Six days after Microsoft’s biggest security release of September, IT admins across the world were watching Remote Desktop sessions die within minutes of connecting. The fix came fast. On September 14, 2026, Microsoft pushed out KB5129195, an out of band update built specifically to undo the damage its own security update had caused.
If KB5129195 showed up in your update queue and you want to know exactly what it changes before you click install, here is the full picture.
What KB5129195 Is
KB5129195 is a mandatory, cumulative, out of band (OOB) update for Windows 11, version 25H2 and version 24H2. It moves 25H2 to OS build 26200.9457 and 24H2 to OS build 26100.9457. Being “out of band” means it did not wait for the next scheduled Patch Tuesday. Microsoft pushed it the moment the fix was confirmed stable, because the problem it addresses was too serious to sit in a queue for three or four weeks.
If you are still sorting out the difference between your 24H2 and 25H2 build, worth reading KB5054156, which explains the enablement package that moved most machines from one to the other.
Sibling updates went out the same day for other Windows versions: KB5129194 for Windows 11 26H1, and KB5129236 for Windows 10 21H2 and 22H2. This article covers the 25H2 and 24H2 release specifically.
Why Microsoft Rushed This Out
The story starts on September 8, 2026, Patch Tuesday, when Microsoft shipped its regular monthly cumulative update. That update closed two actively exploited zero day vulnerabilities and bundled in a servicing stack update along with a long list of quality fixes. It also introduced a fresh set of problems, and Remote Desktop Services took the worst of it.
Within days, sysadmins running RDS on servers and larger fleets started reporting connections that worked for a few minutes and then dropped, sign in failures that locked users out mid session, and in some cases servers that stopped responding entirely during Remote Desktop configuration. For any organization that depends on RDS for remote work, that is not a cosmetic bug. It is downtime.
This is the exact gap KB5129195 was built to close. It also is not the first time this has happened in 2026. Back in July, KB5101650 shipped as that month’s Patch Tuesday update and quietly broke a batch of Dell PCs. Microsoft’s response was KB5121768, an emergency out of band hotpatch that landed just four days later. The pattern with KB5129195 is nearly identical: a Patch Tuesday release causes real damage, and Microsoft follows up with an OOB fix inside a week.
The Security Fix: CVE-2026-62721
Beyond the RDS repair, KB5129195 carries one security fix worth knowing about. It strengthens protection against CVE-2026-62721, an elevation of privilege vulnerability in the Windows User-Mode Power Service (UMPS).
Microsoft revised its advisory after finding that the original September patch did not fully close the hole. In plain terms, an attacker with local access to a machine could manipulate power management requests sent to that service and potentially gain SYSTEM level privileges, the highest access level on a Windows machine. KB5129195 tightens that gap further.
What Else Got Fixed
RDS stability is the headline fix, but the update package also addresses a few other issues that surfaced after the September update:
- Remote Desktop Services connections dropping after a few minutes, with sign in failures and unresponsive servers during configuration
- Hyper-V folder sharing problems affecting HCS managed virtual machines running Linux guest systems
- USB audio playback issues on some multi channel audio configurations
If you manage a fleet with Hyper-V based Linux VMs or rely on RDS for remote access, this one should go to the top of your patch queue.
What KB5129195 Does Not Fix
Worth flagging before you install: KB5129195 does not address the AMD GPU errors some users have been reporting since the September update. If your AMD graphics card has been acting up since Patch Tuesday, this update will not resolve it. Microsoft has not given a timeline for that fix yet.
How to Install KB5129195
For most users, this is automatic. The update downloads and installs on its own through Windows Update once your device is in scope for the rollout.
- Check manually: Go to Settings > Windows Update > Check for updates. It shows up as “2026-09 Security Update (KB5129195) (26200.9457)” on 25H2 devices.
- Installation time: Around 10 minutes on average, though this varies by hardware.
- Reboots: Usually just one. If your device has a pending Secure Boot certificate update, it may restart more than once.
- IT admins: Manual MSU packages are available through the Microsoft Update Catalog. Download the file for your architecture and install using DISM or the Windows Update Standalone Installer. If installation errors come up, check that the servicing stack baseline covered in KB5120102 is already present on the machine.
How to Verify KB5129195 Is Installed
Go to Settings > System > About and check the OS Build field. You are looking for:
- 26200.9457 on Windows 11, version 25H2
- 26100.9457 on Windows 11, version 24H2
Not sure which Windows version you are even running to begin with? Our free What Windows Version Do I Have tool checks your build the moment the page loads, no download needed.
Should You Install It Right Away
Yes. This is not something worth sitting on. The RDS fix alone makes it critical for any business running remote desktop infrastructure, and the CVE-2026-62721 fix closes a real privilege escalation path. Unless there is a specific compatibility reason to hold back, there is no upside to delaying KB5129195.
Frequently Asked Questions
What is KB5129195?
KB5129195 is a mandatory out of band cumulative update for Windows 11, version 25H2 and 24H2, released September 14, 2026 to fix critical issues introduced by that month’s Patch Tuesday update.
What does KB5129195 fix?
It resolves Remote Desktop Services instability causing RDP sign in failures and dropped connections, fixes Hyper-V folder sharing problems on Linux guest VMs, and strengthens protection against CVE-2026-62721, a privilege escalation vulnerability in the Windows User-Mode Power Service.
Is KB5129195 mandatory?
Yes. It is a mandatory cumulative update and installs automatically through Windows Update on affected devices.
Does KB5129195 fix the AMD GPU errors from September’s update?
No. Microsoft has not listed a fix for the AMD GPU issues in this release.
How long does KB5129195 take to install?
Roughly 10 minutes on average. A single reboot is usually enough unless a Secure Boot certificate update is also pending on your device.
How do I check if KB5129195 is already installed?
Go to Settings > System > About and check the OS Build number. It should read 26200.9457 for 25H2 or 26100.9457 for 24H2.
Does KB5129195 replace the September Patch Tuesday update?
No. It is cumulative and builds on top of it. The September update still needs to be installed as the baseline, and KB5129195 adds the fixes on top.
