Microsoft’s September 2026 Patch Tuesday closed 964 vulnerabilities, the largest monthly release the company has ever shipped, including a critical Remote Desktop Services flaw Microsoft itself rated more likely to be exploited. Six days later, Microsoft had to ship emergency out of band updates because the same release had broken Remote Desktop Services on the servers it was meant to protect. The sequence is a preview of a problem that patch management as a discipline has not caught up to: security fixes are now large and frequent enough to become their own source of operational risk.
What shipped, and what broke
Among the 104 critical and 860 important fixes in September’s release was CVE-2026-69525, a use after free vulnerability in Remote Desktop Services carrying a CVSS score of 9.8. An attacker who can reach an exposed RDS endpoint can send crafted requests and execute arbitrary code with no authentication and no user interaction required, and Microsoft assessed exploitation as “more likely,” its highest pre-exploitation warning tier. Security vendor Tenable’s analysis of the release also flagged two zero days already under active attack in the same batch: a Windows Update Stack privilege escalation flaw, the first in that component exploited as a zero day since 2022, and a Windows ALPC privilege escalation flaw, the second such ALPC bug exploited since January 2023. Both let an attacker who already has a low privileged foothold reach SYSTEM level access, the kind of second stage bug that turns a single phishing click into full host control.
The cumulative updates carrying those fixes, KB5122882 for Windows Server 2022, KB5122871 for Windows Server 2025, and the equivalent update for Windows Server 2019, introduced a separate defect: Remote Desktop Services itself became unstable after installation, in some cases causing RDP sign-in failures or leaving servers unresponsive. Microsoft’s own out of band update documentation states plainly, “This update addresses an issue affecting Remote Desktop Services (RDS) after installing the September 2026 Windows security update (KB5122882),” and separately warns that “RDS might become unstable, causing RDP connection and sign-in failures or servers to become unresponsive.” Related tools including the Microsoft Management Console, the RDS Licensing Diagnoser, File Explorer, and even the Windows Update page itself could also stop responding on an affected host. Microsoft shipped KB5129237 for Windows Server 2022 and KB5129235 for Windows Server 2025 on September 14, six days after the original release, alongside a fix for a related Hyper-V virtual machine folder sharing failure and a partial fix for a USB audio regression the same update had introduced.
Media Partner
What it means for the security leader
The immediate risk calculus has not changed: CVE-2026-69525 is severe enough, and exploitation likely enough, that the September security update still needs to go on every internet reachable RDS host as fast as change control allows. What has changed is the shape of the decision a patch owner now has to make. A team that deployed the September 8 cumulative update promptly, exactly as security guidance recommends, is the same team that then had RDS instability to firefight on infrastructure it had just patched for a critical remote code execution bug in that exact service. Delaying the original patch to avoid the regression would have left the CVSS 9.8 flaw open longer. There was no clean choice, only a faster or slower path through the same disruption.
That tension is becoming structural rather than occasional. September’s 964 CVEs surpassed the previous monthly record set in July, part of a run of releases this year that have climbed from roughly 400 fixes in an August cycle to nearly 1,000 fixes a month later. A single vendor now routinely ships fixes in the hundreds in one release, and CyberTech has already covered how CISA’s own compliance deadlines are outrunning organizations’ actual patch adoption even before a release introduces a new bug of its own. Volume at that scale means every release carries a nonzero chance of a Microsoft-introduced regression riding alongside the vulnerability fixes it was built to deliver, and testing an update against every dependent Remote Desktop workload before deployment is not something most patch cadences can realistically absorb in the window a 9.8 CVSS score demands.
The same dynamic showed up earlier this year when a separate CVSS 10 flaw in SAP’s kernel forced a similarly urgent patch cycle of its own, described in CyberTech’s earlier coverage. What is new is not any single vendor’s patch quality, it is that a record breaking release size has become the normal case rather than the exception, at the exact moment attackers are moving fastest to weaponize newly disclosed flaws before enterprises finish deploying the fix meant to close them.
What to do
Security teams running Windows Server 2019, 2022, or 2025 with Remote Desktop Services exposed should confirm both the September 8 cumulative update and the September 14 out of band fix for their specific OS build are installed, not just the first; installing only the original release leaves RDS itself unstable, which tends to push frustrated administrators toward workarounds like disabling the very service the critical patch was meant to protect. Where change control cannot move that fast, network level access restrictions to RDS endpoints buy time against CVE-2026-69525 without waiting on either patch cycle, and endpoint monitoring for SYSTEM level privilege escalation attempts helps catch the two zero days even on hosts still mid rollout. Longer term, patch validation processes built around a monthly cadence and a handful of expected fixes need to account for releases an order of magnitude larger, where the update itself is now part of the attack surface being managed, not just the fix for it.
Source: Microsoft Support
