The September 2026 cumulative updates for Windows Server 2019, 2022, and 2025 are causing Remote Desktop Services (RDS) failures. After installing these updates, RDS initially works but then starts failing after a few hours or after users log out, preventing new connections and causing existing sessions to hang. Some administrators report that the only way to restore functionality is a hard reset. Rolling back the updates restores RDS functionality but removes the security fixes. Microsoft has not yet confirmed the cause or provided a fix.
The BlueMoon exploit kit is a modular tool used by multiple cyber-espionage groups to chain zero-day vulnerabilities in Microsoft Windows and Google Chrome. It combines two Chromium-based browser flaws allowing remote code execution and sandbox escape with a Windows kernel local privilege escalation. Observed since August 2026, BlueMoon has been deployed by Chinese state-sponsored actors targeting NGOs, aerospace, defense, and manufacturing sectors. The kit exploits delays in Chrome stable releases to weaponize recent Chromium fixes. It executes payloads by elevating Chrome renderer privileges and injecting commands to download and run malware loaders.
Microsoft addressed a known issue in Windows 11 where mouse settings were reset after installing the KB5120998 August 2026 preview update. The problem was resolved with the September 2026 updates.
Microsoft released the September 2026 Patch Tuesday updates to fix a known issue that caused Windows desktop settings to be lost or reset on some devices. This bug affected user configurations but was addressed by the official update.
ShieldCrash is a zero-day exploit targeting Microsoft Defender on fully patched Windows systems as of September 2026. It enables privilege escalation to full System privileges, allowing attackers to perform sensitive actions such as dumping the SAM database. This exploit bypasses previous patches for related vulnerabilities including ShieldBreak and RoguePlanet, indicating incomplete remediation by Microsoft. The underlying vulnerability is tracked as CVE-2026-69414. No official patch specifically addressing ShieldCrash has been confirmed at this time.
Microsoft is introducing new age-awareness APIs in Windows 11 that enable applications to determine if a user is a child, teenager, or adult without revealing the exact date of birth. These APIs provide age ranges based on verified Microsoft account information, allowing apps to tailor experiences and safeguards accordingly. The feature supports age verification status checks and aims to streamline age-appropriate protections, including for AI experiences. Age verification is currently available in select regions and will expand over time. The APIs are available to Windows Insiders and will be rolled out broadly soon.
Microsoft's September 2026 Patch Tuesday release addresses 973 vulnerabilities across multiple products, including 113 critical issues. Among these, several vulnerabilities have been exploited in the wild, notably CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows ALPC), both elevation of privilege flaws with CVSS scores of 7.8. The update also includes multiple remote code execution vulnerabilities with high CVSS scores, such as CVE-2026-69676 (Windows Kerberos) with a score of 8.8 and CVE-2026-69730 (Windows DNS Server) with a score of 9.8. Microsoft highlights some vulnerabilities as more likely to be exploited and others as less likely. The vulnerabilities affect a broad range of Microsoft products including Windows components, Azure services, and Microsoft SQL Server. No explicit patch links are provided in the source, but these vulnerabilities are part of the official monthly security update. The vendor manages remediation through this update.
Microsoft released the Windows 10 KB5122878 extended security update as part of the September 2026 Patch Tuesday. This update includes security fixes addressing a record 966 vulnerabilities across Microsoft products, including two zero-day exploits that were actively exploited. It also contains bug fixes and improvements such as enhanced Secure Boot certificate deployment, time zone adjustment for Morocco, improved logging for OMA DM Client, and fixes for Remote Desktop audio redirection and BitLocker Group Policy issues. No new features are included, and Microsoft reports no known issues with this update.
Microsoft released Windows 11 cumulative updates KB5124008 and KB5122880 for versions 23H2, 24H2, and 25H2. These updates include security patches addressing approximately 1,000 vulnerabilities discovered in previous months, along with bug fixes and new features such as a movable taskbar, enhanced Start menu customization, and improvements to Windows Search and File Explorer. The updates are mandatory and part of the September 2026 Patch Tuesday release. No new issues have been reported with these updates so far.
The August 2026 Microsoft security update may cause recurring application errors (0xc0000409) on Windows Server 2016 systems where the Compatibility Appraiser diagnostic service is enabled. This issue affects both physical and virtual machines, including VMware and Azure environments. The CompatTelRunner.exe process crashes, generating event log warnings, but device functionality is not impacted. Microsoft acknowledges this as a known issue and recommends dismissing the event log warnings temporarily until a fix is released in a future update.
An investigation revealed a sophisticated cryptocurrency and credential-stealing operation using Amatera stealer as the primary payload. The attack chain leverages Cloudflare Workers to inject JavaScript stored on BNB Smart Chain, presenting fake Google CAPTCHA prompts that lead to WebDAV-based DLL execution. Two parallel infection chains were identified, one loading through a DLL named 'pf.ch' and another through 'verification.google', both delivering Amatera stealer with different secondary payloads. The 'pf.ch' variant deployed ZigCryptoStealer via NativeAOT loader and a Go-based reverse proxy, while the 'verification.google' variant installed NetSupport Manager with C2 infrastructure in Russia. The operation affects numerous countries with primary focus on stealing cryptocurrency wallets, credentials from password managers, and various authentication data through extensive collection rules targeting over 400 applications.
Microsoft warned customers last week that they may experience application crashes on some Windows Server 2025 due to recent memory management changes. [...]
Microsoft has acknowledged a known issue affecting some users on Windows systems who experience delays or are blocked from opening the Microsoft Teams desktop client. The problem causes loading delays of up to two minutes or failure to open the client initially. Microsoft is investigating the root cause and has advised affected users to use Teams via web or mobile apps as a workaround. A related issue affecting Mac users' ability to join Teams calls and meetings is also under investigation. No evidence of exploitation or security breach has been reported. Microsoft is actively working on remediation.
A zero-day privilege escalation vulnerability named 'FalconFlank' affects CrowdStrike Falcon Sensor on up-to-date Windows 11 and Windows Server systems. The exploit abuses the Office malicious macros remediation feature in CrowdStrike Falcon to spawn a command prompt with SYSTEM privileges. CrowdStrike is investigating and advises disabling the Microsoft Office File Suspicious Macro Removal policy setting as a mitigation. The vulnerability has not yet been assigned a CVE ID or publicly patched. The exploit was released by a security researcher known as 'Nightmare Eclipse'.
A known issue in the Microsoft KB5120998 August 2026 preview update causes mouse settings to revert after installation, but this problem only affects non-English Windows 11 systems. Microsoft has acknowledged the issue and clarified its limited scope. There is no indication that this issue is a security vulnerability or that it leads to exploitation. The problem is specific to user experience with mouse configuration on certain localized versions of Windows 11.
A known issue affecting Microsoft Teams and the new Outlook on ARM-based Windows devices causes crashes and launch failures after installing August 2026 Patch Tuesday updates. The problem impacts devices running Windows 11 24H2 or later, particularly those that have not installed Microsoft Store updates. Microsoft has provided a temporary workaround involving updating the Auto Super Resolution Package and is working on a permanent fix in a future Windows update.
TerminalFix is a new variant of the ClickFix attack that tricks victims into running malicious PowerShell commands via fake Cloudflare CAPTCHA prompts on compromised websites. This attack uses Windows Terminal or PowerShell to execute complex multi-line scripts that download and deploy a multi-stage payload. The payload includes steganographically hidden components and establishes persistence via scheduled tasks and Registry keys. It performs network reconnaissance and deploys a custom Python reverse tunnel over encrypted WebSocket, enabling attackers to pivot into internal networks. Microsoft discovered these attacks in the wild but has not observed active hands-on exploitation. The attack could facilitate lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, or ransomware deployment. Recommended mitigations include restricting PowerShell execution, monitoring suspicious processes, hardening endpoints, and investigating lateral movement if compromise is suspected.
Microsoft has acknowledged that the Windows 11 KB5120998 August 2026 non-security preview update causes mouse settings to be reset to default values after installation. This issue affects user-configured mouse preferences but does not represent a security vulnerability or exploit. No evidence of active exploitation or security impact has been reported.
The TerminalFix campaign is a sophisticated multi-stage intrusion targeting organizations via compromised websites that display fake Cloudflare CAPTCHA overlays. Victims are tricked into executing malicious PowerShell commands that download and execute a signed legitimate binary alongside a malicious DLL for sideloading. This leads to steganographic payload extraction, extensive Active Directory reconnaissance, and deployment of a Python-based reverse-tunnel implant providing persistent network-level proxy access. The campaign enables attackers to pivot within the network, conduct domain enumeration, and maintain stealthy persistent access. Although no direct downstream actions were observed, the access gained could facilitate privilege escalation, data exfiltration, and ransomware deployment. The campaign combines advanced evasion techniques and persistent network access, posing a serious threat to enterprise environments.
Microsoft released the Windows 11 KB5120998 preview cumulative update for versions 25H2 and 24H2, which includes 35 non-security changes and quality improvements such as taskbar customization, Start menu size options, and administrator protection features. This update is optional and does not contain security fixes. It is intended for IT administrators to test upcoming fixes and features before the next Patch Tuesday release. The update also removes the WMIC utility from these Windows versions. Microsoft has warned that some devices may experience an additional reboot due to Secure Boot certificate updates during installation.
