Microsoft has published a temporary workaround for gaming issues affecting Windows 11 devices after the August 2026 Patch Tuesday cumulative update. According to reporting by BleepingComputer, users began experiencing degraded gaming performance — including stuttering, frame drops, and instability in GPU-intensive workloads — shortly after installing the August 2026 security updates. Microsoft has acknowledged the regression and is mitigating it through a Known Issue Rollback (KIR) while engineering a permanent fix for a future cumulative update.
For enterprise defenders, this is not a vulnerability story — it's a patch assurance and change-control story. But it carries real security implications in three directions:
- Patch hesitation: High-profile regressions like this erode organizational confidence in Patch Tuesday deployment, and delayed security patching is one of the most consistent root causes in the ransomware and intrusion engagements we respond to.
- Unauthorized rollback: Users and even IT staff may uninstall the cumulative update entirely to restore gaming performance — silently stripping out every security fix shipped in the same package.
- Audit gap: If you can't see which endpoints uninstalled the update or received the KIR, you can't attest to your patch posture during an incident or audit.
This post walks through how to verify which endpoints are affected, how to apply Microsoft's sanctioned mitigation correctly, and how to detect unauthorized update removal across your environment.
Technical Analysis
Affected Platforms
- Windows 11 devices that installed the August 2026 Patch Tuesday cumulative update
- Impact is concentrated in gaming and GPU-intensive workloads (DirectX titles, 3D rendering paths), but the update package itself contains the month's full set of security fixes
- Consumer devices receive the Known Issue Rollback automatically; enterprise-managed devices require the KIR Group Policy MSI from Microsoft's release health documentation
How Known Issue Rollback Works
KIR is Microsoft's server-side mechanism for reverting a non-security code change inside a cumulative update without removing the update itself. The security fixes remain installed; only the offending feature change is disabled. This is the critical distinction defenders must enforce:
- KIR applied → security patches intact, regression neutralized. Acceptable posture.
- Update uninstalled via
wusa.exe /uninstallor DISM → security patches gone. Unacceptable posture on any managed endpoint.
The KIR for enterprise devices is delivered as a Group Policy definition that writes a rollback key under the Windows Update policy registry path. Once applied and the device reboots, the problematic code path is disabled.
Why This Matters to Security Operations
In our IR casework, we routinely find endpoints that were "patched" on paper but had cumulative updates manually removed by users chasing performance or compatibility. Every August 2026 security fix — including whatever privilege-escalation and RCE fixes shipped that month — leaves the system the moment someone runs an update uninstall. Attackers don't need a zero-day when your users are voluntarily rolling back to a vulnerable build.
Exploitation Status
There is no CVE and no active exploitation tied to this story — the risk is entirely defensive posture degradation from improper remediation of a quality regression.
Detection & Response
The detection objectives here are twofold: (1) find endpoints where the cumulative update was uninstalled rather than mitigated via KIR, and (2) audit KIR deployment so you can attest to posture.
Sigma Rules
---
title: Windows Update Uninstallation via WUSA or DISM
id: 3f8c2e71-9b4d-4a6e-b812-7d5e9f0a1c34
status: experimental
description: Detects manual removal of installed Windows updates using wusa.exe or DISM. During update regression events, users or administrators may uninstall cumulative updates, which also removes all security fixes contained in the package. Audit and justify every occurrence.
references:
- https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-temporary-fix-for-windows-11-gaming-issues/
- https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/08/15
tags:
- attack.defense_evasion
- attack.t1562
logsource:
category: process_creation
product: windows
detection:
selection_wusa:
Image|endswith: '\wusa.exe'
CommandLine|contains: '/uninstall'
selection_dism:
Image|endswith: '\dism.exe'
CommandLine|contains:
- '/Remove-Package'
- 'remove-package'
condition: 1 of selection_*
falsepositives:
- Authorized IT rollback activity during sanctioned regression mitigation
- WSUS/Intune-driven update remediation workflows
level: medium
---
title: Known Issue Rollback Policy Registry Modification
id: 8a1d4f63-2c7b-49e5-a3d8-5e6b0c9f2a71
status: experimental
description: Detects registry writes under the Windows Update policy path associated with Known Issue Rollback activation or tampering. Use to confirm sanctioned KIR deployment and to alert on unexpected modification of update policy keys.
references:
- https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-temporary-fix-for-windows-11-gaming-issues/
author: Security Arsenal
date: 2026/08/15
tags:
- attack.defense_evasion
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- '\Policies\Microsoft\Windows\WindowsUpdate'
- '\CurrentVersion\Policies\Explorer\KnownIssueRollback'
falsepositives:
- Legitimate KIR Group Policy application by domain controllers or MDM
- Microsoft deployment of the sanctioned rollback policy
level: low
KQL (Microsoft Sentinel / Defender)
Hunt for endpoints where the August cumulative update was uninstalled — these are your exposed assets. Correlate against your authorized change tickets before treating any hit as benign.
// Hunt: manual update removal activity across the fleet (last 14 days)
// Flags both wusa.exe and DISM-based package removal
let lookback = 14d;
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("wusa.exe", "dism.exe", "powershell.exe")
| where ProcessCommandLine has_any ("/uninstall", "/kb:", "Remove-Package", "Uninstall-WindowsUpdate", "Remove-WindowsUpdate")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| order by TimeGenerated desc;
// Companion hunt: identify interactive (non-SYSTEM) users removing updates —
// SYSTEM/TrustedInstaller removal is often servicing; interactive removal is the risk
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName =~ "wusa.exe" or ProcessCommandLine has "Uninstall-WindowsUpdate"
| where InitiatingProcessAccountName !in~ ("system", "nt authority\\system", "trustedinstaller")
| summarize UninstallAttempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
by DeviceName, InitiatingProcessAccountName, ProcessCommandLine
| order by LastSeen desc
Velociraptor VQL
Use this artifact to enumerate installed hotfixes across hunted endpoints and confirm whether the August 2026 cumulative update is still present. Feed the resulting KB list into your patch compliance dashboard.
-- Enumerate installed Windows hotfixes and flag recent update removal events
-- Confirms whether the August 2026 cumulative update remains installed per endpoint
LET hotfixes = SELECT HotFixID, Description, InstalledOn, InstalledBy
FROM wmi(query="SELECT HotFixID, Description, InstalledOn, InstalledBy FROM Win32_QuickFixEngineering", namespace="root/cimv2")
LET removal_events = SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE CommandLine =~ '(?i)(/uninstall|Remove-Package|Uninstall-WindowsUpdate)'
SELECT * FROM hotfixes
ORDER BY InstalledOn DESC
Remediation Script
The following PowerShell verifies whether August 2026 updates are installed, detects evidence of manual update removal, and checks KIR policy presence. Run it via your RMM or Intune as a detection/remediation pair. Confirm the exact KB number against Microsoft's Windows release health dashboard before targeting removal or rollback — do not hardcode assumptions.
# Security Arsenal - August 2026 Windows 11 Update Regression Posture Check
# Run elevated. Review output before taking any removal action.
# 1. Inventory updates installed in August 2026
Write-Host "=== Updates installed August 2026 ===" -ForegroundColor Cyan
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date "2026-08-01") } |
Sort-Object InstalledOn | Format-Table HotFixID, Description, InstalledOn -AutoSize
# 2. Check for the Known Issue Rollback policy key (enterprise-managed devices)
Write-Host "=== KIR Policy Presence ===" -ForegroundColor Cyan
$kirPaths = @(
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate",
"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\KnownIssueRollback"
)
foreach ($path in $kirPaths) {
if (Test-Path $path) {
Write-Host "[FOUND] $path" -ForegroundColor Green
Get-ItemProperty -Path $path | Format-List
} else {
Write-Host "[MISSING] $path" -ForegroundColor Yellow
}
}
# 3. Detect evidence of manual update removal in the last 30 days
Write-Host "=== Update Removal Events (last 30 days) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Setup'; Id=3; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match 'uninstall|removal' } |
Select-Object TimeCreated, Message | Format-List
# 4. Report OS build for patch compliance reconciliation
Write-Host "=== Current Build ===" -ForegroundColor Cyan
Get-ComputerInfo | Select-Object OsName, OsBuildNumber, OsVersion, OsHardwareAbstractionLayer
# REMEDIATION (only after confirming the affected KB against Microsoft's advisory):
# - Preferred: deploy the KIR Group Policy MSI from Microsoft's release health page
# and force a gpupdate + reboot. Security fixes remain installed.
# - NOT recommended: wusa.exe /uninstall /kb:<KBNumber> — this strips all August
# 2026 security fixes. Use only as an absolute last resort with compensating
# controls, and track the device as an exception until re-patched.
Remediation Guidance
- Do not uninstall the cumulative update. The sanctioned path is Microsoft's Known Issue Rollback, which disables the problematic non-security change while leaving the August 2026 security fixes intact. Update removal should be treated as a policy violation on managed endpoints.
- Consumer/single devices: The KIR propagates automatically via Windows Update — a reboot is typically required. Verify after reboot that gaming performance is restored and the update remains listed under installed updates.
- Enterprise-managed devices: Download the KIR Group Policy MSI referenced in Microsoft's Windows release health entry for this issue, deploy it via Group Policy or Intune, and confirm application with the script above.
- Reconcile patch posture: Cross-reference endpoints flagged by the KQL hunts against authorized change records. Any device that uninstalled the update outside of change control must be re-patched immediately and treated as a compliance exception.
- Don't let this derail your patch cadence: Regression stories generate outsized fear. The correct response is a ringed deployment model (pilot → broad) with a documented rollback path — not skipping Patch Tuesday. The vulnerabilities fixed in the same package are the ones we see weaponized in ransomware intrusions within weeks of disclosure.
- Monitor the official channels: Microsoft's Windows release health dashboard and the original BleepingComputer coverage will be updated when the permanent fix ships in a subsequent cumulative update.
Final Assessment
This story is a quality regression, not an exploitable vulnerability — but the defensive failure mode it creates is very real. The organizations that get breached in September will include a measurable fraction whose users or admins ripped out the August update to fix frame rates. Know your fleet, enforce KIR over uninstall, and audit every rollback.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.