September 2026 Windows Security Update: Two Exploited Flaws and the Secure Boot Check Users Should Make

• Microsoft’s September 8, 2026 security release fixes two Windows privilege-escalation vulnerabilities that were already being exploited: CVE-2026-85880 and CVE-2026-81963.
• Windows 11 24H2 and 25H2 users should install KB5124008, while eligible Windows 10 devices receive KB5122878. Both updates require a restart in normal installations.
• After restarting, check Windows Security > Device security > Secure Boot and make sure your BitLocker recovery key is available before changing firmware or boot settings.

What to do about the September 2026 Windows update

Microsoft released its September 2026 security updates on September 8, and this is a patch to install promptly rather than postpone. Microsoft says two Windows vulnerabilities were being exploited before the fixes became available: CVE-2026-85880, a Windows Advanced Local Procedure Call privilege-escalation flaw, and CVE-2026-81963, a Windows Update Stack privilege-escalation flaw.

Neither issue is described by Microsoft as a remote-code-execution vulnerability. The practical concern is that an attacker who already has a foothold on a Windows computer could use a local privilege-escalation bug to gain more control. That makes the update especially relevant for home PCs, small-business computers, and devices used for remote work.

The September release also expands Microsoft’s rollout of updated Secure Boot certificates. That process is separate from the two exploited flaws, but it is one reason to pay attention to what Windows reports after the restart.

Install the update first

On Windows 11, go to Start > Settings > Windows Update, select Check for updates, and choose Download & install when the update appears. Restart when Windows asks you to.

For Windows 11 versions 24H2 and 25H2, the cumulative update is KB5124008. Windows 11 version 23H2 receives the separate cumulative update KB5122880. Microsoft’s September release notes list Windows 11 26H1 separately with KB5124012.

Microsoft classifies the September Windows update as a baseline update rather than a hotpatch. In practical terms, even devices enrolled in hotpatching may need a restart because some of the protected components cannot be updated while Windows is running.

Install Windows updates from Microsoft’s official instructions ↗

What Windows 10 users need to know

Windows 10 is more complicated because standard support ended on October 14, 2025. The September 2026 update applies to Windows 10 devices covered by Extended Security Updates, Windows 10 Enterprise LTSC 2021, or Windows 10 IoT Enterprise LTSC 2021—not ordinary unsupported Windows 10 Home or Pro installations.

Eligible Windows 10 systems receive cumulative update KB5122878. Microsoft says the package includes additional Secure Boot targeting data, a code-integrity compatibility improvement related to certificate-authority rotation, and a fix for a BitLocker Group Policy issue that could cause some devices to request their recovery key.

If your Windows 10 PC is not covered by ESU or a supported LTSC edition, the September update will not restore regular security support. Upgrading to a supported Windows 11 release, replacing the device, or reviewing Microsoft’s ESU options is a separate decision from installing this month’s patch.

Review the official Windows 10 KB5122878 update page ↗

What the Secure Boot changes mean

Secure Boot helps verify trusted software before Windows starts. Microsoft is replacing older certificates issued in 2011 because several of them began expiring in 2026. The most relevant dates include June 24, June 27, and October 19, 2026, depending on which certificate is installed and what it is used to sign.

A device that has not received the newer 2023 certificates should normally continue to start, and standard Windows updates should continue to install. The longer-term problem is that it may stop receiving some future protections for the Windows boot process, including updates to the Boot Manager, Secure Boot databases, revocation lists, and mitigations for boot-level vulnerabilities.

Microsoft is delivering the certificate updates automatically to many consumer PCs and non-managed business devices. Compatibility checks, firmware limitations, enterprise policies, older boot configurations, and third-party bootloaders can affect whether the process completes automatically.

Check the status after restarting

Open Windows Security > Device security > Secure Boot. Look at the text beneath the status badge, not just the colour of the icon.

• Fully updated: The required certificate updates and updated Boot Manager are installed. No further certificate action is needed.
• Not yet updated: Install the latest Windows updates, keep the device connected to the internet, and restart if prompted.
• Requires action: Windows cannot deliver a needed boot-security update using the current configuration. Follow Microsoft’s Secure Boot guidance rather than repeatedly dismissing the warning.
• Hardware or firmware limitation: The computer manufacturer may need to provide a firmware update or other supported resolution.

A green checkmark is helpful, but Microsoft says you should also read the accompanying message. The strongest confirmation is the wording that Secure Boot is on and all required certificate updates have been applied.

BitLocker and recovery-key precautions

Secure Boot, firmware changes, and BitLocker are closely related. BitLocker can ask for its 48-digit recovery key when Windows detects a hardware, firmware, or software change that it cannot distinguish from a possible attack. That does not mean the update is defective, but it can leave you locked out if the key was never backed up.

Before changing UEFI settings, updating device firmware, or troubleshooting a red Secure Boot warning, confirm that you can access the recovery key. On a personal PC, it may be stored with your Microsoft account. On a work or school computer, the organization’s IT department may control it.

Do not save the only copy of the key on the same encrypted drive. Microsoft supports saving or printing another copy, provided it is kept somewhere separate and secure.

A practical checklist for home users and small businesses

1. Save open work and make sure important files are backed up.
2. Check Windows Update and install the September security update offered for your Windows version.
3. Restart the PC, even if the update appears to finish without an immediate restart request.
4. Open Windows Security and review the Secure Boot status text.
5. Confirm that the BitLocker recovery key is available before making firmware or boot-configuration changes.
6. Check essential hardware and software after the restart, including Wi-Fi, printers, VPN access, Microsoft Teams, Outlook, and remote-desktop tools.
7. If a Secure Boot warning remains, record the exact message and device model before contacting the manufacturer or business IT support.

Microsoft’s September Windows 11 update currently lists no known issues for KB5124008. The Windows 10 KB5122878 page also says Microsoft is not currently aware of known issues, although organization-managed devices can still be affected by local policies, firmware, drivers, or security software.

What happens next

Secure Boot certificate deployment will continue through Windows updates in the coming months. Microsoft’s published guidance says updates may be paused for devices with known compatibility problems and resume automatically after a supported resolution is available.

Windows 11 24H2 Home and Pro editions are scheduled to reach the end of updates on October 13, 2026. Enterprise and Education editions remain supported until October 12, 2027. That deadline is separate from the September patch, but it matters if a household or small business is still running Windows 11 24H2 and planning its next upgrade.

For now, the sensible sequence is straightforward: install the September security update, restart, read the Secure Boot status, and make sure the recovery key is accessible before touching firmware settings.

Helpful Links

• Microsoft September 2026 Security Updates – Review Microsoft’s September 2026 security release, including the two Windows vulnerabilities exploited before fixes were available.
• September 8, 2026 KB5124008 Windows 11 security update – Check the Windows 11 24H2 and 25H2 update details, Secure Boot changes, installation methods, and known issues.
• September 8, 2026 KB5122878 Windows 10 security update – Review eligibility, installation details, Secure Boot improvements, and support limitations for Windows 10.
• Windows Secure Boot certificate expiration and CA updates – Read Microsoft’s certificate-expiration timeline and guidance for affected Windows PCs, servers, and managed devices.
• Secure Boot certificate update status in the Windows Security app – Understand the green, yellow, and red Secure Boot messages shown in Windows Security.
• Find your BitLocker recovery key – Locate a personal or work-managed BitLocker recovery key before making firmware or recovery changes.
• Install Windows Updates – Official page referenced in the article.

Frequently Asked Questions

Q. Which September 2026 Windows update should I install?

A. Windows 11 24H2 and 25H2 use KB5124008, Windows 11 23H2 uses KB5122880, and Windows 10 eligible for ESU or supported LTSC editions uses KB5122878. Windows Update normally selects the correct package automatically.

Q. Are the two exploited vulnerabilities remote-code-execution flaws?

A. Microsoft identifies CVE-2026-85880 and CVE-2026-81963 as privilege-escalation vulnerabilities. They can help an attacker with an existing foothold gain greater control, but Microsoft does not describe these two issues as remote-code-execution vulnerabilities.

Q. Will an old Secure Boot certificate stop my PC from starting?

A. Microsoft says affected devices should generally continue starting and receiving standard Windows updates for now. However, they may miss future protections for the Windows boot process, and some newer firmware, operating systems, bootloaders, or Secure Boot-dependent software may eventually have compatibility problems.

Q. Why might Windows ask for my BitLocker recovery key after an update or firmware change?

A. BitLocker can request the recovery key when hardware, firmware, or software changes alter the device’s trusted startup state. It is a security response and does not by itself prove that the Windows update failed.

Q. What should I do if Secure Boot shows a red warning?

A. Install all available Windows updates, restart, and read the exact message under Windows Security > Device security > Secure Boot. If the warning remains, use Microsoft’s Secure Boot guidance and contact the device manufacturer or business IT support if the message cites a firmware or hardware limitation.

Featured image: EVG Kowalievska / Pexels / Pexels License