reader reports focused on Server 2019 (KB5122876), Server 2022 (KB5122882) and Server 2025 (KB5122871). This is a reliability bug introduced by the updates, not a newly discovered security hole.
The fix
On September 14 Microsoft released out-of-band cumulative updates. According to BleepingComputer and Microsoft's release notes, they include:
- Windows Server 2025: KB5129235
- Windows Server 2022: KB5129237
- Windows Server 2019: KB5129238
- Windows 11 24H2 and 25H2: KB5129195; Windows 11 26H1: KB5129194
- Windows 10 21H2 and 22H2: KB5129236
The Server updates are available through the Microsoft Update Catalog. Microsoft's later documentation also lists matching updates for Windows Server 2016 (KB5129239) and Windows Server 2012 R2 (KB5129243). Microsoft's Server 2025 notes say the new update can be installed directly and contains the earlier fixes.
The same release addresses a Hyper-V shared-folder problem on Windows 11 and part of a USB audio issue. Microsoft says other USB Audio Class 1.0 symptoms remain unresolved.
Don't confuse it with the RDS security flaw
Microsoft also fixed a genuine Remote Desktop Services vulnerability on September 8: CVE-2026-69475, an elevation of privilege flaw rated Important (CVSS 7.8). It lets a local, authorized attacker gain SYSTEM privileges. Microsoft listed it as not publicly disclosed, not exploited and "Exploitation Less Likely". It is separate from the connection failures described above.
What to do
- Identify servers running RDS roles (Session Host, Gateway, Connection Broker, Licensing) and any server used for RDP administration.
- Install the matching out-of-band update. You do not need to uninstall the September update first, and uninstalling it would also remove that month's security fixes.
- If you cannot deploy yet, Microsoft published Group Policy mitigations for each affected build. For virtual machines you cannot reach over RDP, stopping and restarting the VM may temporarily restore access.
- Pilot the update on a small group of servers before a wide rollout, and watch for new RDP hangs afterward.
Sources
- BleepingComputer: September Windows Server updates break Remote Desktop Services
- BleepingComputer: Microsoft: September updates cause RDS failures on Windows Server
- BleepingComputer: Microsoft releases emergency Windows updates to fix RDS failures
- Microsoft Support: September 14, 2026 - KB5129235 (OS Build 26100.33451) Out-of-band
- Microsoft Support: September 8, 2026 - KB5123066 (Monthly Rollup)
- Microsoft Learn: Troubleshoot Remote Desktop Services instability after September 2026 Windows security updates
- MSRC: CVE-2026-69475 Windows Remote Desktop Services Elevation of Privilege Vulnerability
Related: Microsoft's Rough Month: Record Patches, an Exploited Zero-Day and a Cloud Supply-Chain Attack.
0 Comments