Important
Free support for Windows 10 Enterprise LTSC 2021 ends on January 12, 2027. To learn about continuing support, see Plan for Windows 10 Enterprise LTSC 2021 end of support.
To learn about continuing support for Windows 10, see Extended Security Updates (ESU) Licensing Preparation Package for Windows 10.
Summary
This article lists the security issues and quality improvements included in this cumulative security update.
Applies to: Windows 10 ESU
Important
Use EKB KB5015684 to update to Windows 10, version 22H2.
This security update includes fixes and quality improvements that are part of the following updates:
September 8, 2026—KB5122878 (OS Builds 19045.7725 and 19044.7725)
Extended Security Updates (ESU) Licensing Preparation Package for Windows 10
September 14, 2026—KB5129236 (OS Builds 19045.7727 and 19044.7727) Out-of-band
The following is a summary of the issues that this update addresses when you install this update. If there are new features, it lists them as well. The bold text within the brackets indicates the item or area of the change we are documenting.
[Time and Date]
This update enables permanent Daylight Savings Time (DST) support for British Columbia and Alberta starting in November 2026.
This update introduces the new time zone Manitoba Standard Time "(UTC-5:00) Manitoba".
[ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. To learn more, see KB5130741.
[Storage Spaces] Addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. This issue occurs when valid tiered storage metadata is incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online.
[File History (known issue)] Fixed: This update addresses an issue where File History might fail to back up or restore files to an external drive or network location. Affected devices might incorrectly display a "Reconnect your drive" message even when a compatible backup drive is connected and working properly.
[Secure Boot] This update continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. Deployment through Windows Update remains ongoing across supported device.
Note If you installed earlier updates, only the new updates contained in this package will be downloaded and installed on your device.
For information about security vulnerabilities, please refer to the new Security Update Guide website and the October 2026 Security Updates.
Known issues in this update
USB Audio Class 1.0 devices with error Code 10 or no output
Symptoms
After installing the September 8, 2026, Windows security update, some USB Audio Class 1.0 devices might fail to start or produce audio. Affected devices might experience one or more of the following symptoms:
- The device displays an error in Device Manager: "This device cannot start (Code 10).”
- No audio output.
- Volume controls are unresponsive or remain at zero.
- Sound settings are unresponsive or unavailable.
- Some devices might function in standard stereo configurations but fail when using multichannel audio features, including 8-channel or 3D audio modes. Some customers have reported that they're able to restore audio in these cases by switching to 2-channel mode.
This issue is limited to USB Audio Class 1.0 devices.
Resolution
This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available.
IT administrators who need an immediate workaround for the symptoms not addressed yet by the OOB update should contact Microsoft Support for Business for assistance.
Windows 10 servicing stack update (KB5127308) - version 19041.7789
Microsoft now combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). SSUs improves the reliability of the update process and includes fixes to the servicing stack, the component that installs Windows updates.
Note: This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. To ensure that the device can access the required certificate update domains to successfully download and install certificate updates, see Certificate downloads and revocation lists and Azure Certificate Authority details. To learn more about SSUs, see Servicing stack updates.
How to get this update
Before you install this update
Important You must have the latest servicing stack update (SSU) installed. Not installing the latest SSU before applying Windows updates might result in the Windows update not being offered until the latest SSU is installed.
Deployment
If you deploy this update, choose one of the following based on your installation scenario:
- For offline OS image servicing: If your image does not have the July 25, 2023 (KB5028244) or later LCU, you must install the special standalone October 13, 2023 SSU (KB5031539) before installing this update.
- For Windows Server Update Services (WSUS) deployment or when installing the standalone package from Microsoft Update Catalog: If your devices do not have the May 11, 2021 (KB5003173) or later LCU, you mustinstall the special standalone August 10, 2021, SSU (KB5005260) before installing this update.
If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.
Note
The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.
To ensure the boot.stl file is included as part of the installation media, do one of the following:
- Use the Update WinPE script to update an existing Windows image. (Recommended)
- Manually copy the boot.stl file from the devices Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.
For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.
Get and install this update
To get and install this update, use one of the following Windows and Microsoft release channels.
| Available | Next Step |
|---|---|
|
This update will be downloaded and installed automatically from Windows Update. |
File information
A list of the files that are included in this update are provided in a CSV (Comma delimited) (*.csv) file. The file can be opened in a text editor such as Notepad or in Microsoft Excel.
Note The English (United States) version of this software update might contain files for additional languages.
Download the file information for cumulative update KB5126657.
Download the file information for update SSU (KB5127308) - version 19041.7789.
References
For information about Windows update terminology, see the article about the types of Windows updates and the monthly quality update types.
For an overview of Windows 10, version 21H2 or Windows 10, version 22H2, see its update history page.
Related topics
Microsoft Store application updates
Windows updates do not install Microsoft Store application updates. If you are an enterprise user, see Microsoft Store apps - Configuration Manager. If you are a consumer user, see Get updates for apps and games in Microsoft Store.Secure Boot certificate updates remain in progress as Microsoft transitions devices from certificates that began expiring in 2026 to newer certificates. Devices that have not yet received the newer certificates can continue to start and receive standard Windows updates. Microsoft will continue delivering the newer Secure Boot certificates to eligible devices through Windows Update.