Windows 11 KB5124008 Patches Two Exploited Zero-Days in September 2026 Patch Tuesday

KB5124008 is the September 2026 Patch Tuesday cumulative update for Windows 11 versions 24H2 and 25H2. Per Microsoft's release notes dated September 8, 2026, it takes 24H2 to OS build 26100.9445 and 25H2 to 26200.9445.

The package also carries servicing stack update KB5124007, version 26100.9441, which Microsoft says improves the reliability of the update installation process. Devices that already have earlier updates download only the new components.

Other Windows 11 releases get their own packages this month. Version 23H2 receives KB5122880 (build 22621.7582) and version 26H1 receives KB5124012 (build 28000.2954). The 24H2 and 25H2 branches share a servicing base, so both get identical fixes.

The September release fixes two Windows privilege escalation flaws that attackers were already using. CVE-2026-85880 is a heap-based buffer overflow in Advanced Local Procedure Call, the component Windows processes use to talk to each other. CVE-2026-81963 is a link following flaw in the Windows Update Stack.

Both carry a CVSS score of 7.8 and both let a local attacker reach SYSTEM, per Tenable's September 2026 Patch Tuesday analysis. Neither is remotely exploitable on its own, which is exactly why they matter: they turn a phishing foothold or a low-privilege process into full control of the device.

CISA added both CVEs to its Known Exploited Vulnerabilities catalog on September 8, 2026, the day the patches shipped. Reporting from BleepingComputer and Notebookcheck identifies KB5124008 as the package that delivers these fixes to 24H2 and 25H2.

Microsoft lists six quality changes in the KB5124008 release notes, most of them fixes for regressions users have been reporting.

• Custom mouse cursor settings, including pointer style and color, failed to display correctly. Selected options now apply as expected.
• Desktop background and other personalization settings could fail to load, leaving a black wallpaper.
• Microsoft Teams and Microsoft Outlook could close unexpectedly on Arm64-based PCs.
• Morocco Standard Time is adjusted for the country's move to permanent UTC+00:00 on September 20, 2026.
• Remote Desktop audio redirection could stop remote session audio from playing on the local device in some configurations.
• OMA-DM client logging now returns more diagnostic detail for device management server connection problems.

The release also updates four built-in AI components to version 1.2608.951.0: Image Search, Content Extraction, Semantic Analysis and Settings Model. The OMA-DM logging change is the one most likely to save an admin time, since it surfaces more detail when a device fails to reach its management server.

KB5124008 adds what Microsoft calls high confidence device targeting data, widening the set of machines eligible to receive new Secure Boot certificates automatically. This is the continuation of a rollout that has run through most of 2026.

The background matters for planning. Secure Boot certificates used by most Windows devices started expiring in June 2026. Microsoft states that devices which have not yet received the newer certificates will still start normally and will keep installing standard Windows updates, and that certificate delivery continues over the coming months across supported PCs and non-managed business devices.

Managed fleets are a separate track. If you control certificate deployment through your own tooling, this update changes which unmanaged and lightly managed devices Microsoft will reach automatically, not what your managed policy does.

The update installs automatically from Windows Update and Microsoft Update. Standalone packages are on the Microsoft Update Catalog for WSUS import, Configuration Manager deployment, or DISM-based offline servicing.

One detail is easy to miss. If you apply this update as a dynamic update to an existing Windows image, the boot.stl file has to be included in the installation media. Microsoft warns that leaving it out can stop devices from starting from that media and produce error code 0xc0430001. The file is used during Secure Boot validation and must match the version and architecture of the image.

Microsoft recommends the Update WinPE script rather than a manual copy of boot.stl. For Intune-managed devices, an expedite policy under Devices, Windows, Windows Updates, Quality Updates pushes the September release ahead of your normal deferral window.

The October deadline is the item to plan around. Windows 11 version 24H2 Home and Pro editions reach end of updates on October 13, 2026, which is also the next Patch Tuesday. After that date those devices stop receiving fixes for known issues, time zone updates and monthly security updates. Enterprise and Education editions of 24H2 remain supported until October 12, 2027.

The second thing to watch is the scale of the monthly releases themselves. Trackers disagreed on how many CVEs Microsoft fixed in September: Tenable counted 964, BleepingComputer counted 966, and the Zero Day Initiative logged 972 new CVEs. The gap comes from how each counts advisories spanning multiple products. Whichever figure you use, September was the largest Patch Tuesday of the year so far, and testing windows are getting harder to defend.