Microsoft's Record 974-Bug Patch Broke Windows, So It Shipped an Emergency Fix Six Days Later

Microsoft's September 2026 Patch Tuesday was the biggest security update in the company's history. It also broke enough things that Microsoft had to scramble an emergency fix less than a week later.

The original update, KB5124008, shipped September 8 and closed 974 vulnerabilities across Microsoft's product line, according to sec-news.ai, citing figures from The Hacker News. That breaks down to 723 flaws in Windows, 111 in Office, 62 in SQL, and 22 in Developer Tools, with more than 110 rated critical. Including non-Microsoft CVEs, the total hit 999 for the month. Two of the fixed bugs, CVE-2026-85880 and CVE-2026-81963, were already being actively exploited and have been added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, per sec-news.ai. Federal civilian agencies now have until September 22, 2026, to apply the fixes.

Credit for finding the zero-days goes to Volexity, Proofpoint, Airbus Helicopters, and Microsoft's own Threat Intelligence Center, sec-news.ai reported. Nobody has publicly named who was behind the exploitation attempts.

Then the bugs showed up

Bigger patch, bigger mess. According to The Verge and NotebookCheck, the September update broke Remote Desktop Services on affected systems, with connections dropping after a few minutes, sign-in failures, and machines hanging at a "Please wait for the Remote Desktop Configuration" screen. File Explorer, the Microsoft Management Console, and the RDS Licensing Diagnoser could also stop responding.

A second problem hit Hyper-V. Applications running Linux virtual machines that rely on Plan9 folder sharing, including the Windows Subsystem for Linux and Claude Cowork, lost access to shared folders between host and guest, according to thewincentral and undercodenews. Standard Hyper-V VMs that don't use Plan9 sharing weren't affected.

A third bug hit audio. Some USB Audio Class 1.0 devices worked fine in stereo but threw errors, cut signal, or stopped responding to volume controls when switched into 8-channel or 3D multichannel modes, per NotebookCheck.

The fix, and what it doesn't fix

Microsoft released KB5129195 on September 14 for Windows 11 24H2 and 25H2, moving them to builds 26100.9457 and 26200.9457, according to NotebookCheck. A companion update, KB5129194, covers Windows 11 26H1, and KB5129236 covers Windows 10 21H2 and 22H2. The Verge and Daily Guardian reported Microsoft also pushed updates for Windows Server 2025, Windows Server 2022, LTSC versions of Windows 10, and Windows Server 2012 and 2012 R2. Installation takes roughly 10 minutes and usually needs a single restart, though machines with a pending Secure Boot certificate update may reboot more than once, per NotebookCheck.

The emergency update also strengthens protection for CVE-2026-62721, an elevation-of-privilege flaw in the Windows User-Mode Power Service. NotebookCheck reported Microsoft revised its security advisory after determining the original September patch didn't fully close that hole, meaning a local attacker could still potentially gain SYSTEM-level access.

But this isn't a full reset. NotebookCheck and thewincentral both report that some USB Audio Class 1.0 devices may still show a Code 10 error in Device Manager, produce no sound at all, or have volume controls stuck at zero. Graphics driver crashes on some AMD hardware remain unaddressed. Sporadic explorer.exe crashes and File History backup failures from the original update will require a separate future fix, according to NotebookCheck, which also noted that some administrators report secure domain sign-in failures persisting even after installing KB5129195, though Microsoft has not confirmed that as a known issue.

Finding and patching 974 vulnerabilities in one release, including two zero-days already being exploited in the wild, is a genuinely good outcome for security. Nobody should skip that update over the bugs. Undercodenews frames the tension correctly, asking whether Microsoft's increasingly AI-assisted vulnerability discovery process is now producing patches too large and too fast for the company's own regression testing to keep up with. That's a fair question given the record scope of the release, but it's a theory raised by that outlet, not something Microsoft has confirmed.

A pattern, not an isolated incident

This is not a one-off. The Verge and Daily Guardian both note that Microsoft has had to ship emergency out-of-band updates repeatedly in 2026: four in January after a buggy Windows 11 patch, two in March over installation failures and Microsoft account sign-in problems, and one in July to fix an Intel driver issue causing battery drain and performance loss. September makes the fourth emergency cycle this year.

For IT administrators managing large fleets, KB5129195 is rolling out automatically through Windows Update, Windows Update for Business, and WSUS, and is also available manually through the Microsoft Update Catalog, per NotebookCheck. Whether Microsoft slows its patch cadence or tightens pre-release testing before the next monthly cycle remains an open question the company has not addressed publicly.