Replace September 13, 2026: Microsoft has marked this challenge as Mitigated and launched a Recognized Concern Rollback (KIR) through Group Coverage. The registry characteristic flag workaround described under has additionally been reported as unreliable, it failed to forestall the impasse on at the least one Server 2022 21H2 host.
Use the official KIR in case you have relevant Microsoft 365 or Home windows licensing. The registry strategy stays documented under for environments with out entry to the KIR. Bounce to the Repair part.
Home windows Replace are likely to have the behavior of breaking issues, and this time it’s Distant Desktop Service. The session hosts run positive for just a few hours after reboot, however then connections begin hanging at “Connecting…”, customers can’t sign off, and ultimately a tough reset is the one manner out.
Rolling again the replace is usually the best approach to repair it, however this month’s launch patches CVE-2026-69525, a crucial Distant Desktop Companies distant code execution vulnerability with a CVSS rating of 9.8, plus two zero-days which are already underneath lively exploitation. So rolling again possibly isn’t the best choice.
On this article, we willl take a look at what induced the difficulty, which techniques are affected, and easy methods to repair it with out stripping the September safety patches.
What’s Occurring
The primary reviews appeared on Reddit’s r/sysadmin shortly after the September updates rolled out. A number of admins described the identical failure sample: RDS session hosts work usually after a reboot, then break just a few hours later when customers start logging off.
As soon as it begins, new RDP connections sit at “Connecting…” and by no means attain the logon display screen. Present classes can’t sign off cleanly. Process Supervisor, Settings, and most instruments that contact session state impasse as a result of they’ll’t get a response from the Native Session Supervisor (LSM). A standard restart hangs too. Solely a tough reset recovers the host.
The foundation trigger was tracked down by Reddit consumer u/lesiromanu, who did kernel-level debugging on an affected Server 2022 host. The issue appears to narrate to a routine referred to as RDPSERVERBASE!WDLIB_Close which is invoked throughout the session terdown. When a particular inner characteristic flag (3802373433) is lively, this routine calls RtlWaitOnAddress with no timeout, inflicting the thread to attend indefinitely.
As a result of LSM serializes session state adjustments by means of a single crucial part, that caught thread blocks the whole lot behind it, new connections, logoffs, and dealer requests, till the host is hard-reset.
Microsoft has confirmed to BleepingComputer that it’s conscious of the reviews and investigating. No official root trigger affirmation or out-of-band repair has been launched on the time of writing. Microsoft has up to date the identified points for the Home windows Replace.
These are the occasion log signatures that point out this particular defect:
- TerminalServices-RemoteConnectionManager Occasion 20498: “Distant Desktop Companies has taken too lengthy to finish the shopper connection”
- Winlogon Occasion 6005: “The winlogon notification subscriber SessionEnv is taking very long time to deal with the notification occasion (Disconnect)”
- TermService standing:
StopPendingmoderately thanWorking
Affected Techniques
The difficulty impacts all present Home windows Server variations through their September 2026 Cumulative Updates:
| Home windows Server | KB | Construct |
|---|---|---|
| Server 2016 | KB5123099 | – |
| Server 2019 | KB5122876 | – |
| Server 2022 | KB5122882 | 20348.5622 |
| Server 2025 | KB5122871 | 26100.33438 |
Why Rolling Again is a Final Resort
The identical replace that broke RDS additionally fastened CVE-2026-69525, a crucial Distant Desktop Companies distant code execution vulnerability carrying a CVSS rating of 9.8. The September launch additionally patched CVE-2026-81963 (Home windows Replace stack) and CVE-2026-85880 (Home windows Superior Native Process Name), each zero-days already underneath lively exploitation and listed in CISA’s Recognized Exploited Vulnerabilities catalog.
Now in case your RDS servers are solely customers internally, and never uncovered to the web, then the danger is decrease, and rolling again the replace is likely to be the best possibility. But when your RDS server is accessible from the web, then rollback ought to be your final resort.
Test Whether or not Your Hosts Are Affected
Earlier than touching something, first affirm the affected KB is put in and that the occasion log matches this particular defect moderately than one thing else.
Test the put in construct:
$cv = Get-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersion""$($cv.CurrentBuild).$($cv.UBR)"For Server 2022, the affected construct is 20348.5622. For Server 2025, it’s 26100.33438.
Test the occasion log for the identified failure signatures:
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Home windows-TerminalServices-RemoteConnectionManager/Admin' Id = 20498} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Desk TimeCreated, Message -WrapGet-WinEvent -FilterHashtable @{ LogName = 'System' ProviderName = 'Microsoft-Home windows-Winlogon' Id = 6005} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Desk TimeCreated, Message -WrapTest TermService standing:
Get-Service -Identify TermService | Choose-Object Identify, StandingA standing of StopPending is a robust indicator the impasse is already lively. If the occasion log is clear and TermService is working usually, the host both hasn’t triggered the situation but or isn’t affected.
Repair RDS
Microsoft has launched an official mitigation through Recognized Concern Rollback (KIR), see Possibility 1 under. The registry characteristic flag override is documented as Possibility 2, however a reader working Server 2022 21H2 confirmed the difficulty returned after making use of it, so deal with it as a fallback for environments that may’t entry the KIR, not as a primary selection.
Due to reader u/mickert_dev, who confirmed within the feedback that the registry workaround failed on Server 2022 21H2 and flagged the official KIR after Microsoft up to date the difficulty standing.
Possibility 1 – Official KIR through Group Coverage (Really useful)
Microsoft has launched a Recognized Concern Rollback for all affected variations. The catch: Microsoft solely distributed the KIR notification to subscribers with Home windows licensing through M365 or Azure, so loads of admins didn’t hear about it by means of official channels.
The downloads themselves are publicly accessible. Citrix independently confirmed the difficulty in help article CTX697101.
Obtain the MSI in your server model:
To deploy:
- Set up the MSI on a machine with Group Coverage entry. This registers the brand new ADMX template.
- Copy the ADMX and ADML information to your central retailer (
domainSYSVOLdomainPoliciesPolicyDefinitions), or handle it domestically when you’re engaged on a standalone host. - Open Group Coverage Administration, create or edit a GPO linked to your RDS servers.
- Navigate to Laptop Configuration > Administrative Templates and allow the Recognized Concern Rollback coverage in your KB.
- Apply the GPO and run
gpupdate /driveon the affected servers, or look forward to the following refresh cycle.
No TermService restart is required, however monitor for Occasion IDs 20498 and 6005 for twenty-four–48 hours to substantiate the rollback is holding.
Possibility 2 – Registry Function Flag Override (Fallback)
Observe
Disabling this flag reverts the RDP audio redirection enchancment launched within the September CU. The safety patches in the identical replace are unaffected. As a result of Microsoft hasn’t publicly documented this flag, we will’t totally rule out uncomfortable side effects in different code paths, check on one host first and monitor earlier than rolling out.
Step 1 – Again up the prevailing FeatureManagement Overrides key
New-Merchandise -Path C:temp -ItemType Listing -Drive | Out-Nullreg export "HKLMSYSTEMCurrentControlSetControlFeatureManagementOverrides" ` C:tempFeatureOverrides-backup.regIf the important thing doesn’t exist but, the export returns an error, which is okay, it simply means no overrides are presently set.
Step 2 – Apply the override
New-Merchandise -Path "HKLM:SYSTEMCurrentControlSetControlFeatureManagementOverrides43802373433" -DriveSet-ItemProperty ` -Path "HKLM:SYSTEMCurrentControlSetControlFeatureManagementOverrides43802373433" ` -Identify "EnabledState" -Worth 1 -Kind DWordSet-ItemProperty ` -Path "HKLM:SYSTEMCurrentControlSetControlFeatureManagementOverrides43802373433" ` -Identify "EnabledStateOptions" -Worth 0 -Kind DWordThe 4 within the path works for many environments. If you have already got different entries underneath the Overrides key, verify the exported .reg from Step 1 to substantiate which precedence degree your surroundings makes use of earlier than creating the brand new key.
Step 3 – Restart TermService
The override takes impact after a TermService restart. A full system reboot just isn’t required, however this disconnects all lively RDP classes on the host.
Restart-Service -Identify TermService -DriveGet-Service -Identify TermService | Choose-Object Identify, StandingStep 4 – Monitor
After making use of the override, monitor for Occasion IDs 20498 and 6005 over the next 24–48 hours, significantly round consumer logoff exercise. If neither occasion reappears and TermService stays in Working state, the override is holding.
If the Host is already Deadlocked: DISM Rollback
If a number is already unreachable through RDP or distant administration, you’ll be able to’t apply the characteristic override remotely. A tough reset is required first, after which the September CU ought to be eliminated earlier than the impasse recurs.
Observe that wusa /uninstall /kb:5122882 will fail. September’s updates ship as mixed packages bundling each the Servicing Stack Replace (SSU) and the Newest Cumulative Replace (LCU). As a result of the SSU can’t be eliminated, the standalone installer rejects the entire bundle. Use DISM as a substitute.
Discover the bundle identify:
dism.exe /On-line /Get-Packages /Format:Desk | findstr /i "Package_for_RollupFix"Anticipated output:
Package_for_RollupFix~31bf3856ad364e35~amd64~~20348.5622.1.2 | Put in | Replace | 9/9/2026Take away the bundle:
dism.exe /On-line /Take away-Bundle /PackageName:Package_for_RollupFix~31bf3856ad364e35~amd64~~20348.5622.1.2 /NoRestartSubstitute the bundle identify with the precise string returned by the earlier command. The SSU portion will stay put in after removing, that’s anticipated conduct.
After the host is again up, block the KB from being reinstalled mechanically. When you use WSUS, decline the KB there. In any other case, apply a GPO replace deferral to forestall Home windows Replace from pushing it again throughout the subsequent upkeep window.
Observe
DISM rollback removes all safety patches delivered within the September 2026 cycle, together with the patch for CVE-2026-69525 (CVSS 9.8). Use the characteristic flag override on any host that’s nonetheless reachable. Reserve rollback for hosts which are already deadlocked and unreachable.
Wrapping Up
The September 2026 Cumulative Updates induced an actual mess for RDS environments. However rolling again the replace just isn’t the best response for web facings RDS servers, given the CVE’s it patches.
Microsoft has marked this as Mitigated and launched a KIR. Use Possibility 1 in case your licensing covers it. If the registry workaround is your solely possibility, monitor intently, at the least one surroundings noticed it fail earlier than the official repair was accessible.
I hope you favored this text, in case you have any questions, simply drop a remark under.
