KB5124008 Windows 11 Update: Two Exploited Zero-Days Fixed — Install Now or Wait?

Every second Tuesday of the month, Microsoft ships a pile of fixes for Windows, and most months the pile is routine. September 2026 is not one of those months. This month's update patches two security holes that attackers are already using against real targets, and that single fact changes the math on how fast you should install it.

Two holes that are being used right now

The headline item in KB5124008 is a pair of elevation of privilege bugs: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in the ALPC component. Both carry a CVSS score of 7.8, and both are flagged "exploitation detected" — Microsoft's way of saying working attacks exist in the wild, not just in a research lab.

What does elevation of privilege actually mean for you? An attacker who already has a foothold on your PC — through a malicious file, a bad browser extension, or malware that arrived some other way — normally operates with the limited rights of your user account. A bug like this lets them jump from that limited foothold to SYSTEM, the highest level of control Windows offers. From there, nothing on the machine argues with them: security tools can be switched off, files encrypted, persistence installed.

That is also why these two flaws pair so badly with the worms and infostealers circulating this year. The initial infection gets in through one door; this bug hands over the keys to the whole building. Patching removes the second half of that equation.

The rest of the security haul

Beyond the two zero-days, Microsoft counted 974 vulnerabilities fixed across its products this month, 114 of them rated Critical, with 723 affecting Windows directly. For context, the company has now patched more than 2,760 vulnerabilities in 2026 so far — roughly double the pace of 2025. Whether that reflects harder work or a more dangerous year is a fair question; probably both.

The update also continues the slow rollout of new Secure Boot certificates, the behind-the-scenes work that keeps your PC booting securely as the old 2011 certificates age out. If your machine has not received the new certificates yet, there is nothing to do — it will keep booting and updating normally while the rollout completes over the coming months.

Fixes you will actually notice

Security aside, several quality fixes in this build solve problems people genuinely complained about:

• Custom mouse pointers stopped resetting. If you use a non-English version of Windows, your chosen cursor style and color could silently revert to defaults. Fixed.
• The black wallpaper mystery. Desktop backgrounds and slideshow themes sometimes failed to load, leaving a black desktop. Fixed.
• Outlook and Teams crashing on ARM64 laptops. On Snapdragon-class machines, both apps could close without warning. Fixed.
• Remote Desktop audio. Sound from a remote session sometimes refused to play locally. Fixed.
• Morocco's clock. A small but timely one for readers in the Maghreb: Windows now carries Morocco's switch to permanent UTC+00:00, which takes effect September 20, 2026.

Four built-in AI components (Image Search, Content Extraction, Semantic Analysis, and the Settings Model) also move to version 1.2608.951.0. You will not see these by name anywhere, but they quietly power search and settings features.

Install now, or wait a few days?

The usual advice splits into two camps. The cautious camp waits three to seven days to let other people discover any launch bugs. The pragmatic camp installs security updates the day they arrive.

This month I land firmly in the second camp. Two actively exploited flaws plus Microsoft reporting zero known issues is about as clean an install case as Patch Tuesday ever offers. The waiting strategy makes sense when an update is purely cosmetic or when a bug pattern is expected; neither applies here. If your machine is a work-critical device and you are the careful type, waiting until the weekend is a defensible compromise — but no longer.

One practical note: this update includes the September Servicing Stack Update (KB5124007), so the restart at the end may take a few minutes longer than usual. That is normal, not a hang.

Which build are you on right now?

Before updating, it helps to know your starting point. Press Win + R, type winver, and hit Enter. A small window shows your version and build number. If it starts with 26200, you are on Windows 11 25H2; if it starts with 26100, you are on 24H2. Both get this same update and should land on build .9445 after the restart. If the window says 23H2, your machine receives its own September package (KB5122880), though that version is approaching the end of its support window. And if it says 22H2, the situation is more serious: that version stopped receiving security updates back in late 2024, so KB5124008 will never appear on a machine like that. The priority then is not this month's patch — it is finding out why the machine never moved forward, and fixing that first.

How to install it — and what to do if it misbehaves

Open Settings > Windows Update and click Check for updates. The 2026-09 Security Update (KB5124008) should appear; install it and let the PC restart. Alongside it, you will likely see the usual companions: the Malicious Software Removal Tool v5.145 and this month's .NET security updates. All normal.

If the update does not appear, does not finish, or throws an error code, that is where the real troubleshooting starts:

• Installation failing with error 0x80073712? That points to a corrupted component store, and we have a full fix guide for it.
• Progress stuck at 0%, 99%, or anywhere in between? Here is what to do when Windows Update freezes, step by step.
• If Windows Update itself is misbehaving on an older build, the Installation Assistant versus Windows Update comparison explains when the assistant is the better door.

And if you are still on an older version of Windows 11 because your machine is waiting on the 25H2 offer, this month is a reasonable moment to revisit that decision — our 25H2 upgrade-or-wait guide walks through who should move now and who should not.

What about Windows 10?

Windows 11 23H2 received its own September package (KB5122880) with the same security fixes, but 23H2 itself is approaching the end of its support window. If you are still on Windows 10, the ESU era is the reality now — whether that road is worth paying for is exactly what our Windows 10 safety guide covers, alongside the cheaper questions most people forget to ask first.