By Microsoft’s September 2026 Patch Tuesday fixed roughly 966 vulnerabilities, including a no-auth remote code execution flaw in Remote Desktop Services rated CVSS 9.8. It also, within hours of installation, broke Remote Desktop Services on Windows Server 2019, 2022, and 2025. Administrators who applied KB5122876, KB5122882, or KB5122871 came back to find their session hosts frozen, users locked out, and hard resets the only way to restore access. There is a fix — Microsoft released one — but many admins don’t know it exists because Microsoft only told M365 subscribers.
What’s Breaking and How It Fails
The regression lives in the audio-redirection code path modified in this month’s cumulative updates. After installation, servers behave normally — for a while. Then, as users begin logging off RDS session hosts, the service hits a deadlock between the Remote Desktop stack and the Local Session Manager. Debugging traces point to a hang at RDPSERVERBASE!WDLIB_Close. At that point, new connections queue indefinitely, existing sessions can’t disconnect or log off cleanly, and the only way to recover is a hard reset.
Microsoft confirmed the issue on September 11 in its Windows health dashboard: “In some environments, the RDS service may become unstable, which can cause RDP connections to fail after a few minutes, sign-in problems, or servers to get stuck on the ‘Please wait while the Remote Desktop is being configured’ screen.” The problem was first reported on Reddit’s r/sysadmin, where multiple administrators independently described the same failure pattern across entirely different hardware and configurations — a sign this is systemic, not environmental.
Three KB updates are responsible:
- KB5122876 — Windows Server 2019 and Windows 10 1809
- KB5122882 — Windows Server 2022
- KB5122871 — Windows Server 2025
Why Rolling Back Is Not the Answer
The obvious move — uninstall the update, restore RDS — is also the dangerous one. The same package that broke your session hosts contains the patch for CVE-2026-69525, a use-after-free vulnerability in Remote Desktop Services that allows an in-network attacker to execute arbitrary code with no authentication and no user interaction. CVSS 9.8. Microsoft rates it “Exploitation More Likely.” Rolling back patches the service outage and reintroduces a critical RCE in the same breath.
That’s not all. September’s Patch Tuesday also fixed two zero-days under active exploitation: CVE-2026-85880, a heap buffer overflow in Windows ALPC that allows local privilege escalation to SYSTEM, and CVE-2026-81963, a link-following flaw in the Windows Update Stack. Rolling back removes those fixes too. For any RDS host reachable from a network, rollback is not a mitigation — it’s a trade of a service outage for multiple open vulnerabilities.
The Right Fix: Microsoft’s Known Issue Rollback
Microsoft released a Known Issue Rollback (KIR) for this regression. A KIR is different from uninstalling an update — it reverts only the specific non-security behavior change responsible for the regression, leaving the security fixes intact. Your servers get stable RDS back. CVE-2026-69525 stays patched. The zero-days stay patched.
KIR packages are available for the affected builds:
- Windows Server 2022 (KB5122882): rollback ID 260911_18471
- Windows Server 2019 / Windows 10 1809 (KB5122876): rollback ID 260911_18474
Deploy via Group Policy under Computer Configuration > Administrative Templates. Full deployment instructions are in Microsoft’s KIR deployment guide. A restart is required after the policy applies. The reason many admins haven’t done this already: Microsoft initially distributed the KIR notification only to subscribers with M365 or Azure licensing. The downloads are publicly accessible, but the announcement wasn’t. That’s a problem worth naming.
Backup Option: Registry Workaround
If you can’t deploy Group Policy or need something faster, an unofficial registry fix targets the same audio-redirection feature flag the KIR disables:
Key: HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides
Value: 1501792398 (DWORD) = 0Setting that DWORD to 0 disables the faulting code path without removing the patch. This approach has been reported to work in many environments — but it also failed on at least one Server 2022 21H2 host. Treat it as a stopgap while you deploy the KIR, not a permanent fix. LazyAdmin and 4sysops both have step-by-step walkthroughs.
When Rollback Is Actually Acceptable
One scenario qualifies: fully air-gapped servers with zero network exposure to untrusted sources and a controlled environment where you can verify no one can reach the RDS service from outside. In that case, rolling back while you wait for Microsoft to ship a proper fix is a reasonable temporary measure. If there is any doubt about your attack surface, use the KIR.
What to Watch
Microsoft says it is investigating and will share guidance as it becomes available. Watch the BleepingComputer coverage and the Windows release health dashboard for a proper cumulative update that addresses the regression. Until then, the KIR is your best option.
September 2026 Patch Tuesday patched a record number of vulnerabilities. It also handed sysadmins a genuine dilemma: stay patched and lose remote access, or restore access and reopen a CVSS 9.8 hole. The KIR resolves that dilemma. The problem is Microsoft buried the announcement behind a licensing gate. Now you know.
