Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.
Microsoft's September 2026 Patch Tuesday includes 964 Microsoft vulnerabilities requiring customer action, a record attributed to AI-assisted bug discovery, plus 174 third-party/open-source and 23 Chromium/Edge CVEs. Two zero-days are exploited in the wild: CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape and privilege escalation, and CVE-2026-81963, a Windows Update Stack escalation to SYSTEM. CVE-2026-69730, an unauthenticated Windows DNS RCE, is not yet exploited but Microsoft expects exploitation, and roughly 20 bugs could be wormable. Separately, SAP issued a critical CVSS 10.0 fix for the EPP component used in S/4HANA and NetWeaver.
ZDI's September 2026 Microsoft update review lists two already-exploited Windows EoP zero-days and dozens of critical RCEs across Office, SQL Server, and Windows services.
The review catalogs Microsoft's September 2026 fixes, marking CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack) as already exploited elevation-of-privilege issues. It also lists critical RCE flaws in Office, Word, Excel, PowerPoint, Outlook, SQL Server, Windows DNS, DHCP and Failover Cluster, plus graphics component RCEs. Azure-side fixes include Entra ID, Copilot Studio, Azure AI Language and Azure AD B2C elevation-of-privilege flaws.
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.
Local Privilege Escalation via Link Following in Windows Update Stack
CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.
· Microsoft Windows 11 23H2, 24H2, 25H2, 26H1 · Microsoft Windows Server 2025 KEVmass
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
· Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
Signature Verification Flaw Allows Privilege Escalation in Microsoft Copilot Studio
Microsoft Copilot Studio, the low-code cloud service in the Power Platform used to build AI copilots and agents, fails to properly verify cryptographic signatures on certain network traffic (CWE-347), allowing signature checks to be bypassed. An unauthenticated attacker can trigger the flaw remotely over a network with no user interaction by sending a crafted request whose signature is accepted without correct verification. Successful exploitation elevates the attacker's privileges, and the changed-scope CVSS metric plus high confidentiality, integrity, and availability ratings indicate impact that extends beyond the immediate component. Because Copilot Studio is a multi-tenant Microsoft-hosted service, every organization using the service falls within the blast radius, and there are no on-premises versions to inventory. As of the September 2026 Patch Tuesday disclosure, no in-the-wild exploitation is known, there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a modest 0.3% probability of exploitation within 30 days.
Authorization Bypass Through User-Controlled Key in Microsoft Azure Cosmos DB
CVE-2026-69857 is an authorization bypass through a user-controlled key (CWE-639, an IDOR-style flaw) in Microsoft Azure Cosmos DB, Microsoft's managed NoSQL database service: an authenticated principal can supply or alter a resource identifier (key) that the service fails to validate against the caller's permissions. Triggered over a network by a low-privileged, authorized user who manipulates such a key (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N), the flaw lets the attacker bypass access checks and perform spoofing, i.e., impersonate another identity or act outside their authorized scope. Per the CVSS vector, successful exploitation carries high impact on the confidentiality, integrity, and availability of data in the affected database account, since the attacker can read or modify data as a different authorized identity. Any organization using Azure Cosmos DB is potentially affected; because it is a fully managed Azure service there are no customer-managed installations, and no affected version ranges are specified in the advisory data. The flaw was addressed in Microsoft's September 2026 Patch Tuesday cycle (966 flaws fixed, including 2 zero-days); no public proof-of-concept is known, it is not in CISA's KEV, and EPSS estimates only a ~0.4% chance of exploitation within 30 days.
Missing Authorization in Microsoft Entra ID Enables Privilege Escalation
CVE-2026-83941 is a missing-authorization flaw (CWE-862) in Microsoft Entra ID, the cloud identity service behind Microsoft 365 and Azure. An already-authenticated, low-privileged user can send a network request to an Entra ID endpoint that fails to enforce proper authorization checks, requiring no user interaction. Exploitation lets the attacker elevate their privileges within the directory, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Any organization that uses Microsoft Entra ID is in the affected population. The flaw was patched in Microsoft's September 2026 Patch Tuesday release; it is not in CISA KEV, has no known public proof-of-concept, and carries a low EPSS of roughly 0.7%.
Authentication Bypass in Microsoft Entra ID Enables Privilege Elevation
CVE-2026-62916 is an authentication bypass (CWE-288) in Microsoft Entra ID, Microsoft's cloud identity and access management service, in which an alternate path or channel allows authentication checks to be circumvented. Per the CVSS vector, it is exploitable remotely over a network with no privileges and no user interaction required, by authenticating via an alternate path instead of the standard sign-in flow. A successful unauthenticated attacker gains the ability to elevate privileges, with high impact on confidentiality, integrity, and availability reflected in the 9.8 critical score. The affected population includes organizations relying on Entra ID, which is the default identity platform for Microsoft 365, Azure, and hybrid deployments; the available data does not specify affected versions or the specific sub-component involved. There is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not in CISA's KEV; EPSS assigns a 0.6% probability of exploitation within 30 days.
Missing-Authorization Local Privilege Escalation in Microsoft Data Sharing Service Client
CVE-2026-73014 is a missing authorization flaw (CWE-862) in the Data Sharing Service Client, a Microsoft component assigned by the Microsoft CNA. A local attacker who already holds a low-privileged authorized account on the machine can invoke the service without a required authorization check and elevate privileges. Successful exploitation yields high impact to confidentiality, integrity, and availability (CVSS 7.8), which typically means gaining elevated rights on the local system. Any system running the affected component is exposed, though the attack requires local access and is not remotely exploitable. There is no known public proof-of-concept, it is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.3%; the fix shipped in Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws.
Heap Buffer Overflow in Windows Graphics Kernel Enables Local Code Execution
CVE-2026-73017 is a heap-based buffer overflow (CWE-122) in the Windows Graphics Kernel, fixed by Microsoft in its September 2026 security update release. It is triggered locally: per the CVSS vector, an attacker already holding high privileges on the target machine, with no user interaction and high attack complexity, must successfully exploit the memory corruption. A successful exploit yields code execution with a scope change, meaning the attacker's code runs beyond the vulnerable component's normal security context (typically the kernel), with high impact to confidentiality, integrity, and availability. All Windows systems running the affected builds are potentially exposed, but exploitation requires a local attacker who already has elevated credentials, which limits exposure to scenarios such as compromised accounts or privilege/sandbox-escape chains. No exploitation is currently known: the flaw is not in CISA KEV, has no public proof-of-concept, and EPSS assigns it only a 0.3% probability of exploitation within 30 days (17th percentile).
· Microsoft Windows (Graphics Kernel component)mass
Unauthenticated out-of-bounds read DoS in Microsoft Windows BranchCache
CVE-2026-69329 is an out-of-bounds read (CWE-125, arising from an integer-overflow condition, CWE-190) in the BranchCache component of Microsoft Windows. A remote, unauthenticated attacker can trigger the flaw over the network with no privileges or user interaction by sending malformed input to a system running BranchCache. Successful exploitation results only in denial of service of the BranchCache service — availability impact with no information disclosure or tampering (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Affected systems are Windows installations with the optional BranchCache feature enabled, such as branch-office caching deployments (Hosted Cache Servers or clients in distributed mode); the provided data does not specify affected version ranges. There is currently no known exploitation: the flaw was addressed in Microsoft's September 2026 Patch Tuesday (part of a 966-flaw release), has no public PoC, is not in CISA KEV, and carries an EPSS of 1.1% (62nd percentile).
· Microsoft Windows BranchCache (component of Windows client and Windows Server)large
Use-After-Free Local Privilege Escalation in Microsoft Windows AVCTP Component
CVE-2026-69401 is a use-after-free (CWE-416) in the Audio Video Control Transport Protocol (AVCTP) component of Microsoft Windows, the protocol layer used to control Bluetooth audio and video devices. A local, authorized (low-privileged) attacker can trigger the flaw by interacting with the vulnerable protocol handling such that memory is freed while still in use, though the high attack-complexity score indicates reliable triggering is non-trivial. Successful exploitation lets the attacker elevate privileges locally on the affected machine, with high impact to confidentiality, integrity, and availability once elevated. Any Windows system that includes the AVCTP/Bluetooth component is affected, meaning a very broad portion of the Windows installed base. Exploitation status is currently calm: there is no known public proof-of-concept, the flaw is not in CISA KEV, EPSS is low at 0.2%, and the fix shipped as part of Microsoft's September 2026 Patch Tuesday (966 flaws fixed, including 2 zero-days).
· Microsoft Windows (Audio Video Control Transport Protocol / Bluetooth AVCTP component)mass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.