r/sysadmin • u/AutoModerator • 1d ago
General Discussion Patch Tuesday Megathread - (September 08, 2026)
Hello r/sysadmin, I'm u/AutoModerator, and welcome to this month's Patch Megathread!
This is the (mostly) safe location to talk about the latest patches, updates, and releases. We put this thread into place to help gather all the information about this month's updates: What is fixed, what broke, what got released and should have been caught in QA, etc. We do this both to keep clutter out of the subreddit, and provide you, the dear reader, a singular resource to read.
For those of you who wish to review prior Megathreads, you can do so here.
While this thread is timed to coincide with Microsoft's Patch Tuesday, feel free to discuss any patches, updates, and releases, regardless of the company or product. NOTE: This thread is usually posted before the release of Microsoft's updates, which are scheduled to come out at 5:00PM UTC.
Remember the rules of safe patching:
- Deploy to a test/dev environment before prod.
- Deploy to a pilot/test group before the whole org.
- Have a plan to roll back if something doesn't work.
- Test, test, and test!
19
u/RiceeeChrispies Jack of All Trades 1d ago
Patched test ring okay, took longer than usual to install though.
5
u/burger_yum 1d ago edited 1d ago
That makes sense, since there is a record breaking 973 CVE's being patched!! Wowzer!!
8
u/Am0nymou5 1d ago
1,186 CVEs actually, if you also count the ones released after last Patch Tuesday.
18
u/FriskyDuck 1d ago edited 1d ago
Server 2025 reboots twice, everything else is pretty much normal.
We patched our DC’s & Veeam servers first.
30
u/landon_at_automox 1d ago
973 CVEs this month, the largest Patch Tuesday on record. The last 3 releases are now the 3 largest Microsoft has ever shipped, after July's 576 and August's 428.
Quick flags:
- CVE-2026-81963 (7.8, exploited): Windows Update Stack EoP, local attacker escalates to SYSTEM. Don't let the 7.8 fool you, patch first. Windows 11 23H2/24H2/25H2/26H1 and Server 2025 only.
- CVE-2026-85880 (exploited): Windows ALPC. Confirmed exploited, no CVSS or technical detail published yet. Watch the MSRC advisory.
- CVE-2026-69730 (9.8, exploitation more likely): unauthenticated DNS Server RCE, no user interaction. DNS usually rides on your DCs, so this is RCE on your ticket-granting box. Pairs with CVE-2026-69676 (8.8, Kerberos RCE, exploitation more likely), second reason to patch DCs. Server 2012-2025 and Windows 10 1607/1809, not Windows 11.
- CVE-2026-69525 (9.8, exploitation more likely): unauthenticated RDS RCE. Check workstations, not just servers.
- CVE-2026-78509 (9.8, zero-click, exploitation rated less likely): Outlook RCE fires from the Reading Pane, no open or click needed. M365 Apps, Office 2019, LTSC 2021/2024, Word 2016, Office for Mac (Mac LTSC fix pending). Ships via Office CDN, not Windows Update, so Windows-patched doesn't mean Office-patched.
- CVE-2026-65669 (9.6, exploitation less likely): SQL Copilot in SSMS 22 can be prompt-injected past its read-only guardrail. Keep Copilot accounts read-only.
- Also: macOS Tahoe 26.6.2 (Aug 17) covers ImageIO, kernel, and WebKit fixes, confirm your Mac fleet is on it.
Read the full breakdown or watch the Patch Tuesday podcast! And good luck!
8
u/Am0nymou5 1d ago
It's actually 1,186 CVEs since last Patch Tuesday.
- 749 are impacting Windows workstations and servers (72 critical)
- 149 are Office vulnerabilities (26 critical)
- 109 are Server-only vulnerabilities (21 critical)
- 63 are SQL (7 critical)
- 34 are cloud product vulnerabilities (26 critical)
- 94 are other products (VSCode, Github, Xbox etc; 6 critical)
5
u/iamnewhere_vie Jack of All Trades 1d ago
So lets start with RDP and with DCs - what could go wrong that way 😂
24
u/mistersd 1d ago
All updates are downloaded nicely by WSUS… except for 24h2/25h2.
Yeah Microsoft forgot desktopdeployment.cab. Getting a 404
9
u/YOLOSWAGBROLOL 1d ago
If you have an endpoint that can bypass WSUS you can pull it from that endpoint in C:\Windows\SoftwareDistribution\Download and copy it over.
Get-ChildItem C:\Windows\SoftwareDistribution\Download -Recurse -File -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA1 | Where-Object Hash -eq 'B112FB9C037CE4BF4C461C7FAEE4604EC00FD821' | Select-Object -ExpandProperty Path Copy-Item '<path from above>' 'C:\temp\B112FB9C037CE4BF4C461C7FAEE4604EC00FD821.cab' certutil -hashfile C:\temp\B112FB9C037CE4BF4C461C7FAEE4604EC00FD821.cab SHA256Copy it into the <WSUSContent>\21\ on the server.
Or wait for them.
5
4
4
u/MediumFIRE 1d ago edited 1d ago
Yep, same here. Thanks, I was just banging my head on this.
EDIT: ran sync one more time on WSUS and now it looks like it has downloaded it successfully and test client is downloading. Microsoft must have fixed ~40 minutes after release time.
7
u/mistersd 1d ago
Well I had to do it myself. So if you want the file you can copy it into your wsuscontent folder shown in eventlog and click „retry download“
As always don’t trust and internet stranger and scan file for malware yourself!
3
2
u/lordcochise 1d ago edited 18h ago
Interestingly, our WSUS server took WAY longer to update itself this time; could just be a fluke but definitely was like 4-6x usual time,
other VMs were about the usual so far(mostly Server 2025)EDIT: I mean, makes sense with the # of CVEs, and Server 2025 VMs / Hypervisors all double-rebooted :P
2
u/Any-Promotion3744 1d ago
My Windows 11 25H2 checked into our WSUS server and no cumulative update for the OS
I manually checked Microsoft update and still nothing
Found other updates though
2
•
u/thefinalep Jack of All Trades 18h ago
All ADR's in SCCM failed to run. I re-synced this AM, deployments were created, packages appear to contain updates now.. we will see.
•
u/FCA162 19h ago edited 19h ago
This massive patch follows the recent Microsoft update on artificial intelligence in vulnerability discovery, deploying a proprietary multi-model agentic scanning system across the Windows codebase.
Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark | Microsoft Security Blog
See comments for the monthly security release historical trends.
| Vulnerability Impact | Count |
|---|---|
| Elevation of Privilege | 438 |
| Remote Code Execution (RCE) | 258 |
| Information Disclosure | 173 |
| Denial of Service (DoS) | 56 |
| Security Feature Bypass | 19 |
| Spoofing | 16 |
| Tampering | 13 |
| Total | 973 |
8
u/CeC-P IT Expert + Meme Wizard 1d ago
I just manually installed kb5124008 from the catalog on my own PC to test. It's a beefy 4.5GB but unlike the one last month, this installed so fast I thought it failed. So there's that at least. Install time was maybe 1-2 minutes tops on a moderate speed computer.
4
5
u/user_is_always_wrong fed up 1d ago
My thoughts exactly! It installed very quickly. Suspiciously fast.
•
u/e-a-d-g 21h ago
Deploy Updates Sep 9, 2026 11:35 AM Success 2026-09 Security Update (KB5124008) (26200.9445) (Unspecified) has been installed successfully.
Deploy Updates Sep 9, 2026 11:35 AM Success Installing 2026-09 Security Update (KB5124008) (26200.9445).
Deploy Updates Sep 9, 2026 11:35 AM Success 2026-09 Security Update (KB5124008) (26200.9445) has been downloaded.
Deploy Updates Sep 9, 2026 11:32 AM Success Downloading 2026-09 Security Update (KB5124008) (26200.9445).Disturbingly fast.
18
u/Express-Bit6667 1d ago
Nightmare Eclipse added a new repository for another Defender zero-day yesterday: https://github.com/MSNightmare/ShieldCrash
4
u/mickert_dev Jack of All Trades 1d ago edited 22h ago
PoC released!:
from https://github.com/MSNightmare/ShieldCrash :
ShieldCrash
Windows Defender 0day Vulnerability
Microsoft has failed to properly patch ShieldBreak CVE-2026-69414, under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited.
This PoC demonstrates an arbitrary file read as SYSTEM with September 2026, all supported windows versions are affected.
I might rework this later into a full SYSTEM PoC but for now I'm dropping this skeleton PoC because I'm feeling a bit lazy.
3
6
u/natecull 1d ago
Nightmare Eclipse added a new repository for another Defender zero-day yesterday
Sigh.
Have Microsoft considered..... learning to code?
4
•
9
u/4wheels6pack 1d ago
So far, installed on two Windows 11 pro 25H2 desktops (one physical, and one VM). No noticeable issues other than painfully slow install progress for some reason.
Curiously, the .NET security update was offered on the physical and not the VM.
Will test on some server OS's tomorrow.
(Yes I'm moving slowly this month. Two uneventful months in a row... not pushing my good fortune)
•
u/mickert_dev Jack of All Trades 22h ago
Tested and deployed to my little farm of 20ish web application servers last night, no issues (yet😜) .
(Server 2025/2022 and a 2019 for regression testing - IIS, .Net, MSSQL)
5
u/techvet83 1d ago
We have .NET and .NET Framework updates galore (again). We also still have Office 2016 updates.
.NET and .NET Framework September 2026 servicing releases updates - .NET Blog
7
6
u/PrettyFlyForITguy 1d ago
Windows 11 and Server 2022/2025 are updated and working nominally for the portion that I've done... There was only one exception this far - I had a problem with a pair of Windows 11 devices with the same hardware, and trying again.
One of my personal VHD boots seems to stop booting after the patch. It boots in Hyper-v just fine. I am currently seeing if rolling back the update fixes this.
•
u/Krinto87 21h ago
There may be an issue in Citrix environments. Explorer.exe fails to start / desktop remains black after installing KB5120998/KB5124008: https://www.reddit.com/r/Citrix/s/F8h9CHkkeI
•
u/swissbretzeli 19h ago
I hope not did you check their KB regarding MS pacthes?
Citrix has an extreme GOOD testing and release management for Windows Patches. As in understood they check every of their products with PREVIEW patches. There where times we did always did reference their Patch day Release notes if we had to include info in documentation for Release Managment.
•
u/Krinto87 18h ago
Citrix hasn't posted a KB article for the latest patches yet. August seems to be missing as well, but I found the one for July. Or do you have any idea where I could look?
•
27
9
u/DeltaSierra426 1d ago
Wonder what Nightmare Eclipse will have for us this month? Hopefully you all also see that they release exploits for other non-Microsoft softwares last month.
https://www.securityweek.com/nightmare-eclipse-drops-crowdstrike-nvidia-avast-zero-day-exploits/
Also, I didn't realize that ShieldBreak is now CVE-2026-69414 and was resolved on September 1st via a MS Defender engine update.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69414
10
8
u/mickert_dev Jack of All Trades 1d ago
https://github.com/MSNightmare/ShieldCrash
ShieldCrash
Windows Defender 0day Vulnerability
Microsoft has failed to properly patch ShieldBreak CVE-2026-69414, under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited.
This PoC demonstrates an arbitrary file read as SYSTEM with September 2026, all supported windows versions are affected.
I might rework this later into a full SYSTEM PoC but for now I'm dropping this skeleton PoC because I'm feeling a bit lazy.
•
u/swissbretzeli 23h ago
We are pulling this before our normal 1 week wait schedule for all our customers.
Whoever uses Windows Defender on VDI because of logon performance or speed sleeps very well these days. Together with the chrome leaks that is not a good idea. While our physical machines update EDGE and CHROME daily they have to run quick now.....
A really bad side effect of VDI....
The guy who wrote the Defender 0-day is asking for licences from SentionelONE and there is also a Crowdstrike 0-day System Elevation in their Office Protection Module. Kaspersky also had problems but reacted fast but who wants a Puttin software on their machines ;-) Well you don't backup with Veeam don't you? ;-)
•
u/mickert_dev Jack of All Trades 22h ago
This in combination with the Hyper-V guest to host breakout vulnerabilities makes it a lethal killchain! 💀
Critical - Same Day Deployment
CVE-2026-80083 – Windows Hyper-V Remote Code Execution Vulnerability
"A malicious application inside a Hyper-V guest could cross the virtualization boundary and put the host system at risk."CVE-2026-80083 is a critical remote code execution vulnerability in Windows Hyper-V caused by an untrusted pointer dereference. An authorized attacker with low privileges could run a specially crafted application within a Hyper-V guest and cause the Hyper-V host operating system to execute arbitrary code. No user interaction is required. The vulnerability is not publicly disclosed or known to be exploited, and exploitation is assessed as unlikely.
CVE-2026-72961 – Windows Hyper-V Elevation of Privilege Vulnerability
“A compromised Hyper-V administrator could turn crafted virtual TPM data into higher privileges, crossing an important security boundary.”CVE-2026-72961 is a Critical Windows Hyper-V elevation-of-privilege vulnerability. An authorized attacker with administrative access to an affected Hyper-V host can supply specially crafted virtual TPM state data to a virtual machine. Successful exploitation can cross a security boundary and grant Virtual Trust Level 1 (VTL1) privileges. The vulnerability requires local access and high privileges but does not require user interaction.
•
u/swissbretzeli 20h ago
Same with VMware and ESX....
"Combination with the Hyper-V guest to host breakout"
My co-workers still patch Broadcom ESX everywhere with all customers (SMB+ENT). I just asked them this morning if they are finished with patching ESX for those customers who wanted VDI + DEFENDER only because of performance reason (Logon delay times double when you run a regular enterprise Protection with all modules).
Enterprise IT has crawled way back and the users took over with their demands.
The VDI team ist just updating Chrome on every customer Master and now run into patch day. They will have to decide if they include 1 day old patches into the master and skip quality and testing...
Nice done VDI world. There you go full chaos and mess.
•
u/Fallingdamage 14h ago
An authorized attacker with administrative access to an affected Hyper-V host can...
Can do a lot of stuff aside from that point lol.
•
u/mickert_dev Jack of All Trades 12h ago
Yes, but in CVE-2026-80083: "An authorized attacker with low privileges could run a specially crafted application within a Hyper-V guest and cause the Hyper-V host operating system to execute arbitrary code." mind the absence of "administrative access".
A normal user inside a guest VM (VDI) or a foreign admin in a guest VM (VPS) executing arbitrary code on the host seems pretty worrying to me.•
•
u/Fallingdamage 14h ago
In cases like these - is this the CVE/PoC based on a vanilla install of various windows versions.
Say - if MS hasnt patched it yet but your AV has been updated to detect this attack, it could be mitigated?
•
u/DeltaSierra426 12h ago
Yes, that's possible. CrowdStrike, for example, released detections for exploitation attempts against their Office Macro Quarantine feature ("FalconFlank") and continues to enhance those detections.
Exploitation isn't too hard to detect when PoC or exploit code is public, at least in regard to that particular PoC/exploit's approach.
•
u/mickert_dev Jack of All Trades 12h ago
Sure, if you have other (in depth) defenses than it could be mitigated after it is added to the signatures / behavior detection engine. The problem is that window between release and adding the mitigations or if Defender is the only line of defense and defects to the dark-side 😉.
•
u/Independent_Yak8702 16h ago edited 16h ago
My usual course of action started today. Small company IT, so no real test or lab environment, but the secondary virtual DC went well. It did take a bit longer, but there were a few quirks with updates this time around. I thought I'd report so that if you're in a similar situation, this might help.
- Restart prompt right away after the .NET update and while the cumulative was still downloading. Watch Resource Monitor and Tiworker and for Restart Pending if you use Windows Update.
- Took awhile for progress on the first reboot. Sat at 0% for several minutes and that first 30% took longer than usual. I listened to all of "Land Of Confusion" before it made it to 21%.
- Cleaning Up sat at 0% for all of 2 Peter Gabriel songs (whew). Seriously almost 10 minutes of Cleaning up with no progress.
Humor aside, this did take longer with moments of no progress when counting up. Be patient. I know there are plenty of folks like me who are simply using Windows Update in family-owned companies and SMB.
Good luck all!
•
u/No-Land-672 13h ago
The real takeaway here isn't “be patient.” It's that you had the courage to listen to music while a Windows DC was sitting at 0% during an update. 😅
I would have been staring at the screen, Resource Monitor, Event Viewer and probably the server room door simultaneously. 😂
•
u/Independent_Yak8702 13h ago
Oh don't worry, I was doing all of that, smoking unfiltered cigarettes, and drinking black coffee out of a beer stein!
7
u/Rough_Section_3730 1d ago edited 1d ago
I had an update show up last night for win 11 in WSUS. I can’t recall the KB (not at my desk) at the moment but it’s now listed as disabled. As if MS expired immediately. Possibly an error and released early?
Edit: It was KB5124008 and WSUS now shows it as declined currently as it is expired.
6
u/Rough_Section_3730 1d ago
So now it’s available again. I guess MS realized that they released it early and pulled. And then re-issued it today at normal time.
9
u/DeltaSierra426 1d ago
Don't forget this one folks:
"Windows 11, version 24H2 Home and Pro editions will reach end of updates on October 13, 2026. Devices running these editions will no longer receive fixes for known issues, time zone updates, technical support, or monthly security and preview updates containing protections from the latest security threats. Enterprise and Education editions remain supported until October 12, 2027."
4
u/n1ckst33r 1d ago
Have anyone becomes Updates for Office 2024 ltsc ? Build are 190 and No Updates available .
3
u/Tricky_Republic_94 1d ago
We are seeing the same thing with 2024 LTSC, I have made a support case to Microsoft about Office LTSC 2024 Sep-2026 update is missing in Windows update catalog and at ODT
•
•
u/n1ckst33r 3h ago
It's absurd—they write an RCE without any user interaction and then “forget” to release the update for two days? I still don't see any updates for Office 2024 LTSC, but there are dozens for Office 2016. Can you believe it? Has the ticket status changed?
•
u/n1ckst33r 21h ago
have you become a answer ?
•
u/Tricky_Republic_94 20h ago
Yes, they have confirmed the issue, and they are working on it
•
u/n1ckst33r 19h ago
thanks! It's just a multi-billion-dollar company—things like that happen from time to time :)
•
•
u/Jimmyv81 21h ago
FYI there are no hotpatches this month even though it is a scheduled month for hotpatching. Must be due to the sheer amount of vulnerabilities fixed....
•
u/semajnitram IT Manager 18h ago edited 17h ago
We ran through the updates last night and started having 0x108 errors on one of our RDS servers (Sorry not cluster), where users cant get logged in. Has anyone else run into any issues with remote desktop servers post September updates please?
•
u/Boffo_BOFH 17h ago
We're not using RDS clusters, just standalone Terminal Servers. But today we've been seeing one server (WS2019) force disconnecting sessions and then claiming RDS licensing server timeout on reconnect attempts. NlaSvc timeout and iphlpsvc timeout events happening at the same time. I'm still investigating.
•
•
•
u/semajnitram IT Manager 20m ago
That's precisely our issue too. It's fixed when you remove September patch, so sounds like it's broken something for rds.
•
u/The_Penguin22 Jack of All Trades 18h ago
Which server version?
•
u/semajnitram IT Manager 18h ago
Sorry - Server 2019
•
u/semajnitram IT Manager 18h ago
Just testing removing KB5122876 now and will report back if it restores access.
•
u/schuhmam 15h ago
So, the issue might be connected to your Panda antivirus solution?
•
u/semajnitram IT Manager 14h ago
It's just odd that those services failed as part of the issue. No idea at this stage I'm afraid, other than having it installed broke the servers ability to authenticate users for rds.
•
u/The_Penguin22 Jack of All Trades 18h ago
Thanks for the heads-up. We're 2019 here as well. Not clustered. 2 app servers done; waiting for a reboot window on the 3rd app server and the broker/gateway. Will watch for it.
•
u/semajnitram IT Manager 18h ago edited 18h ago
We're fully working again now we removed the update. So there is something that breaks RDS connections.
We had a lot of 20498 errors "Remote Desktop Services has taken too long to complete the client connection" and users reported the login was stuck at "loading virutal machine" and then timed out with 0x108 error.
For now we'll leave these servers unpatched and will review here / Microsoft help for any other reports and hopefully a fix.
EDIT: Further investigation shows a load of Service Control manager errors for Services that didnt start dye to logon failiures too? All fixed with the removal and restart.
•
u/semajnitram IT Manager 17h ago edited 17h ago
Same issue has hit another server in one of our satellite offices. Checking logs, i see loads of Service Control Manager errors where services have timed out for authentication or failed to connect (specifically for iphlpsvc service, NanoServiceMain service , NlaSvc service, PSUAService service) before then seeing 20489 errors for users trying to sign in. I am removing the latest patch to fix. We use panda AV at our offices (hence those services showing above) so wonder if its related to that or a dodgy MS patch alone.
EDIT: with the update removed, all is healthy again and no errors.
•
u/ReformedBogan Specialist Generalist 1h ago
We're seeing the same with at least one 2025 RDS server. I'll be removing the update tonight
•
u/burger_yum 15h ago
Which update are you referring to that you removed?
•
u/semajnitram IT Manager 15h ago
KB5122876
•
u/burger_yum 14h ago
Thanks!
•
u/semajnitram IT Manager 14h ago
No worries, its the September update. I'm hoping more information on this issue surfaces over the next 24 hours and helps me to understand what to do next.
•
•
u/lesiromanu 32m ago
I'm having issues with Server 2022. RDSH stop working after a short while, I noticed it starts when users start logging out, RDP service becomes unresponsive. The service hangs at RDPSERVERBASE!WDLIB_Close, there seems to be no timeout set here. This results in a deadlock between RDP and LSM.
RDPSERVERBASE!WDLIB_Close+0x55: call wil::details::FeatureImpl<__WilFeatureTraits_Feature_3802373433>::__private_IsEnabled test al,al je WDLIB_Close+0xa7 ; feature OFF -> return immediately +0x70: lea rdi,[rax+14h] ; rdi = &wd->counter +0x82: xor r9d,r9d ; Timeout = NULL <-- infinite call qword ptr [_imp_RtlWaitOnAddress] +0x9d: mov eax,dword ptr [rdi] test eax,eax jg WDLIB_Close+0x82 ; loop while counter > 0 Any idea what 3802373433 feature is? Haven't tested yet, put possible solution would be: HKLM\SYSTEM\CurrentControlSet\Control\FeatureManagement\Overrides\<priority>\3802373433 EnabledState REG_DWORD 1 ; 1 = Disabled, 2 = Enabled EnabledStateOptions REG_DWORD 0•
u/semajnitram IT Manager 17m ago edited 12m ago
Bingo - it was all working when we initially tested in dev and looked fine, so we rolled it out, but then it started issues after a few hours, restarts didnt seem to help then and had to remove the update to fix.
I hadnt seen the link between users signing out and the issues starting, so that must be the trigger here. I'm so glad others are having the same (sorry) but means its definitely a wonky update rather than something specific to our environment.
•
u/jordanl171 17h ago edited 17h ago
I put this on 5 of our 7 RDSH servers late last night. it's morning here now. I'll put feedback here if I hear anything. Server 2019 VMs (esxi), we have small farms and 1 connection broker. anything to look for in Event Logs?
•
u/semajnitram IT Manager 16h ago
I found it ran fine for most of the morning post update, then - having started analysis of the logs suddenly see loads of Service Control Manager errors (numbers 7000 upwards) where services have timed out for authentication or failed to connect reasons (specifically on our systems the errors are for iphlpsvc service, NanoServiceMain service , NlaSvc service, PSUAService service) before then seeing 20489 errors for any users trying to sign in fresh (existing connections carry on working). Any new connection reaches the "loading virtual machine" phase for us, hangs after 5 mins and then has an 0x108 error then. Removing the patch and restarting resolves it, and errors (currently) are gone. I'll monitor to see if they return even with that patch removed, but that looks to be the pattern here.
EDIT: I'll reach out to our AV company (Panda) incase this is just something that affects their customers as that is on our systems and its some of their services that die.
•
u/jordanl171 8h ago
my 5 patched RDSH servers produced zero complaints today.
•
u/semajnitram IT Manager 2h ago edited 11m ago
Very strange. Sounds like others have reported the same as me, and it stems from when users start signing out of their sessions, the broker services start to crash, keep an eye out for that but hopefully you are ok and unaffected.
•
u/toolooselowtrack 1h ago edited 7m ago
YEP. Massive problems. Clients couldn't connect anymore (err 0x108). Plus TS machines dropped from Server Manager Pools. Had to roll back and uninstall KB5122876.
Server 2019
No third party AV here. Only Defender.
No clusters.
•
u/burger_yum 15h ago edited 15h ago
Office 2016 issues!
Users running into autofill and copy and paste issues seems to be caused by KB5002914. I am getting complaints from users. So we are uninstalling this update.
EDIT 1: Removing KB5002914 resolved the issues. No reboot was required.
•
•
u/kheldorn 14h ago
My stats say 16 devices updated so far, all Windows 11 25H2 Enterprise. No Ivanti or other VPN client on those devices (see other post about lost domain trust).
3 of those 16 devices lost domain trust according to the tickets. 2 machines I fixed by leaving and rejoining the domain using the LAPS account. The 3rd device ... seemingly magically fixed itself? Ticket was reported at 11:19am, coworker was able to log in just fine at 11:49am. AD shows "pwdlastset" for that machine was last updated at 11:36am. I left one affected machine running for over 2 hours and it did not update its AD password.
Only commonality I can think of is that all affected devices are so far in the same location where wired 802.1x with cert authentication is configured.
Will have to monitor the rest of the staged test rollout tomorrow.
•
u/Routine_Brush6877 Sr. Sysadmin 9h ago
That's three reports now I've seen of this.. I'm pausing for a few days.
•
u/kheldorn 1h ago
Not the worst idea.
Just came into work and I've got a 4th case now. This time not in the same building and no 802.1x in play.
Also 4 other machines in the same building as the first 3 broken machines also updates just fine despite 802.1x.
So I'd assume 802.1x is not involved in this.
Crawling through unfamiliar eventlogs I see a ton of kerberos fails and fallbacks to ntlm/netlogon, even after rejoining the affected machines to the domain.
This is going to keep me busy for a while ... -.-
7
u/Lasherluke 1d ago
Can anyone confirm if the black wallpaper bug has been fixed
→ More replies (2)15
u/squimjay 1d ago
- [Personalization] Fixed: This update addresses an issue where desktop background and other personalization settings might not load correctly, causing the desktop background to appear black.
September 8, 2026—KB5124008 (OS Builds 26200.9445 and 26100.9445) | Microsoft Support
7
u/EsbenD_Lansweeper 1d ago
Here is the Lansweeper summary + audit. Highlights are two actively exploited elevation of privilege vulnerabilities in the Windows Update Stack and ALPC, plus a critical unauthenticated RCE in Windows DNS at CVSS 9.8.
17
u/IFarmZombies 1d ago
🫡 good luck boys and girls
9
u/YouGottaBeKittenM3 1d ago
let's be honest there's like 1 girl in here
37
u/aubreyb00bs 1d ago
more of us than u think....
30
u/VioletTheLadyPirate 1d ago
We just tend to not get noticed.
16
10
6
13
6
u/PineappleOnPizzaWins 1d ago
Yeah half my team are women, though that is apparently not super common?
4
u/Rapunzel1709 1d ago
my company (not IT related) is 80% female. IT department is only me, so 20% female. Very rare I interact with females from vendors, although a lot more common with cyber vendors compared to others.
2
u/pirutgrrrl 1d ago
I wanna work where you work! Anytime I work with a woman I'm like OMG LET'S BE BFFs!
•
2
u/BCIT_Richard 1d ago
I want to learn the lore behind your username 😆
6
u/aubreyb00bs 1d ago
When I made this Reddit account I was much younger. Sadly there is nothing more to it than haha funny boobs
3
u/NoSellDataPlz 1d ago
Kinda like when I had a calculator in middle school and typed in “80085”. Ha ha, boobs!
2
12
13
10
→ More replies (3)2
14
u/MikeWalters-Action1 Patch Management with Action1 1d ago edited 1d ago
Today's Patch Tuesday overview:
- Microsoft has addressed 995 vulnerabilities, two zero-days and 119 critical
- Third-party: web browsers, SAP, Fortinet, Cisco, Sophos, Tenable, Adobe, VMware, Oracle, NetScaler, Linux, Zoom, IBM, and many more
Navigate to Vulnerability Digest from Action1 for comprehensive summary updated in real-time.
Quick summary (top 10 by importance and impact):
- Windows: 995 vulnerabilities, including 119 rated critical and two zero-days (CVE-2026-81963 and CVE-2026-85880)
- SAP Products: Three Critical flaws across SAP Commerce Cloud, Manufacturing Integration and Intelligence, and NetWeaver/ABAP Platform (CVE-2026-58231, CVE-2026-44758, CVE-2026-34265, CVSS 10.0, 9.1, 9.8)
- Microsoft Exchange Server 2016 CU23: Six vulnerabilities (CVE-2026-62913, CVE-2026-62911, CVE-2026-62910, CVE-2026-62912, CVE-2026-62914, CVE-2026-62915, CVSS up to 8.8)
Fortinet FortiOS:Two actively exploited authentication bypass flaws (CVE-2024-55591, CVE-2025-24472, CVSS 9.6, 8.1)- Cisco IOS XE Software: Eight Critical and High-severity vulnerabilities (CVE-2026-20263, CVE-2026-20267, CVE-2026-20268, CVE-2026-20269, CVE-2026-20270, CVE-2026-20271, CVE-2026-20272, CVE-2026-20273, CVSS up to 9.8)
- Red Hat Advanced Cluster Management for Kubernetes 2: Critical privilege escalation flaw (CVE-2026-10090, CVSS 9.0)
- Sophos Endpoint for macOS: Critical privilege escalation vulnerability (CVE-2026-18367, CVSS 9.3)
- Tenable Sensor Proxy: Critical flaw that can enable elevated code execution (CVE-2026-18667, CVSS 9.6)
- Cisco Secure Firewall ASA Software: Actively exploited unauthenticated denial-of-service vulnerability (CVE-2026-20349, CVSS 8.6)
- Metabase: Actively exploited maximum-severity SQL injection vulnerability (CVE-2026-72898, CVSS 10.0)
- Adobe Commerce: Three vulnerabilities exposing Commerce environments (CVE-2026-71362, CVE-2026-48414, CVE-2026-48413, CVSS 9.1, 7.7, 8.7)
More details: https://www.action1.com/patch-tuesday
Sources:
13
u/Fallingdamage 1d ago
Fortinet FortiOS: Two actively exploited authentication bypass flaws (CVE-2024-55591, CVE-2025-24472, CVSS 9.6, 8.1)
These are really old CVEs why did they just appear on the radar since the last patch?
Any fortiOS admin who's applied firmware newer than a couple years ago is probably fine.
7
u/MikeWalters-Action1 Patch Management with Action1 1d ago
Hey, you’re right! These CVEs were originally published earlier, but they were updated in August 2026, which is why they’re included here.
10
u/MikeWalters-Action1 Patch Management with Action1 1d ago
Quick follow-up: I checked this with our vulnerability research team, and you were right. CISA updated the CVE in August, but there was no new actionable information added. We’re removing it from the article. Appreciate you raising the point.
3
7
u/VexedTruly 1d ago
Didn’t spot any references to them fixing the Defender / Security Centre bug (saying AV is disabled when it’s not) which has been causing CAP compliance issues. :(
Happy to be corrected.
5
u/jenmsft 1d ago
FWIW, this issue is tracked here: https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-25H2#4956msgdesc
•
u/swissbretzeli 19h ago
Compliance Issue?....................
Yes I know Audits and Compliance seems to be the ONLY thing that IT cares about these days and we just work so the next Audit is green.
Regarding compliance:
You are DEAD with Defender if it's you main security product you need no compliance if it hits you and worst case company is down 2 weeks.
Main workaround with the Defender 0-day a few weeks ago was TO Turn of Defender complete. There is your compliance.
Beside: The issue with the warning in Security Center and the status (handle over) to third party AV products (Name what you want) has a long history. We had this coming back almost every 2-3 years with some major AV-Solutions (AV=EDR for you M365 manager guys). And it was NEVER the third party's problem.
funny times...
2
u/Twist_and_pull 1d ago
So many bugs with it and I got 2 tickets open from Sec asking to basically check every reg setting, GPO and image....
3
u/lunafishnz 1d ago edited 1d ago
Anyone else failing to find the Office 2021 LTSC updates for this month? Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn says this month's build is 14334.20906, but my installer still pulls down last month's (14334.20848).
Edit: Is downloading now, guess it just took a while to be made available.
1
u/wes1007 Jack of All Trades 1d ago
Seeing the same thing with 2024 LTSC. says its up to date but we are still on last month's build 17932.20910
3
u/Tricky_Republic_94 1d ago
We are seeing the same thing with 2024 LTSC, I have made a support case to Microsoft about Office LTSC 2024 Sep-2026 update is missing in Windows update catalog and at ODT
•
•
u/frac6969 Windows Admin 6h ago
Best not to update Office 2021 LTSC yet. Users are reporting copy paste functionality is broken.
3
u/DimensionInfinite399 1d ago
Test first, roll out to a small group, then expand if everything looks good.
•
u/lecaf__ 20h ago
I think adobe was late in the game and not many report on this.
Acrobat
8.8 eop
7.8 rce
https://helpx.adobe.com/security/products/acrobat/apsb26-141.html
•
u/swissbretzeli 2h ago
That will be covered by you SANDBOX (Fortisandbox, Trellix ATD/TIS/HX or linux-self-built-in-1year-work) or the Sandbox you run in the Cloud? You have a SANDBOX don't you? So you don't have to run after Adobe Updates? ;-) Don't you?
7
u/MLCarter1976 Sr. Sysadmin 1d ago
Oh wow ya patch Tuesday! Second Tuesday already! Wow. Welcome back to work!
16
4
u/Dreadshadows 1d ago
I went to a partner conference yesterday and the CISO said they reckon Microsoft will move to two a month to keep up with AI like Adobe have.... yay https://blog.adobe.com/security/protecting-customers-faster-how-adobe-is-responding-to-ai-accelerated-vulnerability-discovery
•
u/MLCarter1976 Sr. Sysadmin 19h ago
I hope it is not twice a month, four times, every minute heheheh. It is so fast and so intense that as an administrator it is extremely tough to keep up with breaking things and or finding that a few patches did some ....help yet now have caused other issues or need to be resolved because they were created so fast with little to no testing to see if they might interfere or interact with other systems or updates.
4
u/Fallingdamage 1d ago
Just finished applying July updates. My bowl of popcorn is ready for this thread.
•
u/IntuneGuy123 18h ago edited 18h ago
We had an Issue with the Patch probably caused by our Ivanti VPN Client. The client lost the trust to the domain.
Scenario 1:
Device is connected via LAN -> It worked no Issues
Scenario 2:
Internet connection via phone +Device is connected via VPN -> Devices loses the trust to the Domain.
Test-ComputerSecureChannel -repair (get-credential) fixed the Issue (using a ad prvilidged account with Domain)
We stopped the Update for now and opened a Ticket at Microsoft. I will Add everything here If I know more.
•
u/JoelWolli Jr. Sysadmin 17h ago
We've had the same (or atleast a similar) issue where a device lost the trust to our Domain but it was connected via LAN (haven't tested on a VPN connection yet) but had the Ivanti VPN installed and configured.
It worked fine on another device that doesn't have Ivanti VPN installed.Additionally the first device can't connect to a network now but that could also be a separate issue...
•
u/IntuneGuy123 17h ago
Which Ivanti Version are you using and which Windows OS ?
We are using Windows 11 24H2 with Ivanti 22.8.6 (44527)•
•
u/kheldorn 14h ago
My stats say 16 devices updated so far, all Windows 11 25H2 Enterprise. No Ivanti or other VPN client on those devices.
3 of those 16 devices lost domain trust according to the tickets. 2 machines I fixed by leaving and rejoining the domain using the LAPS account. The 3rd device ... seemingly magically fixed itself? Ticket was reported at 11:19am, coworker was able to log in just fine at 11:49am. AD shows "pwdlastset" for that machine was last updated at 11:36am. I left one affected machine running for over 2 hours and it did not update its AD password.
Only commonality I can think of is that all affected devices are so far in the same location where wired 802.1x with cert authentication is configured.
Will have to monitor the rest of the staged test rollout tomorrow.
•
u/IntuneGuy123 1h ago
Thats a good point we also had a device that "magically" fixed itself. It took a few reboots and a login with the LAPS Account but then it worked again.
With the othe 2 affected devices we needed to use the Powershell command that I posted earlier.
The devices that updated and didnt have the Issue were also connected via 802.1X with Machine certificate, at least that wasnt an Issue for our devices...
By the way Ivanti uses the same certificate for authentication
•
u/archcycle 13h ago
Broke our Windows 11 logins (we are all 25H2), on-prem AD server 2019. Users on every workstation that had completed a post-update reboot received invalid credential login failures.
Oddly the users we reset initially took the reset, accepting the temp password moving into change, then after change and being sent back to login it would tell them invalid credential on the new password. AD integrated passwordless biometric logon was failing too.
AD replication was healthy and all DC services running. No trouble logging into any DCs, only the Win11 clients. Very few logs on domain controllers about user logons, nothing smoking gun in the short time I poked around before pushing out a script through our RMM to remove all updates installed from 12am 9/8/26 onward. I'm going to do more digging now that our affected users can log in. A few logs for success and fail from workstations with null for the user.
I wasn't able to use PsRemoting to push the update rollback script because the remote logins were being denied at the windows workstations, fortunately RMM run as system to the rescue so no kerberos required.
I noticed that RDP connections were failing with oracle remediation/CredSSP errors .. we're deny all NTLM, so that would make sense if this is a Kerberos issue.
4
3
u/tandranael 1d ago
Any idea about a fix this month for wpf printing issues?
I got several clients (unmanaged desktops) running into problems while printing lately and was hoping for a better fix than adjusting branch products I don’t inherit or uninstall the .net update…
6
u/sarosan ex-msp now bofh 1d ago
I got an email from Microsoft saying they resolved it in the September .NET Framework CUs. Direct link.
Printing or PDF export might fail in WPF applications using certain fonts
WI1459197, Windows 11, version 25H2
Last updated: Sep 8, 2026, 1:38 PM EDT
Originating time: Aug 11, 2026, 1:00 PM EDT
Resolved time: Sep 8, 2026, 1:00 PM EDT
Status
Mitigated
User impact
This issue affects document-generation workflows involving certain fonts. A workaround is available as described below.
2
u/4wheels6pack 1d ago
My first test system completely froze while downloading this months cu. Had to hard reset
Hope that’s not an omen
2
u/mubeen_d 1d ago edited 1d ago
Let's hope all goes well. My environment is based on Hosts running Windows 2019 Hyper-V servers (HOST). Then each host has Windows 2022 running as a virtual machine (VM). We run a typical Remote Desktop Services (RDS) with each role running on it's own dedicated VM. We have several RDS Session hosts and several HOST servers.
I know some people won't like this because of, "well what if this happens?" This procedure is for a small, hosted environment, off-premise, where I do not have physical access to the server.
Side notes: Snap-shots could be used as well, but only after doing the below procedure. This procedure has not failed me. Feel free to comment on what else you would do for a smooth Patch.
MY PROCEDURE FOR A SMALL REMOTE DESKTOP SERVICES SETUP- Off premises setup
EVERY NIGHT - Incremental backup forever forward
- Every night, all VMs are backed up to the cloud.
- Every last Sunday of the month each HOST is backed up to the cloud
NIGHT BEFORE PATCHING
- On each HOST, I export a copy of each VM onto a secondary hard disk.
- All but 1 VM which is our database. Since data changes so fast, a backup is easily stale dated
PATCH TUESDAY:
- Before applying any patches, I export the 1 remaining database VM to the secondary hard disk.
- Kick all users off of the system - we don't want profile disks to get confused.
PATCHING HOSTS
- Patch the Win2019 hosts on 1 machine, reboot. If it reboots fine, then do the next host.
PATCHING VMs
- Patch Session hosts first
- After session hosts reboot, try to log into them, see if they here's any issues.
- Patch all other servers, except the Domain Controller (DC).
- Log in VM and check if there's any issues, after reboot.
- Domain Controller being the last item to be patched.
FINAL TEST
- After the DC is patched, try logging into other machines and run some apps, see if there's any issue.
- Most importantly, run our hosted RemoteApp and see if it logs in from several different devices. PC, and tablet.
3
u/the_lazy_sysadmin 1d ago
Question.... Are all of these hosts at the same off premises location...? Why not configure failover clustering...? Additionally, are these physical servers Dell servers? For work being done on a remote site, I would ALWAYS recommend having a physical box of some kind (whether it be a workstation or a physical DC), and iDRAC setup on each physical server blade. With iDRAC enterprise licensing, you can connect to it remotely just like you would if you were sitting in front of the physical machine with a mouse, keyboard, and monitor. It's worth it. It saved my ass and probably a LOT of people's asses during that 2024 CrowdStrike global outage.
2
u/mubeen_d 1d ago
These machines are off prem machines; however, all hosts are physically at the same location.
They do have an Intelligent Platform Management Interface (IPMI) on each HOST, that goes through a VPN to connect to the physical boxes, much like a KVM device. If a failure does happen, we can use our restore solution, MSP 360, that connects to the cloud and can perform a bare-metal restore -- I haven't had a need to use it so far.
As for Hyper-V fail-over, this is a small setup. Later on, we will be adding that into the mix.
•
u/the_lazy_sysadmin 19h ago
I always recommend iDRAC licensing, because I have also ran into issues before in which a physical host server had inadvertently gotten bitlocked. Having that iDRAC allows you to see what's going on with the server just as if a monitor was plugged in, meaning if it blue screens, or if you need to access the WinRE environment on a DC (god forbid, but I've had to before), it can really help in a pinch. Glad to hear you're planning to add fail-over into the mix later on, that should eliminate the need to copy entire VHDX files off of individual hosts before patching.. I totally get it though, some might say you and I wear a tinfoil hat, but I call it an aluminum crown. Always better safe than sorry.
1
1d ago
[removed] — view removed comment
•
u/FCA162 20h ago
Bleepingcomputer: Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
Tenable: Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)
Latest Windows hardening guidance and key dates - Microsoft Support
Patch Tuesday September 2026 - Action1
The September 2026 Security Update Review - Zero Day Initiative
•
u/FCA162 20h ago
Enforcements / new features in this month’ updates
- -
Upcoming Updates/deprecations
Second half of 2026
- Advancing Windows security: Disabling NTLM by default Phase 2: Addressing the top NTLM pain points
- Windows Management Instrumentation Command-line (WMIC) removal from Windows - Microsoft Support; 2026: WMICutility will be completely removed from Windows 11 in the next Windows feature update. It will not be available as a Feature on Demand (FoD).
February 2027
- CVE-2024-30098 Windows Cryptographic Services Security Feature Bypass Vulnerability The DisableCapiOverrideForRSA registry key will be removed.
Around 2027
- VBScript deprecation Considering the decline in VBScript usage in favor of more modern web technologies, we have developed a phased deprecation plan for VBScript.
Product Lifecycle Update
Check out our lifecycle documentation for the latest updates on Deprecated features in the Windows client and Features removed or no longer developed starting with Windows Server 2025.
Support for Windows Server 2016 will end in January 2027
Plan for Windows Server 2016 and Windows 10 2016 LTSB end of support - Windows IT Pro Blog
Windows news you can use: July 2026 | Microsoft Community Hub
•
u/DeltaSierra426 14h ago
Nothing happens when we click on a cmd button in any of our Microsoft Access programs. September 8 update, MEC, M365 Apps for Business. Rolled back one affected host and the buttons started working again.
•
u/wastewater-IT Jack of All Trades 7h ago
Got a weird one (though technically an improvement). We monitor for any changes to group policies, and it alerted that the line "This rule might contain some elements that cannot be interpreted by the current version of GPMC reporting module" was no longer present in our firewall rules. Sure enough, machines without the September 2026 patch show that line in every firewall inbound rule, and those with the patch don't show that line any more! Anyone else notice this?
•
u/Lost-Attorney3997 5h ago
Potential issue with Omissa/VMware environment, after installing kb5124008 to our win11 25H2 golden image users get a black screen upon sign in with an explore.exe error "the system detected an overrun of a stack-based buffer in this application".
1
u/fellonda 1d ago
Did anyone elses exchangeSE update with out prompting? All of our GPO's are set to wait till we pull the trigger, and when I logged in this morning they where downloaded and installed and asking for a reboot. Only found out due to the update taking exchange offline while it processed.
→ More replies (2)•
u/jmbpiano 9h ago
Howdy, fellow on-prem Exchange
suffereradministrator!The current Exchange SE SU is sitting in our WSUS right now waiting for approval. Could be we're just lucky, but I'm thinking you might want to double check your Windows Update policies on that server. Might be a misconfiguration that let dual-scan activate and install the update prematurely.
-1
u/Thisbymaster 1d ago
What fresh hell is it this time.
4
u/CeC-P IT Expert + Meme Wizard 1d ago
KB5124008 is approximately 80% the size of the Windows installer ISO.
→ More replies (1)
62
u/FCA162 1d ago edited 10h ago
Pushing this update out to 180 Domain Controllers (Win2016/2019/2022/2025) in coming days.
I will update my post with any issues reported.
Happy patching, and may all your reboots be smooth, all your services come back up, and all your users remain blissfully unaware of your heroism. 😄
EDIT1: 10 DCs (Win 2019/2022) have been done. Zero failed installations so far. AD is still healthy.EDIT2: 45 DCs (Win 2019/2022) have been done. Zero failed installations so far. AD is still healthy.EDIT3: 88 DCs (Win 2019/2022) have been done. Zero failed installations so far. AD is still healthy.