Windows 11 KB5124008: September 2026 Patch Tuesday — Deploy and Verify

Patch Tuesday for September 2026 delivers KB5124008 — a mandatory security update that closes two actively exploited elevation-of-privilege zero-days on every Windows 11 device in your environment. This post is a deployment runbook, not a news summary. It tells you exactly what the vulnerabilities are, how to identify unpatched machines across your fleet, and how to push the fix through Intune before attackers leverage the public knowledge of these CVEs against your endpoints.

The problem: two actively exploited zero-days in the September 2026 update

When a device has not received KB5124008, it carries two unpatched local privilege escalation vulnerabilities that are confirmed to be exploited in the wild right now. A threat actor who has obtained a foothold on an endpoint — through phishing, a compromised browser extension, or lateral movement — can use either CVE to escalate from a standard user account to SYSTEM, the highest privilege level on the machine. From SYSTEM, an attacker can install persistence mechanisms, disable endpoint detection tools, exfiltrate credentials from memory, and move laterally to other assets on the network. These are not theoretical risks; Microsoft's MSRC advisory explicitly marks both as "Exploitation Detected."

CVE-2026-81963 — Windows Update Stack Elevation of Privilege. The Windows Update Stack is the layered set of components (wuauclt, Update Orchestrator, Windows Update Agent) responsible for downloading, staging, and installing updates. Because updates must be applied system-wide, these processes run with elevated privileges. CVE-2026-81963 is a flaw in that stack that allows a locally authenticated user with no administrator rights to gain SYSTEM-level execution. CVSS base score: 7.8 (Important).

CVE-2026-85880 — ALPC Elevation of Privilege. Advanced Local Procedure Call (ALPC) is a high-speed inter-process communication mechanism built into the Windows kernel. Virtually every privileged Windows service communicates over ALPC. CVE-2026-85880 is a flaw in the ALPC subsystem that an unprivileged local process can exploit to gain SYSTEM privileges. CVSS base score: 7.8 (Important).

Beyond the zero-days, KB5124008 resolves several quality issues that have been affecting fleets since the previous preview update (KB5120998): a black desktop background that appeared after reboots, custom mouse cursor and animation settings resetting on non-English locale devices, and Microsoft Teams (new) and the new Outlook failing to launch on Arm64 devices. Classic Outlook on Arm64 is unaffected. These fixes are included automatically — no additional configuration is needed.

One item you will see on the Windows 11 release health dashboard deserves a direct note. There is an open "Confirmed" issue showing false notifications that read "Microsoft Defender Antivirus is turned off." This issue is caused by recent Microsoft Defender Antivirus definition or platform updates — it is not caused by KB5124008. Do not roll back this update in response to those alerts.

The Event Viewer channels to watch during rollout are listed below. If you see Event ID 20 on a device after KB5124008 is offered, check the detailed message for the error code before assuming the update itself is defective.

Why it happens: how ALPC and the Update Stack are exploited

Understanding the attack class helps you prioritize the deployment correctly and answer questions from security leadership without overstating or understating the risk.

What ALPC is and why it matters. Advanced Local Procedure Call is a synchronous IPC (inter-process communication) mechanism that the Windows kernel exposes to both kernel and user-mode components. It replaced the older LPC mechanism and is used internally by the Windows subsystem, security services like LSASS, COM servers, and dozens of privileged system processes. Because ALPC ports are kernel objects, a flaw in the ALPC dispatcher that allows an unprivileged caller to corrupt kernel state or hijack a privileged connection represents a direct path to kernel-level or SYSTEM-level execution. CVE-2026-85880 falls into this category of flaw: a local, unprivileged process sends a crafted ALPC message that triggers the vulnerability. No network connectivity is required. No user interaction beyond the initial code execution foothold is required.

What the Windows Update Stack does and why it is a target. The Windows Update Stack runs a chain of processes: the Update Orchestrator Service (UsoSvc), the Windows Update Agent (wuaueng.dll), and the Update Session Orchestrator — all running as SYSTEM or as a high-integrity service account. Because these processes must write to protected system directories and modify system state, they are inherently privileged. CVE-2026-81963 is a flaw in the stack's privilege boundary enforcement. A locally authenticated user can trigger a code path in the stack that does not correctly restrict its privilege level, allowing the unprivileged caller to inherit a SYSTEM execution context. Again: local access required, no network access required, no additional user interaction required beyond the initial foothold.

The practical attack scenario. In both cases, the attack class is local privilege escalation (LPE). The attacker already has local code execution — perhaps via a phishing email that dropped a macro-delivered payload, a browser exploit, or a vulnerable application. With LPE, they escalate from that limited user context to SYSTEM in seconds. From SYSTEM, they can disable tamper protection on your security tools, dump credentials from LSASS, and begin lateral movement. Patching removes the escalation step from this chain entirely, making the initial foothold far less valuable.

How to verify: check which devices have not received KB5124008

You need three verification layers: a quick local check on a single device, a fleet-wide programmatic query via Microsoft Graph, and the built-in Intune reporting view. Use all three — Intune reporting lags behind actual device state by the device's check-in interval, so PowerShell gives you a fresher reading.

Method 1: Local PowerShell check (single device)

Run these two commands on any Windows 11 device. The first checks the installed hotfix list. The second reads the Update Build Revision (UBR) directly from the registry, which is the authoritative source of truth for whether the build revision has been applied — even when the KB is not listed as a distinct hotfix entry.

The Windows Update registry hive also contains keys that show update orchestration state. These are useful when you are troubleshooting why a specific device has not installed the update despite being offered it.

Method 2: Fleet-wide check via Microsoft Graph (PowerShell)

For a full fleet report, connect to Microsoft Graph and query Intune managed devices. The companion script in Section 5 automates this entirely. Here is the core query logic for reference.

Method 3: Intune admin center — Software updates report

Intune navigation path

Note that the Intune report is populated only when devices check in. A device that has been offline for more than 24 hours will appear as "Not started" even if the update was installed successfully during an earlier online session. Always cross-reference with the PowerShell UBR check when a device shows an unexpected status.

The fix: deploying KB5124008 via Intune Update Rings and Windows Autopatch

There are two supported Intune deployment paths. Choose based on what your tenant already uses. Both paths result in the same outcome: devices receive KB5124008 and restart within your defined deadline window.

Option A: Intune Update Rings

Update Rings are the traditional Intune mechanism for controlling Windows quality update delivery. Each ring defines a deferral period (how many days after release a device waits before downloading), a deadline (how many days after the deferral the device must install the update regardless of active hours), and a grace period (how many days after the deadline a user can postpone the required restart). For a zero-day response, collapse the deferral on your test ring to zero and keep production at no more than seven days.

Intune navigation — create or edit an Update Ring

1. Open the Update Ring for your IT/Test group. Set Quality update deferral period to 0 days and click Save.
2. Under Update settings, set Deadline for quality updates to 3 days and Grace period to 2 days. This forces devices without an active restart window to restart within 5 days of the deadline — appropriate for actively exploited CVEs.
3. Assign the ring to your pilot device group — typically IT devices and a representative sample of hardware models.
4. After 48 hours, check pilot ring compliance in the Intune quality update report. Then open the Production ring and set quality deferral to 7 days with the same deadline and grace period settings.
5. For any Sensitive/Critical ring (servers, privileged-access workstations, executives), set deferral to 14 days but keep the deadline at 3 days — once the deferral window closes, devices install quickly.

Option B: Windows Autopatch

If your tenant is enrolled in Windows Autopatch, the service will automatically pick up KB5124008 and begin distributing it through its built-in ring structure (Test, First, Fast, Broad). You do not need to configure anything for the standard rollout. However, because both zero-days are actively exploited, you should use Autopatch's Expedited update feature to accelerate the deployment across all rings simultaneously.

Intune navigation — Autopatch expedited update

The Dynamic Update imaging warning: error 0xc0430001

If you use Dynamic Update to service offline Windows media (for OSD task sequences or Autopilot pre-provisioning images), KB5124008 installation can fail with error code 0xc0430001 when boot.stl is missing from the media being serviced. The boot.stl file is part of the Windows Preinstallation Environment boot catalog. When Dynamic Update processing removes or does not include it in the serviced media, the installation stack cannot complete the update and returns this error.

The fix is straightforward: ensure boot.stl is present in the \sources\boot\ directory of your media before running the Dynamic Update servicing pass. If you are using DISM or the Microsoft Deployment Toolkit, mount the updated Windows PE WIM, verify the boot.stl file exists, and re-export the image before attempting the servicing pass again.

Proactive Remediation: detect and force-install missing patches

For devices that are not receiving the update through normal Update Ring delivery — typically due to WU client issues, metered connection blocks, or extended offline periods — deploy a Proactive Remediation (Remediations) package. The companion detection script (Detect-KB5124008Missing.ps1) checks for the patch and exits with code 1 if it is missing, triggering Intune to run a remediation script that forces a Windows Update scan and install cycle.

Intune navigation — create a Remediation package

Upload Detect-KB5124008Missing.ps1 as the Detection script. Set the run context to SYSTEM, enable Run script in 64-bit PowerShell, and set the schedule to run daily. The companion report script (Get-KB5124008ComplianceReport.ps1) gives you a CSV-ready fleet view to track how many devices remediated successfully.

Proof it worked: confirming successful deployment

After your update rings have had time to deliver KB5124008, confirm compliance at three levels: local PowerShell on a sample device, fleet-wide Intune reporting, and Event Viewer for a positive install record.

In the Intune reporting view, a successfully patched device shows the status Succeeded in the Windows quality update report. Devices that are still installing show In progress. Any device showing Error should be investigated individually — check Event ID 20 in the WindowsUpdateClient/Operational log for the specific error code.

For Event Viewer confirmation, open Applications and Services Logs › Microsoft › Windows › WindowsUpdateClient › Operational and filter for Event ID 19. The event message will contain the full KB identifier and the installed build string.

Additionally, confirm that the quality-of-life issues resolved by this update are gone: the desktop background should remain your configured wallpaper across reboots, custom mouse cursors and animations should persist on non-English devices, and Teams (new) and new Outlook should launch normally on Arm64 devices.

References

Community resources

The following contributors from the Microsoft MVP and endpoint engineering community regularly publish deep technical analysis of Patch Tuesday releases and Intune deployment patterns. Their sites are worth bookmarking for context that goes beyond the official KB articles. Note that September 2026-specific posts may appear after this article's publish date — check their sites directly.