Microsoft bundles September's 1,000 Windows 11 fixes with a movable taskbar and new Search defaults

The count is the only published detail about the security half of this package. One thousand vulnerabilities, described as discovered in previous months, in the ninth Patch Tuesday release of 2026 ^[3][4], with no CVE named, no severity assigned and nothing flagged as exploited in the notes BleepingComputer reproduced ^[18]. A backlog being closed out reads differently from a fresh wave, and neither the round figure nor the phrasing lets anyone rank the contents or argue for an emergency ring.

The interface changes get the detailed treatment. The taskbar can now sit at the bottom, top, left or right, with the search box and the small taskbar mode working only in the top and bottom positions ^[7]. A small taskbar setting shrinks both icon size and bar height ^[8]. The Start menu gains a size choice, "Recommended" is renamed "Recent", and users can hide their name and profile picture ^[10]. Progress indicators change across startup, sign-in, restart, shutdown and update installation ^[16]. None of that breaks an application. It does invalidate the screenshots in internal documentation, and it moves the pixels that coordinate-based test automation and kiosk scripts depend on.

Two entries in the same changelog are security settings carrying feature labels. Windows now indexes a user's most used folders automatically, with the control at Settings > Privacy & Security > Search > Automatically find additional relevant locations ^[12]. The index footprint grows by default, and the opt-out is documented as a per-user toggle with no group policy or MDM path given ^[19]. The second is the new choice over whether web and Microsoft Store suggestions appear alongside local results, on the same settings page ^[11]. That turns the outbound half of the search box into a position a baseline can assert.

Then there is Share. Users signed in with a work or school account can discover and install apps directly from the share window, managed at Settings > System > Share ^[13]. The install path is scoped to exactly the accounts an enterprise manages.

The validation arithmetic is kinder than the feature list suggests. 25H2 is based on 24H2 and receives the same update with no exclusive or special changes ^[5], so KB5124008 is one payload spanning two versions while KB5122880 covers 23H2 ^[1]. That is two images to soak, not three ^[17]. Delivery is the ordinary Windows Update check or a manual pull from the Microsoft Update Catalog ^[6].

The deadline is set by the mandatory flag rather than by any published exploitation ^[2]. Everything above arrives with it, which puts the indexing and suggestion settings in front of a fleet before most baselines have a line for either one ^[12][11].