Windows administrators worldwide are grappling with a disruptive Remote Desktop Services (RDS) bug that surfaced immediately after Microsoft shipped its September 2026 Patch Tuesday cumulative updates.
Session hosts running Windows Server 2019, 2022, and 2025 have begun freezing hours after boot, leaving RDP connections stuck at “Connecting…” and preventing logged-in users from disconnecting or logging off cleanly.
The trouble traces back to three specific cumulative updates: KB5122876 for Windows Server 2019, KB5122882 for Windows Server 2022, and KB5122871 for Windows Server 2025, all released as part of this month’s security rollout.
Reports first surfaced on Reddit’s r/sysadmin community, where multiple administrators independently described the same failure pattern across unrelated environments, a strong signal that the issue is systemic rather than isolated to one configuration.
Affected hosts typically run normally for a few hours after a reboot before symptoms emerge, most often triggered when a single user session disconnects or reconnects.
Remote Desktop Services Failures
Once that happens, new RDP connection attempts hang indefinitely at the login screen, generating Event ID 20498 in the TerminalServices-RemoteConnectionManager log, which states that “Remote Desktop Services has taken too long to complete the client connection”.
Existing sessions on the host can’t log off, and the paralysis spreads: Task Manager freezes because it cannot reach the Local Session Manager, and nearly every application that touches Windows session state, particularly Settings, becomes unresponsive. Winlogon simultaneously logs Event 6005, warning that “SessionEnv is taking a long time to handle the notification event (Disconnect)”.
Independent kernel-level debugging by affected administrators points to a deadlock inside the RDP server base library, specifically in a routine called RDPSERVERBASE!WDLIB_Close, which is invoked during session teardown.
Once the deadlock takes hold, requests queue up behind it, and even a standard restart may hang; administrators report that only a hard reset restores functionality, though the freeze frequently recurs later the same day. Microsoft has not confirmed this root cause and had not responded to press inquiries about the bug when it was reported.
The affected cumulative updates are not optional. September’s Patch Tuesday addressed roughly 973 vulnerabilities across Microsoft’s ecosystem, including two zero-days already under active exploitation, CVE-2026-81963 in the Windows Update stack and CVE-2026-85880 in Windows Advanced Local Procedure Call, both now listed in CISA’s Known Exploited Vulnerabilities catalog.
The same release also patched a critical Remote Desktop Services remote code execution flaw, CVE-2026-69525, carrying a CVSS score of 9.8, alongside Windows Remote Desktop Client vulnerability CVE-2026-69485. That leaves RDS-heavy organizations in a difficult position: rolling back the update restores stability but strips away critical security fixes shipped in the same package.
Administrators who have removed the September update via DISM report immediate stabilization, since the standalone WUSA installer cannot detach the cumulative update from its bundled Servicing Stack Update and fails outright.
A less disruptive workaround involves overriding the specific feature flag believed responsible through a FeatureManagement registry key, which disables the faulting audio-redirection code path without uninstalling the security patch, though this fix remains unofficial and unverified by Microsoft.
Some administrators have also reported partial relief by forcing RDP transport to TCP only and disabling WDDM or UDP-based Universal Rate Control Protocol via registry changes.
Given the scale of reports across Server 2019, 2022, and 2025 alike, security teams managing RDS collections should pilot the September updates on non-critical hosts, monitor for Event 20498 and Winlogon 6005 after logoff cycles, and maintain a rollback plan until Microsoft officially acknowledges the issue or releases an out-of-band fix.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post Remote Desktop Services Failures on Windows Servers Following September Update appeared first on Cyber Security News.