KB5123099 – Inconsistent File Served from Single Download URL

ZOHO CORPORATION PRIVATE LIMITED 20 Reputation points
2026-09-09T16:18:38.9233333+00:00

Untitled.png

I'm testing this month's Patch Tuesday update — 2026-09 Cumulative Update for Windows Server 2016 x64 (KB5123099) — and ran into something strange I can't explain.

I downloaded the update from the official Microsoft Update Catalog URL:

https://catalog.s.download.windowsupdate.com/c/msdownload/update/software/secu/2026/09/windows10.0-kb5123099-x64_28560cfadc1030ab60e40ddacd3683165f40bc58.msu

The same URL gave me two completely different files on different download attempts. Both show the same file size (1836 MB), but their checksums don't match and they behave differently:

Download 1 (looks correct):

  • SHA1 matches the filename hash: 28560cfadc1030ab60e40ddacd3683165f40bc58
  • Has a valid digital signature
  • Can be extracted normally

Download 2 (looks wrong):

  • SHA1: 745eb9039f8a8cb857090ce23eadbb06bfc92c3d — doesn't match the filename at all
  • No digital signature (both Embedded and Catalog signature sections are completely empty)
  • 7-Zip throws "Cannot open file as archive" — can't extract it

I know Microsoft always signs Windows Update packages, so the unsigned file clearly isn't right. My guess is that the update was quietly revised after release and some CDN servers are still handing out the old version — but I'm not sure.

A few things I'd like to understand:

  1. Was KB5123099 re-released or revised after the initial Patch Tuesday drop? If so, what's the correct SHA1 I should be verifying against?
  2. Is this a CDN caching issue where certain edge servers haven't been updated yet?
  3. Can someone confirm the unsigned file is not valid and should never be installed?

Any clarification from Microsoft would be really helpful.

Thanks!

Windows for business | Windows Server | Devices and deployment | Install Windows updates, features, or roles
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest
  1. Daphne Huynh (WICLOUD CORPORATION) 1,305 Reputation points Microsoft External Staff Moderator
    2026-09-10T03:16:15.0866667+00:00

    Welcome to Microsoft Q&A!

    Thank you for taking the time to provide these additional details and for the thorough verification steps you have already performed.

    Based on the information you've shared, the behavior you are seeing is consistent with reports that have surfaced following the September 2026 release of KB5123099 for Windows Server 2016.

    The expected update package is:

    • KB5123099 (OS Build 14393.9512)
    • File name: windows10.0-kb5123099-x64_28560cfadc1030ab60e40ddacd3683165f40bc58.msu
    • Microsoft Update Catalog size: 1,925,648,806 bytes (approximately 1.8 GB)

    The SHA1 value embedded in the file name (28560cfadc1030ab60e40ddacd3683165f40bc58) matches the hash published for the package and aligns with the hash reported by customers who successfully downloaded a valid, digitally signed MSU package. Microsoft update packages should be digitally signed and can normally be extracted using standard tools such as DISM, expand.exe, or 7-Zip.

    In contrast, the second file you obtained appears to be invalid for several reasons:

    • Its SHA1 hash does not match the published package identifier.
    • The file does not contain a valid embedded or catalog signature.
    • Archive extraction tools are unable to open the package.
    • SmartScreen and signature validation checks fail.

    Because of these indicators, the unsigned MSU package should be treated as corrupted or incomplete and should not be installed.

    Regarding your question about whether KB5123099 was re-released, I have not found any public documentation indicating that Microsoft has published a revised version of the update or changed the official package hash. The public KB article continues to reference the same release, and Microsoft currently reports no known issues with the update itself.

    Based on the available information, the most likely explanation is a temporary content distribution or caching issue, where some download endpoints served corrupted content while others provided the correct package. The fact that downloads from the same URL produced files with identical sizes but different hashes strongly suggest an integrity issue somewhere in the distribution path rather than a local download problem. This is consistent with reports from other customers who experienced hash mismatches, signature validation failures, extraction failures, and installation errors such as 0x8007000D and 0x8007065E.

    Recommended actions:

    1. Verify the file hash before installing the update.
    2. Confirm that the package contains a valid Microsoft digital signature.
    3. If the hash does not match the published value or the signature is missing, delete the file and download a fresh copy.
    4. Do not attempt to install an unsigned package.
    5. If newly downloaded copies continue to differ, open a Microsoft support case and reference the ongoing KB5123099 download integrity investigation.

    In summary, the package whose SHA1 hash matches 28560cfadc1030ab60e40ddacd3683165f40bc58 should be considered the valid version of KB5123099. The unsigned package with SHA1 745eb9039f8a8cb857090ce23eadbb06bfc92c3d should be considered corrupt and should not be installed. At this time, there is no evidence that Microsoft intentionally republished KB5123099 with a different hash.

    References: September 8, 2026—KB5123099 (OS Build 14393.9512) | Microsoft Support

    Windows Server containers for September 2026 | Microsoft Support

    If you find this information helpful, please click Accept Answer. 

    Thank you for using Microsoft Q&A.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.