Affected Systems

Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and Windows 10/11 all versions that applied September 2026 Patch Tuesday updates. Impacts Remote Desktop Services (RDS), RDP connections, MMC, RDS Licensing Diagnoser, and File Explorer.

Exploitation Status

Not a vulnerability; this is a patch-induced operational failure. No exploitation involved. Issue confirmed by Microsoft on September 14, 2026, following widespread admin reports.

Business Impact

RDS becomes unstable after applying September 2026 updates: RDP connections fail after several minutes, sign-in issues occur, servers hang at 'Please wait for the Remote Desktop Configuration'. Existing sessions may not disconnect properly, new connections fail. Management tools (MMC, File Explorer, Windows Update UI) become unresponsive. Critical for organizations relying on RDS/RDP for remote access or virtual desktop infrastructure. Workarounds available but require either applying Group Policy mitigations or rolling back security updates (which removes September security fixes).

Urgency

🔴 Immediate

Recommended Actions

  • Apply Microsoft-provided Group Policy mitigations specific to each Windows version (KB5124012 for 26H1, KB5124008 for 24H2/25H2, KB5122880 for 23H2, KB5122878 for Win10 21H2/22H2, KB5122871 for Server 2025, KB5122882 for Server 2022, KB5122876 for 1809/Server 2019, KB5123099 for 1607/Server 2016, KB5123065 for Server 2012, KB5123066 for Server 2012 R2) found under Computer Configuration > Administrative Templates.
  • For inaccessible VMs, attempt stop/restart of the affected virtual machine to temporarily restore RDS connectivity.
  • If RDS is business-critical and mitigations fail, consider rolling back September 2026 updates on affected systems; document rollback scope and re-evaluate compensating controls for removed security fixes.
  • Monitor Microsoft release health pages for permanent fix availability and plan expedited deployment once released.
  • Test Group Policy mitigations in non-production RDS environments before broad deployment to validate stability.