Microsoft Pushes Six Emergency Fixes After Record Patch Tuesday…

On September 14, 2026, Microsoft released out-of-band updates to address critical regressions introduced by the September 8 Patch Tuesday — the largest in history with 974 CVEs. The fallout breaks Remote Desktop Services, Hyper-V Plan9 file sharing, USB audio, and, for the first time on record, includes an incomplete fix for CVE-2026-62721 that left the vulnerability open for six days.

{"main_topic":"cybersecurity","topics":["microsoft","patch","cve","vulnerability","enterprise"]}

On September 14, 2026, Microsoft released out-of-band updates to address critical regressions introduced by the September 8 Patch Tuesday — the largest in history with 974 CVEs. The regressions affect Remote Desktop Services, Hyper-V Plan9, USB audio, and — for the first time in a documented case — include an incomplete fix for CVE-2026-62721, which remained unpatched for six days after the original fix.

Key Takeaways

Microsoft issued six emergency updates for issues stemming from the September 2026 Patch Tuesday, a historic record with 974 CVEs.
KB5129195 restores RDS, which became unstable with RDP connections failing after a few minutes, but does not resolve persistent USB audio issues or Explorer.exe crashes in enterprise environments.
CVE-2026-62721 (Elevation of Privilege, CVSS 7.8) had an incomplete fix in the Patch Tuesday; the September 14 OOB closes it definitively.
Windows 11 22H2 is out of support and does not receive the update; builds 24H2/25H2 move to 26100.9457 and 26200.9457, while 26H1 moves to 28000.2956.

The RDS Regression: When a Security Patch Blocks Remote Access

On September 8, 2026, Microsoft shipped cumulative updates for 974 CVEs, according to Infosecurity Magazine. On September 11, a health status update confirmed Remote Desktop Services instability: RDP connections failing after a few minutes, sign-in issues, servers stuck on the "Please wait for the Remote Desktop Configuration" message.

The regression was not limited to remote connections. Connected administrative tools — Microsoft Management Console, RDS Licensing Diagnoser, File Explorer, even the Windows Update page — exhibited anomalous behavior. Servers that rely on RDP for daily management found their operational channel compromised by their own patching cycle.

Microsoft acknowledged the problem and provided temporary mitigations via Group Policy, as reported by Infosecurity Magazine citing the official communication: "IT administrators who deployed a temporary mitigation through Group Policy do not need to take any action before installing this OOB update." The alternative was more drastic: uninstalling the Patch Tuesday, which would expose systems to the 974 vulnerabilities it fixed.

The CVE-2026-62721 Anomaly: A Fix That Did Not Close the Gap

Among the September 14 OOB corrections is one that raises questions about pre-release testing. CVE-2026-62721 is an Elevation of Privilege vulnerability in the Windows User-Mode Power Service (UMPS), with a CVSS 7.8 score and vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H per the Microsoft Security Response Center. The official MSRC advisory describes the mechanism: "Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally." The impact is concrete: "An attacker who successfully exploited this vulnerability could gain SYSTEM privileges."

The September 8 Patch Tuesday already included a fix for this vulnerability. However, the MSRC advisory was updated with an explicit notice: "The CVE was updated with links to security updates for Windows 11, version 26H1, 25H2, and 24H2 to address a missed fix. Microsoft recommends installing these updates as soon as possible." Notebookcheck summarized the problem as an incomplete closure: the original patch "did not fully close the vulnerability."

The protection gap lasted six days. No confirmed in-the-wild exploits have emerged — MSRC lists "Exploited No" — but the temporal window existed. For administrators, this means the presence of a KB on a system does not automatically guarantee protection: the actual effectiveness of the fix must be verified.

"In some environments, RDS might become unstable, resulting in RDP connections failing after several minutes, sign-in issues, or servers hanging at 'Please wait for the Remote Desktop Configuration'" — Microsoft health status update, September 11, 2026

Hyper-V Plan9 and USB Audio: The Limits of the Emergency Fix

KB5129195 resolves a second critical issue introduced by the Patch Tuesday: shared folders from a Windows host to Linux virtual machines via Hyper-V's Plan9 protocol did not appear or were inaccessible. Windows Latest documented direct tests confirming the impact on real-world applications: Anthropic's Claude Cowork was disrupted by this bug.

For USB audio, the picture is partial. The issue affects USB Audio Class 1.0 devices in multichannel mode (8-channel, 3D audio): after the Patch Tuesday, Microsoft described precise symptoms in release notes reported by BleepingComputer. "This device cannot start (Code 10). No audio output. Volume controls are unresponsive or remain at zero." KB5129195 resolves the stereo configuration, but multichannel problems persist. NTCompatible confirms the updates "do not resolve all of the USB audio problems." Microsoft is working on an additional fix, with no announced date.

Also unresolved, according to Notebookcheck and Windows Latest: Explorer.exe crashes in enterprise environments with Citrix/FSLogix, File History backup failures, AMD GPU errors. These issues have not received official Microsoft confirmation in the available sources.

What to Do Now

Deploy KB5129195 or equivalents for all supported editions. For Windows 11 24H2/25H2 the package is KB5129195 (builds 26100.9457 and 26200.9457). For Windows 11 26H1 it is KB5129194 (build 28000.2956). For Windows 10 21H2/22H2 it is KB5129236, for Windows 10 1607 it is KB5129239. Windows Server 2019, 2022, 2025 receive updates via the Microsoft Update Catalog, per BleepingComputer.

Verify correct cumulative installation. The OOB overwrites the faulty components but includes all protections from the Patch Tuesday. Microsoft states that "This OOB update is cumulative and includes all improvements and security protections contained in previous Windows updates." There is no need to remove the previous patch.

Remove temporary Group Policy mitigations. If Microsoft's RDS mitigation policies were enabled, they can be disabled after installing the OOB.

Plan post-deployment monitoring for CVE-2026-62721. Verify that systems are actually on the correct build: the September 8 Patch Tuesday alone is not enough. For instances with hotpatch enrollment (25H2 and 24H2), KB5129241 applies the update without a restart.

Record CVE Count, Test Quality, and the Cost of Speed

The September 8 Patch Tuesday fixed 974 vulnerabilities, a figure that includes roughly 611 CVEs specific to consumer editions of Windows 11 24H2/25H2 and 723 for the entire Windows family including servers, according to Windows Latest. The scale of the release highlights a recurring trade-off: Microsoft's ability to process reports accelerated by AI-assisted bug hunting — cited by multiple sources as a factor in the record volume — collides with the depth of regression testing on real-world configurations.

The CVE-2026-62721 case is particularly significant because it is not a new vulnerability discovered in the interim: it is the same flaw whose original fix was insufficient. This is not an error of omission but an error of commission — a patch that arrived but did not close the hole. For CISOs, this shifts the question from "Did we install the KB?" to "Did the KB actually fix the vulnerable component?"

The cycle of six emergency updates in a single week — the total documented by Infosecurity Magazine — measures the operational cost of this acceleration. Windows 11 22H2, out of support, receives no fixes. Users remaining on that version must evaluate an upgrade or accept the risks.

Frequently Asked Questions

Why does CVE-2026-62721 require a second fix?
The MSRC advisory explicitly indicates a "missed fix" in the original September 8 patch. The precise technical mechanism of the residual flaw is not detailed in the available sources.

Can I stay on the September 8 Patch Tuesday if I don't use RDS or Hyper-V?
No: the fix for CVE-2026-62721 is necessary regardless of those services, because the vulnerability affects the Windows User-Mode Power Service, a system component.

Will USB audio be fully resolved?
Microsoft is working on an additional fix for the persistent multichannel issues, but sources do not indicate a release date.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references

Get DeafLetter