Loading story…
Microsoft's September 2026 cumulative updates are reportedly causing Remote Desktop Services (RDS) session hosts on Windows Server 2019, 2022, and 2025 to hang several hours after deployment or after user logoffs. Affected environments report RDP clients stuck at "Connecting," dropped or stalled sessions, blocked logoffs, unresponsive applications and Task Manager, and reboots requiring hard resets. Reports identify KB5122871 for Windows Server 2025 and KB5122882 for Windows Server 2022; administrators have also observed Event ID 20498 and Winlogon Event ID 6005.
Administrators report that removing the affected cumulative update restores RDS functionality, but doing so also removes September security fixes, including patches for actively exploited zero-days and a critical RDS remote-code-execution vulnerability. Independent debugging has suggested a possible deadlock in RDPSERVERBASE!WDLIB_Close during session teardown, though this remains unconfirmed. Microsoft had not acknowledged the issue, determined a root cause, or published a mitigation at the time of reporting.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft stated that it is aware of reports that the September 2026 Windows Server cumulative updates disrupt Remote Desktop Services and is investigating the issue. It had not confirmed the suspected RDP–Local Session Manager deadlock, provided a remediation timeline, or announced an official workaround.
Administrators reported that removing the September cumulative updates restored RDS functionality, but also removed that month's security fixes; some organizations tested rollback on selected hosts while retaining updated systems as controls. Other reported mitigations included disabling a feature flag associated with audio redirection or forcing RDP to use TCP only, with varying results.
Administrator debugging suggested a possible deadlock involving Remote Desktop and the Local Session Manager at RDPSERVERBASE!WDLIB_Close during session teardown. The suspected condition could queue later session-state operations, though Microsoft had not confirmed it as the cause.
Affected administrators reported TerminalServices-RemoteConnectionManager Event ID 20498 and Winlogon Event ID 6005, indicating delayed RDP connection completion and SessionEnv handling of disconnect notifications. Task Manager, Settings-related functions, and normal restarts could also hang, sometimes requiring a hard reset.
Administrators reported that RDS session hosts running Windows Server 2019, 2022, and 2025 began freezing after the September cumulative updates, often after several hours of operation or a user disconnect or reconnect. New RDP sessions could stall at Connecting or login, while existing sessions could not log off or disconnect cleanly.
Microsoft released September 2026 cumulative updates including KB5122876 for Windows Server 2019, KB5122882 for Windows Server 2022, and KB5122871 for Windows Server 2025. The release reportedly addressed roughly 973 vulnerabilities, including actively exploited CVE-2026-81963 and CVE-2026-85880 and critical RDS RCE flaw CVE-2026-69525.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
ghacks.net
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft’s January 2026 Windows security updates introduced regressions that disrupted enterprise endpoints, including **Remote Desktop authentication failures** affecting access to *Azure Virtual Desktop* and *Windows 365*. After installing `KB5074109` on specific Windows client builds (noted as Builds **26200.7623** and **26100.7623**), users reported repeated credential prompt/sign-in failures in the **Windows App**, preventing successful remote session establishment; Microsoft acknowledged the issue and issued an **out-of-band** update intended to restore normal Remote Desktop connectivity. Separately, Microsoft confirmed another January patch-related issue on Windows 11 23H2 where some systems with **Secure Launch** enabled may **fail to shut down, restart, or hibernate**, leaving devices running and potentially draining batteries. As a workaround, Microsoft advised forcing shutdown via the command: ```cmd shutdown /s /t 0 ``` Microsoft indicated a permanent fix would be delivered in a future update, but did not provide scope/impact metrics for affected devices.
Jun 29, 2026
Microsoft has confirmed that the November 2025 non-security preview update KB5070311 and subsequent patches for Windows 11 (versions 24H2 and 25H2) and Windows Server 2025 are causing RemoteApp connection failures in Azure Virtual Desktop (AVD) environments. This issue primarily impacts enterprise users who rely on RemoteApp to stream individual applications, while full desktop sessions and personal devices running Windows Home or Pro are largely unaffected. The disruption stems from changes to Remote Desktop Protocol (RDP) shell handling introduced by the update, leading to widespread difficulties for organizations dependent on virtualized workloads. To address the problem, Microsoft has provided two main mitigation options: a manual registry edit requiring administrative privileges, and the use of Known Issue Rollback (KIR), which automatically reverts the problematic update for Pro and Enterprise devices. Enterprise administrators managing updates via IT policies can also deploy a targeted Group Policy using a specific MSI package. Microsoft has urged affected organizations to implement these workarounds promptly to restore RemoteApp functionality and minimize operational impact.
Jun 29, 2026
Microsoft disclosed and patched several **remote code execution** vulnerabilities affecting Windows Remote Desktop components, including **Remote Desktop Services** flaws tracked as `CVE-2025-21309`, `CVE-2025-24045`, and `CVE-2024-49123`. The issues were published through the Microsoft Security Response Center update guide and indicate continued security exposure in services commonly used for remote administration and application access across Windows environments. Microsoft also published a related **Windows Remote Desktop Licensing Service** remote code execution vulnerability, `CVE-2024-38263`, expanding the affected surface beyond core Remote Desktop Services. The cluster of advisories highlights the need for organizations to prioritize patching internet-exposed and internally accessible RDS infrastructure, review segmentation around remote access systems, and verify that all Windows servers running Remote Desktop roles and licensing components have the latest security updates applied.
Jul 12, 2026