Critical Advisory: Windows 11 Out-of-Band Security & Stability Update

Applies To: Windows 11, versions 24H2 & 25H2 (OS Builds 26100.9457 & 26200.9457) Classification: Critical / Out-of-Band Cumulative Update

Overview

Microsoft released an emergency Out-of-Band (OOB) cumulative security update, KB5129195, to resolve critical operational regressions introduced by the September 8, 2026 Patch Tuesday update (KB5124008).

In addition to key stability and remote infrastructure fixes, this release delivers essential security mitigations for an elevation of privilege vulnerability in core Windows power management services.

Key Fixes & Improvements

• Remote Desktop Services (RDS) Stability:
• Resolves an issue where session hosts dropped RDP connections after several minutes, failed sign-ins, or caused the RDS Licensing Diagnoser and Microsoft Management Console (MMC) to hang.
• Security Hardening (CVE-2026-62721):
• Addresses an Elevation of Privilege (EoP) flaw in the Windows User-Mode Power Service (UMPS) that could allow local attackers to obtain SYSTEM-level execution rights.
• Hyper-V & WSL Plan9 Folder Sharing:
• Corrects a regression preventing folder and file sharing between host machines and Linux virtual environments (WSL/Hyper-V) via the Plan9 file system protocol.
• Multichannel USB Audio Restoration:
• Restores functionality for USB Audio Class 1.0 hardware that experienced silenced 8-channel or spatial/3D audio streams following the initial September patch.

What IT Leaders & Administrators Should Know

1. Do Not Roll Back KB5124008:
2. If your organization experienced RDS drops or audio inconsistencies after Patch Tuesday, apply KB5129195 immediately rather than rolling back the entire monthly security baseline.
3. Windows Autopatch & Intune Settings:
4. Because this is classified as an Out-of-Band release, certain Windows Autopatch quality policies may flag it as “Awaiting Approval.” IT teams should review release rings to approve deployment across production fleets.
5. Pending Known Issues:
6. Microsoft is actively investigating residual issues not covered by this emergency patch, including specific USB Audio Class 1.0 Code 10 errors and select enterprise profile management freezes. A follow-up standard update is expected in upcoming release rings.

Need Assistance Managing Your Windows Fleet?

As part of TrnDigital’s Managed Modern Workplace & vCIO services, our team actively validates and orchestrates zero-downtime patch rings across Intune, Windows Autopatch, and Azure Arc. Reach out to your TrnDigital account team to verify your environment’s patch compliance.

Source– https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5129195-windows-11-24h2-25h2-security-update