Sept 2026 Security Update BUG Affecting RDS and User Logon Sessions for Windows

Posted on by David Florey

Just a quick post here – Microslop at it again with bugs in seemingly un-tested security updates for Windows OSes…

This time, its September 2026’s security hotfix that introduces a bug – affecting mainly RDS session hosts, but also affects ALL Windows server and desktop versions going as far back as Server 2012 right up to the insider pre-release of Windows 11 26H2.

From what I’ve seen in the wild so far is:

  • RDS session host boots, allows users to login for a while
  • RDS session host starts to deny new connections, while existing connection remain
  • RDS session host also denies login at the console, often rendering the console completely unusable – can’t even get to the login screen
  • Existing sessions start to become increasingly slow, to the point of almost unusable
  • Server cannot be rebooted cleanly from the console, from a remote PC using task scheduler, or from a remote PC using commands such as: 
    shutdown /f /r /t 1 /m \\RDShostName
  • Server must be reset or power cycled
  • Server returns to normal for a couple of hours before returning back to a troubled state described in this list

Also have seen this affect a domain controller – denying administrator login over RDP, however this domain controller did allow the administrator logon session from the console.

To verify from a remote PC if the affected system has applied the security hotfix with the bug, I used the PowerShell command:

Get-HotFix -ComputerName "RemoteServerName"

This will return all the hotfixes applied to the specified computer, use this to locate the affected hotfix based on the Windows version and the hotfix KB number from this list:

  • Server 2016 – KB5123099
  • Server 2019 – KB5122876
  • Server 2022 – KB5122882
  • Server 2025 – KB5122871
  • Windows 11 – KB5124008
  • Windows 11 – KB5120998

I then download the required KB patch for the Windows version using the below with the direct link to the catalog:

Citrix has also picked up on this issue and published findings here: https://support.citrix.com/external/article/CTX697101/issues-with-microsoft-windows-september.html

Happy microslapping away, Microslop!

Leave a Reply