Should you update to KB5124008?
No: install KB5127648 instead. KB5124008 is a security update Microsoft released on 8 Sep 2026 for Windows PCs. It fixes 638 security flaws, 54 rated critical and 584 important by Microsoft.[1] One of them is already being used in attacks.
It has since been replaced by KB5129195, released 14 Sep 2026, which includes all of its fixes. If you’re on an older version, install that instead.
Should you update?
No: install KB5127648 instead. KB5127648 came out on 13 Oct 2026 and includes every fix in KB5124008, so there’s no reason to stop at this one. Software Update offers the newest version your device can run.
Is KB5124008 still safe?
Not any more. The 2 updates since, up to KB5127648, fix 1,010 security flaws that KB5124008 doesn’t, and each became public the day its fix shipped. Installing it is safe: get it only from Start → Settings → Windows Update, never from a link in an email, text or pop-up.
What it fixes
Microsoft lists 638 security flaws, 54 rated critical and 584 important by Microsoft.[1] The 638 critical and important ones are:
| Flaw | Severity | What Microsoft calls it |
|---|---|---|
CVE-2026-69499 | Critical | Windows Imaging Component Remote Code Execution Vulnerability |
CVE-2026-69501 | Critical | Windows Secure Kernel Mode Elevation of Privilege Vulnerability |
CVE-2026-69518 | Critical | Windows Remote Desktop Remote Code Execution Vulnerability |
CVE-2026-69579 | Critical | Windows Message Queuing Remote Code Execution Vulnerability |
CVE-2026-69590 | Critical | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2026-69601 | Critical | Microsoft Windows Media Foundation Remote Code Execution Vulnerability |
CVE-2026-69603 | Critical | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2026-69676 | Critical | Windows Kerberos Remote Code Execution Vulnerability |
CVE-2026-69710 | Critical | Windows Hello Elevation of Privilege Vulnerability |
CVE-2026-69725 | Critical | Windows Hello Elevation of Privilege Vulnerability |
CVE-2026-69740 | Critical | Windows Hello Elevation of Privilege Vulnerability |
CVE-2026-69769 | Critical | Windows HTTP Print Provider Remote Code Execution Vulnerability |
CVE-2026-69784 | Critical | Windows Hello Elevation of Privilege Vulnerability |
CVE-2026-69789 | Critical | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability |
CVE-2026-69799 | Critical | Windows Hello Elevation of Privilege Vulnerability |
CVE-2026-69820 | Critical | Windows Hello Elevation of Privilege Vulnerability |
CVE-2026-69829 | Critical | Windows Shell Remote Code Execution Vulnerability |
CVE-2026-69846 | Critical | Windows Secure Kernel Mode Elevation of Privilege Vulnerability |
CVE-2026-69852 | Critical | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2026-69860 | Critical | Windows Imaging Component Remote Code Execution Vulnerability |
CVE-2026-69864 | Critical | Windows Hello Elevation of Privilege Vulnerability |
CVE-2026-69874 | Critical | Windows ALPC Elevation of Privilege Vulnerability |
CVE-2026-69890 | Critical | Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability |
CVE-2026-69906 | Critical | Windows Secure Kernel Mode Elevation of Privilege Vulnerability |
CVE-2026-70203 | Critical | Windows Media Player Remote Code Execution Vulnerability |
CVE-2026-70296 | Critical | Windows Imaging Component Remote Code Execution Vulnerability |
CVE-2026-70586 | Critical | Windows Paint Remote Code Execution Vulnerability |
CVE-2026-72950 | Critical | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2026-72958 | Critical | Windows Credential Guard Elevation of Privilege Vulnerability |
CVE-2026-72959 | Critical | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| and 608 more | ||
Used in attacks
This fix closes a flaw that attackers were already using before the update came out, either on CISA’s list of flaws being used in attacks or in Microsoft’s own words.[2]
How to update, and how long it takes
Usually 15 to 60 minutes in all, with one or two restarts. You can keep working while it downloads.
- Save your work first.Windows restarts to finish the update, once or twice.
- Open Start → Settings → Windows Update.Select Check for updates. Windows downloads the month’s cumulative update; it includes every earlier fix.
- Restart when it asks.Select Restart now, or schedule it for tonight. Until it restarts, the fixes aren’t in place.
- Leave automatic updates on.In the same place, under Advanced options, turn on “Get me up to date” so restarts don’t wait for days.
To check it worked: Press Windows key + R, type winver and press Enter: it shows the OS build. It should say 26100.9457 or 26200.9457 or later.
Older devices
The same day, Microsoft released KB5124012 (637 security flaws), KB5122880 (611 security flaws) and KB5122878 (575 security flaws) for devices that stay on an older version. Each fixes the same holes where they apply.
KB5121003 vs KB5124008
KB5121003, released 11 Aug 2026, fixed 182 security flaws, one already used in attacks. KB5124008 fixes 638 security flaws and includes the fixes before it, so going straight to KB5124008 gets you both.
- Before: KB5121003, 11 Aug 2026, 182 security flaws
- After: KB5129195, 14 Sep 2026, 1 security flaw
- Windows updates, every release and the latest version
- Updates, the latest version of everything HARD tracks
References
- ^ Microsoft. “KB5124008”, 8 Sep 2026.
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”.