Microsoft's September 2026 Windows 11 update fixes 1,000 flaws and finally lets you move the taskbar

Key points - Microsoft released Windows 11 cumulative updates KB5124008 (for 25H2 and 24H2) and KB5122880 (for 23H2) on Patch Tuesday, September 2026. - The updates are mandatory and fix around 1,000 security vulnerabilities logged over previous months. - Users can now move the taskbar to any screen edge for the first time in Windows 11. - Windows Search gains a setting to hide Bing web results and Microsoft Store suggestions from local results. - Administrator Protection, which hands out admin rights only when a task needs them, begins rolling out but stays off by default.

Microsoft pushed its September 2026 Patch Tuesday updates for Windows 11 on Tuesday, and the headline number is hard to ignore: roughly 1,000 security vulnerabilities addressed in a single release, covering flaws reported over previous months.

KB5124008 covers Windows 11 versions 25H2 and 24H2; KB5122880 covers 23H2. Because 25H2 shares its codebase with 24H2, both get an identical package with no exclusive changes. Windows Update installs them automatically, or you can go to Settings, then Windows Update, and hit Check for Updates.

What actually got fixed?

A security patch closes holes attackers could exploit to break into a system. Microsoft hasn't flagged any of the roughly 1,000 fixed vulnerabilities as actively exploited, and says it's unaware of new problems introduced by this release. Most home users won't notice any of them. Skipping the reboot for weeks is still the failure mode that matters: unpatched Windows machines remain one of the easiest footholds for attackers on a corporate network.

What's new for everyday users?

The taskbar can finally move. Dock it to the top or either side under Settings, Personalization, Taskbar, Taskbar behaviors, Taskbar position. We covered the preview of this feature on 28 August, so if you installed that optional update, the behaviour is familiar. A small taskbar mode is also new, shrinking icons and bar height for laptops with tighter screens.

The Start menu gets proper sizing options now: small or large, chosen explicitly, rather than the single automatic default. The Recommended section has been renamed Recent, which is more accurate. You can hide your name and profile picture, and toggle Pinned, Recent and All sections independently.

Search gets the change a lot of people have wanted quietly. A new toggle under Settings, Privacy and Security, Search lets you stop web results and Microsoft Store suggestions from appearing alongside local file results. Results now also label their origin, whether app, setting or file, before you click.

Should you worry about the security side?

Probably not panic, but do pay attention to two things.

Administrator Protection is starting to roll out, though it's off by default. First disclosed in October 2025 as part of KB5067036, it stops administrator accounts from carrying full privileges all the time. Admin power gets granted just-in-time through a separate profile when a task actually requires it. Microsoft is clear this isn't a formal security boundary; it's a hardening measure against elevation-of-privilege attacks, where malware running as a normal user tries to grab admin rights. IT teams can enable it via Microsoft Intune or Group Policy.

Also new is Process Isolation for Microsoft Execution Containers, a lightweight sandbox for code produced by AI coding agents. It limits what that code can reach: the filesystem, network calls, the user interface. With developers routinely running model-generated scripts on work machines, that containment boundary is worth understanding before you assume it's switched on.

The part vendors won't put in the press release

Microsoft says it's unaware of new regressions here, but that's what the August notes said too. Pilot it, watch the crash telemetry in Microsoft Intune, then roll broadly. If you manage endpoints, start evaluating Administrator Protection now rather than scrambling when Microsoft eventually flips the default.