Windows 10 KB5122878: What’s Included in the September 2026 ESU Update

On Tuesday, September 8, 2026, Microsoft released the September 2026 ESU update for Windows 10: KB5122878. The package includes fixes from a record-breaking Patch Tuesday, a zero-day flaw that affects only Windows 10 and Windows Server, and a fix for a BitLocker bug. Here’s what you need to know.

Current context reminder: the September 2026 Patch Tuesday is by far the largest ever released by Microsoft: 973 vulnerabilities fixed, including 113 critical issues and 2 zero-days already being exploited in the wild. The September 2026 ESU update makes it possible to install those security patches on Windows 10. After installing this new update, Windows 10 22H2 machines move to build 19045.7725.

An exploited zero-day that spares Windows 11

No surprise here: Microsoft is not delivering any functional new features on Windows 10. The KB5122878 update focuses on security fixes and a few bug fixes.

On the security side, let’s spend a moment on CVE-2026-85880, since Microsoft says it is already being exploited. As I explained in another article, this is a buffer overflow in the ALPC (Advanced Local Procedure Call) component.

"An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system," Microsoft says. This flaw affects only Windows 10 and Windows Server 2012 through 2022.

Secure Boot, BitLocker, and RDP: the other fixes

Beyond the security patches, this new update labeled KB5122878 also delivers several bug fixes:

• Secure Boot: the update expands the list of devices eligible for automatic deployment of the new Secure Boot certificates. This story seems to go on forever.
• BitLocker: the known issue that could force BitLocker recovery key entry on machines with a non-recommended Group Policy is now resolved. If this is the bug I think it is, that is one long-standing issue finally gone!
• Remote Desktop: fixes an audio redirection issue. In some configurations, sound from the remote session was not coming through on the local machine.
• Windows Code Integrity: the Microsoft Windows Production PCA 2026 RSA2048-SHA256 certificate is now recognized as equivalent to PCA 2011, to avoid application compatibility issues during Microsoft’s certificate authority rotation.
• OMA DM: the OMA DM client (omadmclient.exe) now logs more debugging information when connecting to a management server. A small detail, but a useful one for troubleshooting MDM enrollments.
• Date and time: Windows now accounts for Morocco’s move to permanent UTC+00:00 time starting September 20, 2026.

The list of Windows 10 ESU updates

Below is the list of Windows 10 ESU updates published so far.

This article is also a reminder that Microsoft has quietly extended the free ESU program through October 2027, one year longer than expected for enrolled consumer devices.

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio