Microsoft October Updates Break Remote Desktop Services

Key Takeaways

• Microsoft issued an out-of-band update on September 14, 2026, to address critical issues stemming from its September 8 security patches.
• The update primarily resolves problems with Remote Desktop Services (RDS), shared folders in Linux virtual machines, and certain USB audio devices.
• Affected systems include various Windows client and server versions.
• The fix also includes security updates for specific Windows 11 versions, addressing elevation-of-privilege vulnerabilities.
• While the update resolves many issues, Microsoft noted that some USB audio problems remain unaddressed.

Microsoft Releases Out-of-Band Update to Address September Patch Issues

Microsoft has deployed an emergency Windows update on September 14, 2026, designed to rectify several critical system malfunctions introduced by its regular September 8 security updates. This immediate release targets disruptions impacting Remote Desktop Services, the functionality of shared folders within Linux virtual machines, and audio issues affecting specific USB devices. Concurrently, select versions of Windows 11 receive additional security enhancements.

This comprehensive update package spans numerous Windows client and server platforms, though installation procedures vary. Standard cumulative update packages incorporate all prior security fixes, while a specialized hotpatch package necessitates the prior installation of the September security update.

Microsoft’s release notes also contain a cautionary statement: the update does not provide a complete resolution for all reported USB audio problems, indicating that some issues may persist for users.

Remote Desktop Services Grapple with Disruption

Among the most significant issues addressed are the widespread failures observed in Remote Desktop Services. Following the deployment of the September security update, numerous systems experienced intermittent RDP connection losses, rejection of sign-in attempts, or became unresponsive during the Remote Desktop configuration process. Further compounding these issues, components such as Microsoft Management Console, RDS Licensing Diagnoser, File Explorer, and the Windows Update page were reported to cease responding. These symptoms align with prior reports detailing disruptions in Windows Server Remote Desktop functionality following the September patches.

Microsoft has clarified that this particular September issue does not extend to Windows 365 or Azure Virtual Desktop environments, offering a clear distinction for administrators troubleshooting remote access problems.

Virtual Machine Shared Folder and USB Audio Fixes

The Hyper-V fix specifically targets applications that manage virtual machines through the Windows Host Compute Service. These applications encountered a peculiar bug where Linux guest operating systems would launch without issue, but host folders shared via Plan9 protocols would fail to display or become inaccessible. Microsoft has identified applications such as Windows Subsystem for Linux and Claude Cowork as being affected. Standard Hyper-V virtual machines that do not rely on Plan9 sharing remain unaffected by this particular vulnerability.

A more focused remedy has been provided for USB Audio Class 1.0 devices. This update restores multichannel audio operation, including support for eight-channel and 3D audio modes. However, Microsoft’s documentation still lists unresolved issues, including Code 10 errors, complete absence of sound, and unresponsive volume controls. Users should temper expectations, as this update does not guarantee a fix for every USB audio-related malfunction.

Windows 11 Security Enhancements

For Windows 11 versions 25H2 and 24H2, the update KB5129195 elevates the operating system builds to 26200.9457 and 26100.9457, respectively. Critically, it also patches CVE-2026-62721, an elevation-of-privilege vulnerability identified within the Windows User-Mode Power Service. Windows 11 version 26H1 receives KB5129194, which brings its build to 28000.2956 and addresses the same vulnerability. Additionally, the 26H1 package includes a fix for CVE-2026-85921, another elevation-of-privilege vulnerability, this time residing in Windows Secure Kernel Mode. These security updates are distinct from the stability improvements provided for Remote Desktop, shared folders, and audio functionality.

Eligible Windows 11 25H2 and 24H2 devices enrolled in Microsoft’s hotpatching program will receive KB5129241. Microsoft indicates that this hotpatch can be applied without requiring a system restart, provided the September security update is already installed.

The security packages for Windows 11 26H1, 25H2, and 24H2 are designed to install automatically via Windows Update, contingent on an organization’s configured business policies. These updates are also accessible through the Microsoft Update Catalog and are synchronized with Windows Server Update Services.

Windows 11 23H2 receives a separate optional KB5129242. Administrators who opt to download standalone packages should adhere strictly to Microsoft’s recommended installation order, ensuring any prerequisite checkpoint updates are applied first.

What You Should Do

• Immediately apply the relevant out-of-band updates to all affected Windows client and server systems.
• For hotpatch-eligible Windows 11 devices, ensure the September security update is installed before applying KB5129241 to facilitate a no-restart installation.
• Administrators managing Windows 11 23H2 should download and apply optional KB5129242, carefully following Microsoft’s prescribed installation order for any prerequisite updates.
• Verify the functionality of Remote Desktop Services, Linux VM shared folders, and critical USB audio devices post-update.
• Be aware that some USB audio issues may persist, as the update does not resolve all reported problems in this category.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.