Full Report
Microsoft has confirmed that some users may experience desktop loading issues, including black screens, after installing the August 2026 preview updates and subsequent updates. [...]
Analysis Summary
# Vulnerability: Windows Desktop Loading and Black Screen Bug (August/September 2026 Updates)
## CVE Details
- **CVE ID**: N/A (Functional Bug / Regression)
- **CVSS Score**: N/A
- **CWE**: N/A (Resource initialization/Management issue)
## Affected Systems
- **Products**: Windows 11, Windows Server 2025, Azure Virtual Desktop (AVD).
- **Versions**:
- Windows 11 26H1
- Windows 11 25H2
- Windows 11 24H2
- Windows Server 2025
- **Configurations**: Systems using **FSLogix** for user profile management (primarily in virtualized environments) are most significantly impacted.
## Vulnerability Description
This is a functional regression introduced in the August 2026 preview and September 2026 Patch Tuesday updates. The flaw causes a failure in the desktop initialization process. Specifically, Windows Explorer fails to launch automatically after user authentication, leading to a persistent black screen. Application event logs indicate frequent Windows Explorer (`explorer.exe`) crashes during the sign-in phase.
## Exploitation
- **Status**: Not exploited (Functional stability issue).
- **Complexity**: N/A.
- **Attack Vector**: Local (Triggered by standard user sign-in after update installation).
## Impact
- **Confidentiality**: None.
- **Integrity**: None.
- **Availability**: **High** (Prevents users from accessing the desktop environment and interacting with the OS GUI).
## Remediation
### Patches
Microsoft has not yet released a permanent cumulative update fix. A future update is expected to resolve this permanently. Current problematic updates include:
- KB5120996, KB5120998, KB5124008, and KB5122880.
### Workarounds
1. **Manual Explorer Launch**:
- Press `Ctrl+Shift+Esc` to open Task Manager.
- Select **Run new task**.
- Type `explorer.exe` and click **OK**.
2. **Known Issue Rollback (KIR)**: Microsoft has issued KIR via Group Policy to disable the specific code change causing the issue.
## Detection
- **Indicators of Compromise**: Not applicable; however, indicators of the flaw include:
- User reports of "Black Screen" post-login.
- Event Viewer: Application logs showing repeated `explorer.exe` termination or crashes.
- **Detection Methods**: IT Administrators can monitor AVD environments for sessions that hang at the login phase without initializing the shell.
## References
- Microsoft Release Health: [https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-26h1#devices-might-experience-a-black-screen-or-desktop-loading-issues-after-sign-in] (Defanged)
- KIR Policy (26H1): [https://download.microsoft.com/download/09efb4c6-54f4-4e63-83c7-4314187230bf/Windows%2011%2026H1%20KB5124006%20260924_20071%20Known%20Issue%20Rollback.msi] (Defanged)
- KIR Policy (24H2/25H2/Server 2025): [https://download.microsoft.com/download/8c71622d-e0eb-4838-b25c-ddb99a7bf971/Windows%2011%2024H2,%20Windows%2011%2025H2%20and%20Windows%20Server%202025%20KB5124010%20260924_20021%20Known%20Issue%20Rollback.msi] (Defanged)
- Microsoft Support (KIR Guidance): [https://docs.microsoft.com/en-us/troubleshoot/windows-client/group-policy/use-group-policy-to-deploy-known-issue-rollback] (Defanged)