Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
Key Takeaways
- Microsoft has pinned the RDS instability to KB5124008 on Windows 11 24H2/25H2 (OS Build 26100.9445) and equivalent September updates on other releases.
- Microsoft marked the issue “Mitigated” on September 11 — three days after the September 8 Patch Tuesday release — but has not disclosed a root cause or shipped a permanent fix.
- The affected list is wide: Windows 11 23H2 through 26H1, Windows 10 21H2/22H2 and LTSC 2016/2019, plus Windows Server 2012 through 2025.
What’s New Since Our Last Update
We covered the initial reports of RDS breaking after September’s Patch Tuesday last week. Since then, Microsoft has confirmed more specifics: the instability traces back to KB5124008 on Windows 11 versions 24H2 and 25H2, specifically OS Build 26100.9445, with equivalent September security updates causing the same behavior on other affected Windows releases.
Microsoft’s Windows release health dashboard now lists the issue as “Mitigated” as of September 11 — three days after the September 8 Patch Tuesday release that introduced it. Importantly, “mitigated” doesn’t mean “fixed”: Microsoft has not disclosed a root cause, and there’s still no permanent resolution or announced release date for one.
Not a Vulnerability — A Reliability Regression
Worth noting for anyone triaging this alongside actual security incidents: Microsoft’s documentation gives no indication this results from exploitation or a newly disclosed vulnerability. It’s being tracked purely as a reliability regression introduced by the security update itself — the fix broke something unrelated to what it was patching.
Full Affected Version List
This is broader than initial reports suggested. If you manage a mixed environment, assume you’re in scope unless you’ve confirmed otherwise:
| Client OS | Server OS |
|---|---|
| Windows 11 26H1, 25H2, 24H2, 23H2 | Windows Server 2025 |
| Windows 10 22H2, 21H2 | Windows Server 2022, 2019, 2016 |
| Windows 10 Enterprise LTSC 2019 & 2016 | Windows Server 2012 R2, 2012 |
Because uninstalling a security update would also remove its protections, administrators should avoid broad rollback decisions without assessing exposure, operational impact, and Microsoft’s available mitigation for their environment.
— Cyber Security News, citing Microsoft’s guidance
Updated Guidance for Admins
The recovery step Microsoft is currently pointing to is narrower and less disruptive than a full update uninstall, especially for virtualized environments:
Practical Steps
- Stop/deallocate, don’t just reboot, affected VMs. For VMs that become unreachable over RDP, a full stop-and-restart (deallocation, not a simple in-guest reboot) has restored connectivity — but treat it as temporary, since the instability can return.
- Keep an out-of-band management path. Before touching anything, confirm you have an alternate way in — a cloud console or hypervisor interface — in case RDP becomes your only route to a box that then locks you out.
- Test KB5124008 against RDS-critical systems first. Specifically validate session hosts, licensing servers, and jump servers before deploying September’s update more broadly.
- Don’t roll back reflexively. Uninstalling the update removes its security protections along with the bug — weigh that tradeoff deliberately rather than defaulting to rollback across the fleet.
- Escalate if you’re blocked now. Microsoft says admins needing an immediate workaround can contact Microsoft Support for Business rather than waiting on the public fix timeline.
Bottom Line
“Mitigated” status three days after release is faster than some Patch Tuesday regressions get addressed, but it’s not the same as resolved — Microsoft still hasn’t published a root cause or a fix date. Until then, the stop/deallocate-and-restart workaround is your best lever for VMs, and a full update uninstall should stay a last resort given the security tradeoff it carries.
Source: Cyber Security News, “Microsoft Confirms Remote Desktop Services Might Stop Working Following Sept. 2026 Security Update,” published September 14, 2026.
