RDS can stop responding after the September 2026 update

If you run Remote Desktop Services — session hosts, an RD Gateway, or an RDP-reachable admin jump box — the September 2026 Windows security update is worth reading before you finish rolling it out. Microsoft has confirmed a known issue: RDS may become unstable, with RDP failing after several minutes, sign-in issues, or servers hanging at "Please wait for the Remote Desktop Configuration". MMC, the RDS Licensing Diagnoser, and File Explorer can also stop responding, and Windows Update can hang on a loading indicator.

Microsoft opened the issue September 11, 2026 at 11:19 AM Pacific, updated it that day at 7:20 PM Pacific, and as of September 13, 2026 lists it Mitigated — not Resolved. The timing complicates the obvious response: the September 2026 update cycle also closes two Windows privilege-escalation CVEs — one per version — which CISA added to its KEV catalog on September 8, 2026, the day the update shipped, and which Microsoft marks as having exploitation detected. Holding the update back is not free.

What Microsoft's known issue actually says

Microsoft's release health page describes the problem in its own words: "After installing the September 2026 Windows security update (KB…), some organizations might experience issues with Remote Desktop Services (RDS). In some environments, RDS might become unstable, resulting in RDP connections failing after several minutes, sign-in issues, or servers hanging at 'Please wait for the Remote Desktop Configuration'. Related tools, including Microsoft Management Console (MMC), RDS Licensing Diagnoser, and File Explorer might also become unresponsive. Additionally, the Windows Update page might stop responding and continuously display a loading indicator."

Affected platforms, per Microsoft:

• Client: Windows 11, version 26H1; Windows 11, version 25H2; Windows 11, version 24H2; Windows 11, version 23H2; Windows 10, version 22H2; Windows 10, version 21H2; Windows 10 Enterprise LTSC 2019; Windows 10 Enterprise LTSC 2016
• Server: Windows Server 2025; Windows Server 2022; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012

The list runs from Windows Server 2012 through 2025 and Windows 10 through Windows 11 26H1.

Every server version has its own KB — this table is the point of this post

KB5124008 is the Windows 11 24H2/25H2 package. If you administer Windows Server, your originating KB is a different number. Each row comes from that version's release health page; every originating update is dated 2026-09-08:

Why this isn't a reason to skip the update

The same update cycle also closes two Windows privilege-escalation CVEs CISA added to its KEV catalog that date — CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows ALPC) — each closed by a different subset of the KBs above, not both by every update. Microsoft's guide marks both "Exploitation Detected." KEV publishes no CVSS score, and its due dates bind federal civilian agencies, not private companies — but confirmed exploitation is worth patching regardless. We cover the broader "patch, then assume compromise" posture in our standing KEV piece. Uninstalling a version's update to dodge the RDS symptom trades a regression with a VM-only workaround for reopening the CVE that update closed.

The status is Mitigated, not Resolved

Microsoft's own label for this issue is Mitigated. The page doesn't define that term, so we won't guess at it — the status shown is Mitigated, not Resolved, and Microsoft's next step is only that it is "working to release a resolution in a future Windows update and will provide more information when available." No fix version or date is published as of September 13, 2026. Treat "Mitigated" as "still active, watch this page," not "handled."

The workaround, and where it doesn't reach

Microsoft's published workaround is narrow: "If a virtual machine becomes inaccessible through RDP, customers may be able to temporarily restore connectivity by stopping (deallocating) and restarting the affected virtual machine." That's written for VMs — Microsoft did not say this about physical hosts. If a physical RDS host hangs, you're on console or out-of-band access, not a documented Microsoft workaround.

Our advice: stage the rollout, don't stand it down

For RDS session hosts, RD Gateways, or RDP-reachable jump hosts, the right response is a controlled sequence, not all-at-once or held-back-everywhere. This part is our judgment, not Microsoft's:

• Pilot ring first. Patch a small, non-critical group per the KB table above and watch for the symptoms above before expanding.
• Check the release health entry before each ring — check whether the status has moved to Resolved (and a fix KB is named), and whether a new symptom has been added.
• Keep console or out-of-band access to RDS hosts during the rollout; a hang at the RDP layer means you need a path in that doesn't depend on RDP.
• Know the VM workaround's scope before you need it — Microsoft's fix for a hung VM is stopping (deallocating) and restarting it; plan a separate console-based path for anything physical.

Related reading

• The broader framework for patching an actively exploited CVE: CISA KEV: patch, then assume compromise.
• If your RDS hosts are still on Windows Server 2019: Windows Server 2019 end of support in 2026.
• If any are on Windows Server 2016: Windows Server 2016 end of support: ESU or modernize?.

Sources

• Microsoft — Windows Server 2025 release health
• Microsoft — Windows Server 2022 release health
• Microsoft — Windows 10 1809 and Windows Server 2019 release health
• Microsoft — Windows 10 1607 and Windows Server 2016 release health
• Microsoft — Windows 11, version 25H2 release health
• Microsoft — Windows 11, version 24H2 release health
• Microsoft — Windows 10, version 22H2 release health
• CISA — Known Exploited Vulnerabilities catalog (JSON feed)
• Microsoft Security Response Center — September 2026 CVRF (remediation KBs by CVE)

The 30-second version

The September 2026 update cycle closes two exploited Windows privilege-escalation bugs — one per version — and, on some systems, can also make RDS unstable. Opened September 11, 2026; status Mitigated, not Resolved, as of September 13, with Microsoft "working to release a resolution in a future Windows update" and no date set. Each Windows Server version has its own KB and closes one of the two CVEs — see the table above. Don't uninstall a version's update; that reopens the exploited bug it closed. Stage the rollout by ring, watch the release health page between rings, and keep console access to RDS hosts until the fix lands.

If you want a senior engineer to sequence this rollout, the project intake form takes about three minutes. We'll come back with scope and a fixed-fee range.

Pro IT NW does not resell Microsoft licensing or support contracts. This post reflects Microsoft's published release health guidance as of September 13, 2026, plus our own judgment on sequencing — not Microsoft's guidance. Senior-led, labor-only, fixed fee.