Microsoft ships final Windows 10 security rollup KB5122878 to ESU customers

Key points

• Microsoft released Windows 10 update KB5122878 on September 2026 Patch Tuesday, delivered only to devices in the paid Extended Security Updates programme or running Enterprise LTSC editions.
• The rollup carries fixes from a record 966-vulnerability Patch Tuesday, including two flaws Microsoft says are already being exploited.
• After installing, Windows 10 machines move to build 19045.7725, and Windows 10 Enterprise LTSC 2021 moves to build 19044.7725.
• The update resolves a known BitLocker Group Policy issue that had forced some devices to prompt for a recovery key.
• Microsoft lists no known issues with the update at time of release.

Microsoft has issued KB5122878, a security-only rollup for Windows 10 available solely to machines enrolled in the company's paid Extended Security Updates (ESU) programme or running the long-term-servicing editions. If you're not in one of those two groups, this update isn't offered to you.

ESU is the arrangement under which Microsoft continues to sell security patches for a defined period after mainstream support ends. Enterprise LTSC, short for Long-Term Servicing Channel, is a separate edition sold to organisations needing a stable build for equipment like medical devices or factory machines. We've tracked this programme since our first ESU story on 9 June 2026.

What is actually in the update?

KB5122878 bundles this month's security fixes alongside a small set of bug repairs. Microsoft isn't adding features to Windows 10 anymore, so the release is maintenance only. Eligible machines can install it through Settings, then Windows Update, then Check for Updates, as first reported by BleepingComputer.

The rollup carries the same security content as the wider September 2026 Patch Tuesday, which Microsoft describes as its largest single release to date. That release addresses 966 vulnerabilities across the company's products, including two zero-day flaws, meaning software bugs that attackers were already exploiting before a patch existed. Our 8 September coverage of the Windows 11 counterpart has the full breakdown of this month's record haul.

What bugs does it fix?

Beyond the security content, KB5122878 clears up several specific problems.

One fix targets BitLocker, the built-in disk encryption feature. Machines with an unrecommended Group Policy setup had been asked to enter a recovery key, a long code that unlocks the drive, when they shouldn't have been. That's resolved here.

Another fix restores audio in Remote Desktop sessions, where sound from a remote machine wasn't always playing locally. A separate change adjusts Morocco Standard Time to reflect that country's move to permanent UTC+00:00 effective 20 September 2026. The update also expands device targeting for the ongoing Secure Boot certificate rollout, and teaches Windows Code Integrity to treat the new Microsoft Windows Production PCA 2026 RSA2048-SHA256 certificate as equivalent to the older PCA 2011 certificate, keeping signed applications running while Microsoft rotates its cryptographic keys.

The update also improves debug logging in the OMA DM Client, the component that handles device management connections to servers.

Should ordinary Windows 10 users do anything?

Only if you're covered by ESU or running Enterprise LTSC. For everyone else still on Windows 10, no patch is coming through Windows Update this month. That's the practical cost of staying on an unsupported operating system, and with two actively exploited zero-days in this cycle, the exposure is real.

Home users in that position have two realistic options: move to Windows 11 if the hardware supports it, or enrol in the consumer ESU offer Microsoft has extended for a limited window. Businesses running Windows 10 outside ESU should assume newly disclosed flaws stay unpatched on those machines.

Check the version number after install. If it reads 19045.7725, or 19044.7725 on LTSC 2021, the update landed cleanly.