Microsoft Confirms September 2026 Windows Server Updates Break Remote Desktop Services

On September 8, 2026, Microsoft released its monthly Patch Tuesday security updates. Among them were cumulative updates for Windows Server 2019 (KB5122876), Windows Server 2022 (KB5122882) and Windows Server 2025 (KB5122871). Within days, administrators around the world began reporting that Remote Desktop Services (RDS) session hosts were freezing, that Remote Desktop Protocol (RDP) connections were hanging and that some servers required a hard reset to recover.

Reports first surfaced on Reddit's r/sysadmin community, where multiple administrators independently described the same pattern. Affected hosts typically run normally for a few hours after a reboot before symptoms emerge, most often triggered when a single user session disconnects or reconnects. New RDP connection attempts then hang at 'Connecting...' and never reach the logon screen, generating Event ID 20498 in the TerminalServices-RemoteConnectionManager log. Existing sessions cannot log off cleanly, and tools such as Task Manager, Settings and File Explorer can deadlock because they cannot get a response from the Local Session Manager (LSM).

Microsoft initially said it was aware and investigating. By September 11, 2026, the company had marked the issue 'Mitigated' on its Windows release health dashboard and shipped a Known Issue Rollback (KIR) via Group Policy. The company has not disclosed a root cause, and its documentation does not indicate the behavior results from exploitation or a newly disclosed vulnerability; it is tracked as a reliability regression introduced by the security update. Microsoft is developing a permanent fix for a future Windows update but has not announced a release date.

The timing could hardly be worse. September's Patch Tuesday addressed roughly 973 vulnerabilities, including two zero-days under active exploitation, CVE-2026-81963 in the Windows Update stack and CVE-2026-85880 in Windows ALPC, both in CISA's KEV catalog. The same release patched CVE-2026-69525, a critical Remote Desktop Services remote code execution vulnerability with a CVSS score of 9.8. That means the straightforward remedy, rolling back the update, also removes critical security fixes.

Key Facts

Microsoft confirmed that the September 2026 cumulative updates can destabilize Remote Desktop Services. According to the Windows Server 2025 Release Health Dashboard, 'Some Windows devices with Remote Desktop enabled might experience Remote Desktop Services (RDS) instability.' The linked support article cites update KB5122871 from September 8, 2026 for Windows Server as the cause, but it apparently affects all September 2026 updates that made changes to the Remote Desktop Service. Cybersecurity News reported on September 14 that Microsoft has confirmed its September 2026 Windows security updates can destabilize Remote Desktop Services, potentially disrupting remote administration across a broad range of enterprise endpoints and servers.

The issue is tied to three specific cumulative updates: KB5122876 for Windows Server 2019, KB5122882 for Windows Server 2022, and KB5122871 for Windows Server 2025. On Windows 11 versions 24H2 and 25H2, including OS Build 26100.9445, the equivalent update is KB5124008. Affected client list spans Windows 11 versions 26H1, 25H2, 24H2, and 23H2; Windows 10 versions 22H2 and 21H2; and Windows 10 Enterprise LTSC 2019 and 2016. Affected server editions include Windows Server 2025, 2022, 2019, 2016, 2012 R2, and 2012.

The symptoms are consistent. BleepingComputer reported on September 14 that Windows admins say the September 2026 cumulative updates cause RDS failures on Windows Server 2019, 2022 and 2025, preventing users from connecting and, in some cases, requiring a hard reset to restore functionality. One reader told the outlet: 'All terminal servers in our environment are failing (sessions dropping, no new connections possible, only solution is a hard reset) within a day.' Restarting the server did not resolve the problem, but rolling back the September update did.

Independent debugging points to a deadlock. A Reddit user, u/lesiromanu, did kernel-level debugging on an affected Server 2022 host. The investigation found that the RDP service becomes unresponsive when users begin logging out, hanging at RDPSERVERBASE!WDLIB_Close. According to LazyAdmin, the problem relates to a routine called RDPSERVERBASE!WDLIB_Close invoked during session teardown: when a specific internal feature flag (3802373433) is active, this routine calls RtlWaitOnAddress with no timeout, causing the thread to wait indefinitely. Because LSM serializes session state changes through a single critical section, that stuck thread blocks everything behind it. Microsoft has not confirmed this as the cause.

Microsoft marked the issue as 'Mitigated' on September 11, three days after the September 8 Patch Tuesday release, and released a Known Issue Rollback (KIR) via Group Policy. LazyAdmin reported on September 13 that the registry feature flag workaround described in early guidance had also been reported as unreliable; it failed to prevent the deadlock on at least one Server 2022 21H2 host. The recommended fix is now the official KIR via Group Policy; a DISM rollback is the last resort for already-deadlocked hosts.

Analysis

The bigger picture here is that Microsoft's security update pipeline has a reliability problem that is now directly colliding with its security mission. The September 2026 release was one of the largest in recent memory, fixing roughly 973 vulnerabilities including the critical RDS RCE CVE-2026-69525 with a CVSS score of 9.8. Yet the same update introduced a regression that can take down the very service, Remote Desktop Services, that many organizations rely on for remote administration. Admins are forced into a lose-lose choice: keep the patch and risk unstable servers, or roll back and remain exposed to a critical RCE that is already being discussed publicly.

The technical details matter. The deadlock appears to occur during session teardown, when the RDP server base library calls a routine named RDPSERVERBASE!WDLIB_Close. Because the Local Session Manager serializes session state changes through a single critical section, a thread that waits indefinitely inside that routine can block every subsequent session operation. That explains why a normal restart hangs and only a hard reset recovers the host. It also explains why the registry feature flag workaround proved unreliable: it depends on a feature flag (3802373433) that may not be consistently applied or may not address the underlying timeout. A KIR via Group Policy is a more surgical mitigation because it disables the offending code path without removing the security fixes.

The response timeline is also revealing. The updates shipped on September 8. Microsoft marked the issue 'Mitigated' on September 11 and released the KIR. That is a three-day turnaround, which is fast by historical standards, but it still left administrators in the dark for days. Born's Tech and Windows World reported on September 12 that Microsoft had confirmed the issues on the Windows Server 2025 Release Health dashboard, noting that all versions of Windows are affected and that users are logged out and cannot log back in. BleepingComputer reported on September 14 that Microsoft told the outlet it was aware of the reports and was investigating. The gap between the first reports and clear guidance is the kind of window in which organizations make ad hoc decisions, sometimes rolling back patches they should keep.

What this really means is that the cost of a bad update is no longer measured only in downtime. It is measured in security exposure. When a Patch Tuesday release fixes a CVSS 9.8 RCE in Remote Desktop Services and simultaneously breaks Remote Desktop Services, the security community is forced to choose between two risks. That is a governance problem as much as an engineering one. It also underscores why Known Issue Rollback exists: it is Microsoft's admission that not every regression can be caught before release and that the company needs a way to disable a specific change without forcing a full uninstall. The feature is now doing exactly the job it was designed for.

Why It Matters

For IT teams, the immediate impact is operational. RDS session hosts that freeze within hours of a reboot can strand users, block help desk tickets and force hard resets that interrupt other workloads. The symptoms described by Cybersecurity News on September 13 include RDP connections stuck at 'Connecting...', logged-in users unable to disconnect or log off cleanly, and servers that remain stuck indefinitely at the 'Please wait for the Remote Desktop Configuration' screen. Microsoft also warned that Microsoft Management Console (MMC), RDS Licensing Diagnoser, and File Explorer may stop responding, and the Windows Update settings page can freeze.

The security implications are just as serious. September's Patch Tuesday patched CVE-2026-69525, a critical Remote Desktop Services remote code execution vulnerability with a CVSS score of 9.8, alongside Windows Remote Desktop Client flaw CVE-2026-69485, plus two zero-days already under active exploitation: CVE-2026-81963 in the Windows Update stack and CVE-2026-85880 in Windows ALPC. Both zero-days are in CISA's KEV catalog. Rolling back the September update restores RDS stability but strips those fixes, leaving servers exposed to flaws that attackers are already exploiting in the wild.

The episode also affects a broad range of Windows releases. The affected client list spans Windows 11 versions 26H1, 25H2, 24H2, and 23H2; Windows 10 versions 22H2 and 21H2; and Windows 10 Enterprise LTSC 2019 and 2016. Affected server editions include Windows Server 2025, 2022, 2019, 2016, 2012 R2, and 2012. For organizations that run mixed fleets, the KIR must be deployed carefully, and any host that has already deadlocked may still require a hard reset and a DISM rollback before the KIR can take effect.

Next Up

Microsoft is developing a permanent fix for a future Windows update but has not announced a release date. Until that fix ships, administrators should apply the Known Issue Rollback via Group Policy on affected session hosts, avoid the registry feature flag workaround that proved unreliable, and reserve DISM rollback for hosts that are already deadlocked. Monitoring for Event ID 20498 in the TerminalServices-RemoteConnectionManager log can help identify hosts that are beginning to fail.

The broader question is whether Microsoft will adjust its patch validation process for Remote Desktop Services, which is both a core administrative channel and a frequent target for attackers. The September 2026 episode shows how quickly a reliability regression can become a security trade-off. For now, the company's message is that the issue is mitigated, not fully resolved, and the permanent fix is still pending.