Loading story…
Microsoft has confirmed three known issues affecting Windows 11 26H2, which shares its servicing branch with 25H2 and 24H2. A September update can break USB Audio Class 1.0 devices, removing audio input and output and potentially freezing or crashing Sound settings. Enterprise devices using Active Directory and Credential Guard can also fail to sign in when Machine Identity Isolation causes machine accounts to lose their secure channel.
A separate desktop-loading issue, first linked to the August non-security preview update KB5120998, can leave some users at a black screen after sign-in because the desktop session does not automatically load. The issue particularly affects Azure Virtual Desktop hosts using FSLogix profiles and may generate Windows Explorer crashes in the Application event log; Windows Server is not affected. Microsoft has provided Known Issue Rollback Group Policy packages for affected enterprise versions, while users can manually start explorer.exe through Task Manager; it has marked this issue mitigated and is developing a permanent update.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft opened a known issue for black screens and desktop-loading failures after sign-in on affected Windows 11 systems. It documented Windows Explorer crashes as a possible symptom and stated that Windows Server editions are unaffected.
A September 2026 Windows update introduced an issue that can prevent USB Audio Class 1.0 devices from starting or producing audio on Windows 11 24H2 and 25H2, with 26H2 also affected due to the shared servicing branch. Sound settings may become unresponsive or crash while affected users troubleshoot the issue.
The August 2026 non-security preview update KB5120998 introduced an issue that can leave some Windows 11 devices at a black screen after sign-in because the desktop session does not load. It affects versions 24H2, 25H2, and 26H1, particularly Azure Virtual Desktop hosts using FSLogix profiles.
Microsoft identified an issue in which Windows 11 systems using Credential Guard-protected machine accounts can lose their Active Directory secure channel when Machine Identity Isolation enforcement settings are honored. The resulting secure-channel loss can prevent domain users from signing in despite valid credentials.
Microsoft marked the Windows 11 desktop-loading issue as mitigated and released version-specific Known Issue Rollback Group Policy packages for enterprise administrators. Affected users can also manually start explorer.exe through Task Manager while Microsoft develops a permanent fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft confirmed that September Windows 11 security updates **KB5124008** and **KB5124012** can disable USB Audio Class 1.0 devices on Windows 11 24H2 and later systems. Affected devices may fail to start with Device Manager error `Code 10`, produce no sound, and leave volume controls or Sound settings unresponsive; microphones, 3D audio, and multichannel configurations are also affected. Organizations have reported that changing multichannel devices to 2-channel mode can restore service, but Microsoft has not released a permanent fix. KB5124008, which advances Windows 11 25H2 and 24H2 systems to builds 26200.9445 and 26100.9445, respectively, has also been confirmed to disrupt applications using HCS-managed Linux VMs with Plan9 shared folders, including Anthropic Claude Cowork workspace access, and to cause Remote Desktop Services instability. Additional reports cite Explorer crashes or black screens in virtual-desktop and profile-container deployments, File History failures with external drives, and AMD Radeon driver timeouts. Microsoft is investigating the issues; enterprises should test the updates against USB audio, VDI, RDS, Linux VM, backup, and AMD-dependent workflows while weighing mitigations against the updates' security fixes.
Sep 16, 2026
Microsoft confirmed that Windows 11 preview and cumulative updates can leave some users at a black screen after sign-in because the Windows Explorer desktop shell fails to start. The regression predominantly affects Azure Virtual Desktop hosts using FSLogix profile containers, particularly for certain existing user profiles, following the August 27 non-security preview release and later updates. Affected releases include Windows 11 26H1 through `KB5120996` (OS Build 28000.2804) and Windows 11 25H2/24H2 through `KB5120998`. Microsoft has deployed Known Issue Rollback mitigations for enterprise-managed devices and advised users to manually start `explorer.exe` as a temporary workaround; a permanent fix is in development.
Sep 25, 2026
Microsoft’s January 2026 Patch Tuesday release for Windows 11 (notably **KB5074109** for 24H2/25H2) delivered roughly 100+ security fixes (including reported **zero-days**) but also introduced significant reliability regressions. Reported impacts include **system lockups**, **black screens** on systems with Nvidia/AMD GPUs, graphics-related hangs in GPU/DirectX-intensive applications, and application failures such as **Outlook Classic** freezing or failing to launch; additional issues were reported with File Explorer behavior and cloud-backed storage workflows (e.g., OneDrive/Dropbox) causing apps to become unresponsive when saving or syncing data.
Jun 29, 2026