Microsoft ships out-of-band Windows updates to fix September Patch Tuesday bugs

Microsoft published out-of-band cumulative updates for every serviced Windows branch on September 14, 2026, six days after the September Patch Tuesday rollup. The releases repair three regressions that the September 8 updates introduced: Remote Desktop Services instability, host folder shares failing in Hyper-V-based Linux virtual machines, and failures on USB Audio Class 1.0 devices.

An out-of-band update is any fix Microsoft ships outside the monthly Patch Tuesday cadence. These ones are cumulative, which means each supersedes the September 8 rollup for its branch. A machine that never installed the buggy update can take the September 14 one directly and still get the month's security content.

The Windows 11 24H2, 25H2 and 26H1 packages are classified as security updates and install automatically through Windows Update under default policies. Per Microsoft's KB5129195 article, they also include protections for CVE-2026-62721, a Windows User-Mode Power Service elevation of privilege flaw. Windows 11 26H1 gets one more: CVE-2026-85921, a Windows Secure Kernel Mode elevation of privilege issue.

Microsoft shipped a separate package per servicing branch. The ones confirmed in its update history are:

• Windows 11 24H2 and 25H2: KB5129195, builds 26100.9457 and 26200.9457
• Windows 11 26H1: KB5129194, build 28000.2956
• Windows 11 23H2: KB5129242, build 22631.7584
• Windows 10 21H2 and 22H2: KB5129236, builds 19044.7727 and 19045.7727
• Windows Server 2025: KB5129235, build 26100.33451
• Windows Server 2022: KB5129237, build 20348.5631

The underlying RDS known issue reaches further than that list. Microsoft's release health entry marks it as affecting Windows 11 26H1 through 23H2, Windows 10 22H2 and 21H2, the LTSC 2019 and LTSC 2016 branches, and Windows Server from 2012 through 2025. If you run Server 2019 or 2016, check your branch's update history for the matching September 14 package rather than assuming the ones above apply.

Distribution is the usual set: Windows Update, Windows Update for Business, the Microsoft Update Catalog and WSUS.

The Remote Desktop Services fault is the serious one. Per Microsoft's known issue entry, RDS could become unstable after the September update, with RDP connections dropping after several minutes, sign-in failures, and servers hanging at the Remote Desktop Configuration prompt. Management tools went down with it: MMC, the RDS Licensing Diagnoser and File Explorer could stop responding, and the Windows Update page could spin on a loading indicator.

The Hyper-V fault is narrower but awkward. Applications using HCS-managed virtual machines lost Plan9 host folder shares, so folders shared from the Windows host didn't appear in the Linux guest. Microsoft names WSL and Claude Cowork as two affected applications. Standard Hyper-V VMs that don't use Plan9 were never in scope.

The audio fault covers USB Audio Class 1.0 devices only. Symptoms ranged from a Code 10 error in Device Manager to no output at all, unresponsive volume controls and dead sound settings.

Breaking RDS breaks the tool admins use to fix everything else. Reports collected by gHacks on September 13 described Windows Server 2019, 2022 and 2025 hosts running normally for a few hours after patching, then refusing connections, with some machines needing a hard reset to recover.

That left a bad choice. Uninstalling the September update restored Remote Desktop, but it also removed the month's security fixes from a server that terminates user sessions. Keeping the update meant living with an unreliable session host. Microsoft's only documented interim step was a Group Policy mitigation.

This is also the second bruising patch cycle of 2026. January's rollup forced two emergency updates in eight days after it broke shutdown, Remote Desktop sign-in and cloud-backed file access.

Treat this like any expedited cumulative update, with one shortcut: because it supersedes the September 8 rollup, you don't need to stage that release first on machines you deliberately held back.

A reasonable order of operations:

1. Patch RDS session hosts, jump servers and Hyper-V hosts first. They carry the symptoms with the widest blast radius.
2. Pull the package from the Microsoft Update Catalog if you're deploying through WSUS or a third-party RMM rather than waiting on Windows Update for Business rings.
3. Retest what broke: an RDP session through the gateway, the RDS Licensing Diagnoser, and a Plan9 share inside a WSL or HCS-managed Linux VM.
4. Leave USB audio devices for last, since the fix there is only partial.

One detail worth checking before you approve it in WSUS: Windows Report says Windows 11 23H2 and Windows 10 22H2 ESU devices receive this as an optional non-security update rather than an automatic one, which changes how it flows through approval rules. Confirm the classification in your own catalog sync.

The USB audio regression isn't finished. Microsoft states that the out-of-band update resolves the symptoms on devices using 8-channel or 3D audio modes, and that it's still working on the rest. Devices showing a Code 10 error, no output, or dead volume controls are still waiting. Some users restored sound by switching to 2-channel mode, and Microsoft points administrators who need an immediate workaround for the remaining symptoms to Microsoft Support for Business.

Watch for the October rollup to fold all of this in, and for a separate fix covering the remaining audio symptoms.