Microsoft releases emergency Windows 11 KB5129195 update

Microsoft has issued a mandatory out-of-band cumulative update, KB5129195, for Windows 11 versions 25H2 and 24H2, advancing them to builds 26200.9457 and 26100.9457, respectively. The emergency patch resolves several high-severity stability issues introduced by the September 2026 Patch Tuesday release, KB5124008, which addressed more than 970 vulnerabilities across Microsoft's product line, including two zero-days already under active exploitation. 

Windows 11 26H1 receives a companion out-of-band update, KB5129194, while Windows 10 21H2 and 22H2 get KB5129236 for the same regressions; this article covers the 25H2 and 24H2 releases. The update installs in around ten minutes and typically needs only a single restart, though devices with a pending Secure Boot certificate update may reboot more than once.

Security fix

The update adds further protections for CVE-2026-62721, an elevation of privilege flaw in the Windows User-Mode Power Service. Microsoft revised its security advisory after finding that the original September patch did not fully close the vulnerability, which could let a local attacker gain SYSTEM-level access by manipulating the service's power management requests.

Bugs resolved

KB5129195 addresses Remote Desktop Services instability that caused RDP connections to fail after several minutes, sign-in issues, and servers hanging during setup. Microsoft Management Console, the RDS Licensing Diagnoser, and File Explorer could also stop responding. The update further resolves a Hyper-V problem that broke folder sharing between host machines and Linux virtual environments using Plan9 and fixes a multichannel USB Audio Class 1.0 issue that silenced 8-channel and 3D audio output.

Issues still under investigation

Microsoft says some USB Audio Class 1.0 devices still show Device Manager Code 10 errors, produce no sound, or have volume controls stuck at zero. Graphics driver crashes on select AMD hardware remain unaddressed. Sporadic explorer.exe crashes and File History backup failures from the September update will need a separate future fix. Some administrators also report that secure domain sign-in failures introduced by KB5124008 persist after installing KB5129195, though Microsoft has not confirmed this as a known issue.

Rollout

KB5129195 is rolling out automatically through Windows Update, Windows Update for Business, and WSUS, and is also available as a manual download through the Microsoft Update Catalog. IT administrators managing large fleets can also deploy the update through Microsoft Intune or System Center Configuration Manager alongside their existing patch management workflows.