Windows 11 September 2026 Patch Tuesday adds taskbar options & fixes zero-days

Microsoft has released its September 2026 Patch Tuesday updates for Windows 11 (KB5124008 and KB5124012) and Windows 10 (KB5122878). Vulnerability trackers monitoring Microsoft's releases, including Rapid7 and the Zero Day Initiative, put the September count at 974 vulnerabilities, the largest single-month total in Patch Tuesday history. However, tallies from other trackers range from 964 to 997 depending on the counting method. The jump has been linked to Microsoft's AI-assisted vulnerability discovery work across its own codebase. Alongside the fixes, KB5124008 rolls out several previously flagged interface changes to Windows 11.

Two zero-days closed, over 100 critical flaws resolved

The release patches two elevation-of-privilege zero-days already exploited in the wild. CVE-2026-81963 is a link-following flaw in the Windows Update Stack that lets a local attacker elevate to SYSTEM privileges. CVE-2026-85880 is a heap-based buffer overflow in the Advanced Local Procedure Call component, letting an attacker running code in a low-privilege AppContainer escape the sandbox and elevate privileges with no user interaction required.

BleepingComputer's count of the release puts 105 vulnerabilities at critical severity, 81 of them remote code execution flaws, spanning products including Remote Desktop Services, Windows DNS, Office, and SQL Server.

Taskbar, Start menu, and search get documented upgrades

Per Microsoft's own release notes, Windows 11 versions 24H2 and 25H2 gain the ability to lock the taskbar to the top, left, right, or bottom of the screen, plus a smaller taskbar option for compact displays; the search box and small taskbar are supported only in the top and bottom positions. The Start menu adds a size toggle between small and large, a setting to hide the signed-in user's name and picture, and a redesigned settings page with independent show or hide controls for the Pinned, Recommended, and All sections. Microsoft has also renamed the "Recommended" section to "Recent" in the Start menu itself. 

Windows Search gets a simplified home view, clearer labeling of where each result originates, a new privacy toggle in Settings to block web and Microsoft Store suggestions, and automatic indexing of frequently used folders. KB5124008 also fixes a bug that could cause Microsoft Teams and Outlook to close unexpectedly on Arm64-based PCs, resolves a black-desktop personalization bug, and corrects Remote Desktop audio redirection issues. KB5124012, which brings the same security fixes to Windows 11 26H1 devices, carries a separate set of non-security improvements, including Start menu reliability fixes and new touchpad gesture settings, rather than the taskbar and search changes above.

The September 2026 Patch Tuesday update is available now through Windows Update, Windows Update for Business, WSUS, and the Microsoft Update Catalog.