As reported by BleepingComputer, Microsoft has resolved a persistent known issue that has been causing black screens, desktop loading failures, and Windows Explorer crashes since August 2026 updates. While the bug affected some standard Windows 11 desktops, the primary blast radius was in enterprise Virtual Desktop Infrastructure — specifically Azure Virtual Desktop (AVD) environments leveraging FSLogix for profile management.

Cloud Security Alert: While the bug affected some standard Windows 11 desktops, the primary blast radius was in enterprise Virtual Desktop Infrastructure — specifically Azure Virtual Desktop (AVD) environments leveraging FSLogix for profile management.

Why This Matters More Than a Typical Bug

At first glance, a black-screen-after-login issue sounds like a nuisance reliability bug. In a VDI context, however, it's a productivity-stopping event with cascading consequences. When users can't reach their desktops, help desks get flooded, session hosts become effectively unusable, and the manual workaround — launching explorer.exe via Task Manager — is impractical across hundreds of concurrent sessions. For organizations running AVD at scale, this issue has likely been consuming significant IT support capacity for the past two months.

The FSLogix dependency is the critical detail here. FSLogix is the de facto standard for non-persistent VDI profile management, meaning the most exposed environments are also the ones least able to tolerate per-user manual remediation.

The Patch and Mitigation Path

Microsoft resolved the issue in cumulative updates released on October 13, 2026 (Patch Tuesday). The fix is included in all subsequent updates. For organizations that cannot immediately deploy the full cumulative update, two mitigation paths exist:
  • Manual workaround: Launch Task Manager (Ctrl+Shift+Esc), select Run new task, enter explorer.exe, and click OK. This is per-session and not viable at scale.
  • Known Issue Rollback (KIR): Microsoft has published KIR Group Policies that disable the offending change without requiring the full update. Affected versions include Windows 11 26H1 (KB5124006) and Windows 11 25H2/24H2 (KB5124010). A device restart is required after policy application.

Notably, if you install the October 13 cumulative update or later, the KIR workaround is no longer needed — the underlying fix supersedes it.

Adjacent Issues Worth Tracking

BleepingComputer also noted two related known issues that enterprise teams should be aware of: Microsoft resolved an Always On VPN connection failure triggered by September 2026 updates, and confirmed that recent updates may cause Remote Desktop failures for non-admin users when the Administrator protection security feature is enabled. If your environment uses AOVPN or has begun adopting Administrator protection, validate these areas during your October patching cycle.

Shield53 Recommendations

Adjacent Issues Worth Tracking
Patch AVD session hosts immediately. Prioritize your AVD host pools for the October 13 cumulative update. Given FSLogix's role in the issue, validate post-patch that profiles load correctly and Explorer launches without manual intervention.
Apply KIR as a stopgap for deferred patching. If change windows prevent immediate cumulative update deployment, distribute the appropriate KIR Group Policy (KB5124006 for 26H1, KB5124010 for 25H2/24H2) to session hosts and force a restart.
Audit FSLogix configuration. This issue underscores the fragility of profile layering in non-persistent VDI. Review FSLogix version currency and consider whether profile containers are running supported versions with current Microsoft compatibility.
Validate RDP and AOVPN post-patch. Test non-admin RDP sessions and Always On VPN connectivity after applying October updates, particularly if Administrator protection is enabled in your tenant.
Update your help desk runbook. If the manual explorer.exe workaround was documented for support staff, remove or mark it as deprecated once hosts are patched to avoid confusion.

This is a reminder that known issues in widely deployed update channels can have outsized impact when they intersect with critical infrastructure patterns like VDI. The two-month window between August updates and October resolution is a long time for affected environments — and a strong argument for maintaining testing rings even for non-security reliability updates in production-critical virtualization stacks.