Microsoft Windows 11 build 28000.2954 (KB5124012) is the September 2026 cumulative security update for Windows 11 version 26H1.

What's new

• Includes the latest Microsoft security fixes and quality improvements.
• Includes features and improvements previously released with the August 2026 optional preview update KB5120996.
• Expands eligible device targeting for automatic deployment of new Secure Boot certificates.
• Fixes an issue that could cause Microsoft Teams and the new Outlook to close unexpectedly on Arm64-based PCs.
• Fixes Remote Desktop audio redirection issues that could prevent remote-session audio from playing on the local device.
• Improves OMA-DM client diagnostic logging by adding certificate chain information for device-management server connections.
• Updates Image Search, Content Extraction, Semantic Analysis, and Settings Model AI components to version 1.2608.951.0 on supported Copilot+ PCs.
• Includes servicing stack improvements to increase Windows Update installation reliability.

Known issues

• Some USB Audio Class 1.0 devices may fail to initialize or produce audio after installing the update.
• Host folder sharing using Plan9 may become unavailable in certain HCS-managed Hyper-V Linux virtual machines, including scenarios involving WSL.
• Remote Desktop Services may become unstable in some enterprise environments, potentially causing RDP connection failures, sign-in problems, or related management tools to stop responding.

Recommendation

Organizations should deploy KB5124012 through their standard security update process after pilot validation. Particular attention should be given to Remote Desktop Services, USB audio devices, Hyper-V or WSL workloads using Plan9 folder sharing, Secure Boot, and enterprise device-management workflows due to the currently documented known issues.