As reported by BleepingComputer, the September 2026 Patch Tuesday cumulative updates are causing widespread Remote Desktop Services (RDS) failures across Windows Server 2019, 2022, and 2025 environments. The issue manifests as a progressive degradation — servers function normally for hours before sessions begin hanging, existing connections cannot disconnect cleanly, and new connection attempts stall indefinitely. In many cases, only a hard reset restores functionality.

Security Impact: As reported by BleepingComputer, the September 2026 Patch Tuesday cumulative updates are causing widespread Remote Desktop Services (RDS) failures across Windows Server 2019, 2022, and 2025 environments.

This is a textbook example of the Patch Tuesday dilemma that infrastructure teams face every second Tuesday of the month: apply security fixes promptly to reduce exposure, or delay to avoid introducing operational instability. When the patch itself becomes the outage, the calculation changes dramatically.

Affected Updates and Server Versions

KB ArticleWindows Server VersionIssue
KB5122876Server 2019RDS session failures, connection hangs
KB5122882Server 2022RDS session failures, connection hangs
KB5122871Server 2025RDS session failures, connection hangs

Early debugging from affected administrators points to a potential deadlock between the Remote Desktop service and the Local Session Manager (LSM) at RDPSERVERBASE!WDLIB_Close, where no timeout appears to be enforced. Microsoft has not confirmed this root cause at the time of reporting. The fact that the failure is delayed — sometimes by hours — and triggered after user logoff activity suggests a resource exhaustion or handle leak pattern rather than an immediate initialization failure.

Why This Matters Beyond the Immediate Outage

  • Security regression risk: Admins rolling back KB5122876, KB5122882, or KB5122871 to restore RDS functionality are simultaneously removing every security fix shipped in September 2026. If this month's release patches critical or actively exploited vulnerabilities — which is common — those servers become exposed while the RDS bug remains unresolved.
  • Remote workforce impact: RDS remains a backbone technology for remote access to shared applications and desktops. Environments with high session churn — call centers, shared terminal server farms, VDI deployments — are most exposed because the failure appears tied to logoff activity.
  • Monitoring blind spots: A server that passes initial post-patch health checks but degrades hours later exposes the inadequacy of short validation windows. Traditional patch testing protocols that verify connectivity for 30–60 minutes would not catch this issue.
The most dangerous patches are not the ones that fail immediately — they are the ones that pass your validation checks and then degrade under real session load.

Shield53 Recommendations

Immediate Actions:

  • Do not install KB5122876, KB5122882, or KB5122871 on production RDS hosts until Microsoft confirms a fix or issues interim mitigation guidance.
  • If already deployed: Monitor RDS host performance closely. Watch for rising session counts that cannot log off, connection queue buildup, and TermService process handle counts. Implement automated alerting on session state anomalies.
  • If experiencing failures: Rolling back the September update restores functionality but removes security fixes. Document which CVEs are now unpatched and apply network-level compensating controls — restrict RDP exposure via VPN or zero-trust access brokers, tighten firewall rules, and increase monitoring for exploitation indicators.
  • Stagger deployments: Use a ring-based deployment model. Pilot patches on non-critical RDS hosts with representative session load for a minimum of 24–48 hours before broad rollout.
  • Prepare rollback runbooks: Ensure your team can execute wusa.exe /uninstall /kb:XXXXXXX /quiet /norestart rapidly across affected hosts via configuration management tools.

Broader Guidance: This incident reinforces the need for layered defense that does not solely depend on patch currency. Network segmentation, privileged access management, and EDR coverage provide resilience when patching must be delayed. Organizations that treat Patch Tuesday as their primary security control are structurally vulnerable to exactly this scenario.

Shield53 is monitoring for Microsoft's official acknowledgment and will update guidance as mitigation details emerge. Given the breadth of affected versions and the operational criticality of RDS, we assess that a speedy out-of-band fix or servicing stack update is likely if Microsoft confirms the deadlock root cause.