Microsoft has released the September 2026 cumulative security update for Windows 11 version 26H1, introducing enhanced Secure Boot certificate protections, addressing vulnerabilities, and improving system reliability. The update, identified as KB5124012 and OS Build 28000.2954, became available on September 8 and includes fixes from the August optional preview update. This central security-focused change broadens Microsoft's efforts to refresh Secure Boot certificates across compatible Windows hardware.

As older Secure Boot certificates approach expiration, Microsoft must transition eligible hardware to newer trust certificates to maintain operational and security requirements. Microsoft announced that devices already equipped with earlier cumulative updates will only download the new components in this package, thereby reducing update size and deployment overhead. This should offer enhanced diagnostic insights when addressing mobile-device-management connectivity issues.

Machines protected by Credential Guard and domain-joined, but without Windows Server 2025 domain controllers operating at the correct domain functional level, may lose their secure channel if Machine Identity Isolation was enabled in an environment without the necessary domain controllers. Microsoft advises disabling Machine Identity Isolation via Intune, Group Policy, or the appropriate registry setting, followed by repairing the secure channel. Microsoft partially addressed multichannel and 3D audio problems in the September 14 out-of-band update KB5129194, which resolves Plan9 host-folder sharing failures in Hyper-V-based Linux virtual machines and Remote Desktop Services instability.