As reported by BleepingComputer, Microsoft has released KB5122878, the Windows 10 extended security update that bundles September 2026's record-breaking Patch Tuesday fixes — a staggering 966 vulnerabilities across Microsoft's product ecosystem, including two actively exploited zero-day flaws. This update applies specifically to Windows 10 Enterprise LTSC and ESU program enrollees, bringing builds to 19045.7725 and 19044.7725 respectively.
Why This Patch Cycle Is Historically Significant
A 966-vulnerability Patch Tuesday is unprecedented in scale. To put this in context, Microsoft's typical monthly cycles have historically ranged between 100–200 CVEs. This volume signals either a backlog clearance, a surge in internally discovered flaws, or both. For defenders, the operational burden of validating and deploying fixes at this scale is immense — particularly for organizations still running Windows 10 in production environments.
The inclusion of two actively exploited zero-days elevates this from routine patching to urgent remediation. Threat actors are already leveraging these flaws in the wild, meaning every day of delay widens the attack window.
Key Details at a Glance
| Attribute | Detail |
|---|---|
| Patch Identifier | KB5122878 |
| Total Vulnerabilities Patched | 966 (across Microsoft ecosystem) |
| Actively Exploited Zero-Days | 2 (specific CVEs not enumerated in source) |
| Severity | Critical (zero-days under active exploitation) |
| Affected OS | Windows 10 Enterprise LTSC 2021, Windows 10 ESU program |
| Resulting Build | 19045.7725 / 19044.7725 (LTSC) |
| Patch Available | Yes — via Windows Update or WSUS |
| Known Issues | None reported by Microsoft |
Who Is Most Exposed
Organizations relying on Windows 10 LTSC or ESU are the primary audience — and these are often the environments with the most to lose. LTSC deployments are common in regulated industries (healthcare, manufacturing, industrial control systems) where system stability constraints delay upgrades to newer OS versions. These environments frequently run critical workloads and may have limited redundancy, making patch-induced downtime a genuine concern.
However, the presence of actively exploited zero-days means the risk calculus is clear: the threat of compromise far outweighs the inconvenience of a maintenance window.
Notable Non-Security Fixes in KB5122878
The Secure Boot and Code Integrity changes are particularly important for long-term trust chain maintenance. Organizations should verify that their endpoint detection and security tools properly recognize the new PCA 2026 certificates to avoid false positives or blocking legitimate system components.
Shield53 Recommendations
Immediate Actions
- Patch within 72 hours: Given two actively exploited zero-days, prioritize deployment to all Windows 10 ESU/LTSC assets immediately. Exploited flaws do not wait for your change window.
- Validate in a pilot ring first: Test on a small cohort before mass deployment, but cap pilot time at 24 hours given active exploitation.
- Review BitLocker policies: Apply the BitLocker Group Policy fix proactively to prevent recovery key lockouts that could generate helpdesk overload during patch rollout.
- Audit Secure Boot posture: Confirm that devices are successfully receiving the new Secure Boot certificates. Devices that fail certificate deployment may be running with degraded boot security.
- Hunt for prior exploitation: With two zero-days under active exploitation, assume breach. Review endpoint logs for suspicious process execution, credential access, and lateral movement patterns dating back at least 30 days before this patch.
Strategic Actions
- Accelerate Windows 11 migration planning: Windows 10's mainstream support ended in October 2025. ESU provides breathing room but is a paid stopgap. Build a concrete migration timeline with executive sign-off.
- Inventory your ESU coverage: Verify which devices are properly enrolled in the ESU program. Devices that fall outside coverage will stop receiving security updates — a silent risk.
- Review patch management SLAs: A 966-CVE month will recur if Microsoft continues at this volume. Ensure your patching pipeline can handle surges without becoming a bottleneck.
The scale of this Patch Tuesday is a reminder that legacy OS maintenance is not a set-and-forget exercise. Each month without a migration plan is a month of accumulating security debt — and threat actors are happy to collect.
