Out of band: Microsoft fixes problems and vulnerabilities after Windows updates

Microsoft released out-of-band updates for numerous Windows operating system builds overnight on Tuesday. They address the problems with the September Patchday Windows updates confirmed over the weekend. They also close serious security vulnerabilities in Windows that should have been corrected back in August but were forgotten. Microsoft advises installing the updates as soon as possible.

A brief overview is provided by Microsoft in the Message Center of the Windows Release Health channel. According to this, the unplanned updates resolve the issues with the September Patchday software patches that Microsoft admitted to over the weekend : Remote Desktop Services can become unstable after installation, USB audio devices may no longer start correctly or multi-channel audio beyond stereo may be problematic, and Hyper-V shared host folders with Linux guests may not display correctly. All of this should now be in the past. However, this only partially applies to the USB audio issue: Devices in the USB Audio Class 1 may continue to fail with error code 10 or produce no sound at all. Microsoft is still working on a solution.

The flood of security patches is apparently presenting Microsoft with new challenges – in September alone, developers fixed almost 1000 vulnerabilities . Now, the developers have used the out-of-band updates as an opportunity to also deliver security-relevant software patches. One patches a privilege escalation vulnerability in Windows User Mode Power Services (UMPS), which Microsoft classifies as “important” (CVE-2026-62721, CVSS 7.8 , Risk “ High ”). Authenticated users can exploit this locally. In the version history of the vulnerability entry, Microsoft writes that links for the patches for Windows 11 26H1, 25H2, and 24H2 have now been added to address a “missed fix”; admins should install the updates as soon as possible. The patch was actually supposed to be active in Windows since August, but the developers apparently simply forgot to include it in the cumulative update.

A second security update exclusively affects Windows 11 26H1 and addresses a privilege escalation vulnerability there, which authenticated attackers can use to elevate their privileges to “Virtual Trust Level 1” (VTL1). Microsoft does not state how attackers can provoke this, but the gap is in the Windows Secure Kernel Mode (CVE-2026-85921, CVSS 8.2 , Risk “ High ”). Contrary to the CVSS classification, Microsoft considers the gap to be “ Critical ”.

The updates should automatically download and install on unmanaged Windows versions and, with the appropriate setting, on business versions; depending on the configuration, the machines should also have already restarted or prompt for a restart. For Windows 11 25H2 and 24H2, the KB number is KB5129195 and brings the builds to version 26200.9457 and 26100.9457 respectively. For Windows 11 26H1, KB5129194 is available, with build number 28000.2956. Out-of-band patches are also available for some older Windows 10 versions and Windows Server 2025 down to Server 2012, which admins should apply quickly.

For Windows 10 22H2 and 21H2, Microsoft provides KB5129236 , increasing the build numbers to 19045.7727 and 19044.7727 respectively. No security patches are included for Windows 10; they only resolve the problems observed after the past patchday. Microsoft therefore classifies them as optional updates, which affected users may have to initiate manually.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.