Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including two zero-days already exploited in the wild.
Microsoft's September 2026 Patch Tuesday addresses 973 vulnerabilities across Windows, Office, and Azure components, including two zero-days already exploited in the wild. CVE-2026-81963, an elevation of privilege flaw in the Windows Update Stack, is flagged as an exploited zero-day. The release includes numerous remote code execution and information disclosure fixes for Microsoft Excel and Word, plus patches for the Windows kernel, ALPC, Print Spooler, ReFS, Entra ID, and Azure CLI.
Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.
Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.
Microsoft patched CVE-2026-69836 (CVSS 10.0), a deserialization RCE in Entra ID; the flaw was fully mitigated service-side and was not exploited in the wild.
Microsoft disclosed CVE-2026-69836, a CVSS 10.0 remote code execution flaw in Entra ID caused by deserialization of untrusted data, and said the issue was fully mitigated on the service side with no customer action required. The security bulletin initially marked the flaw as exploited, but Microsoft corrected the status to not exploited in the wild on August 21, 2026. Microsoft credited principal security engineer Robert Fitzpatrick with the discovery. The article also recalls the Lazarus Group's exploitation of Windows WinSock AFD zero-day CVE-2026-68820 (CVSS 7.0) in the Operation Dream Job campaign.
AWS detailed propagating user authorization context through Bedrock AgentCore so downstream services enforce access controls even if the agent is manipulated via prompt injection.
AWS described an architecture for Amazon Bedrock AgentCore where user tokens and department claims are validated at runtime and propagated to DynamoDB, Bedrock Knowledge Bases, and Salesforce. Downstream services enforce authorization themselves, so a prompt-injected or buggy agent cannot retrieve data the user is not entitled to see. AWS demonstrated the pattern with a CRM use case separating Sales and Finance access and recommends IAM-backed knowledge bases for stricter isolation.
Wiz details how adversaries use realistic device names in Entra ID registrations to evade detection and which behavioral signals still expose them.
Wiz researchers describe how adversaries generate realistic device names during Entra ID device registration instead of leaving recognizable fingerprints from public tooling, making rogue device joins blend into enterprise environments. The post explains how this trend changes Entra ID detection approaches. It also identifies behavioral signals that still expose these attacks. No specific CVE or victim was named.
Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.
SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.
Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that handles Winsock socket operations. A local, authenticated attacker can trigger the memory corruption through crafted socket activity, and the high attack-complexity score (AV:L/AC:H/PR:L) indicates exploitation requires a specific, likely race-sensitive sequence of operations. Successful exploitation elevates privileges to SYSTEM, giving the attacker full control of the host, and public reporting describes deployment of a backdoor after privilege escalation. Virtually every Windows 10, Windows 11, and Windows Server (2012-2022) installation ships this driver, so the affected population is essentially the entire supported Windows installed base. The flaw is being exploited in the wild: CISA added it to the KEV on 2026-08-11, Microsoft fixed it in the August 2026 Patch Tuesday release, and reporting ties active exploitation to North Korea's Lazarus group, who paired the zero-day with fake job-offer lures.
· Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) as shipped with the Windows versions listed below · Microsoft Windows 10 1607, 1809, 21H2, 22H2 KEVmass
Use-After-Free RCE in Windows Message Queuing (MSMQ)
CVE-2026-83997 is a use-after-free (CWE-416) vulnerability in Microsoft's Windows Message Queuing (MSMQ) service that permits an unauthenticated, remote attacker to execute arbitrary code over the network. It is triggered when the MSMQ service processes specially crafted network traffic that causes memory to be used after it has been freed, with the high attack-complexity rating (AC:H) indicating the attacker likely needs to win a timing or state race to land the free-then-use condition. Successful exploitation yields code execution in the context of the MSMQ service, with high confidentiality, integrity, and availability impact, meaning an attacker could take over the affected host. Only Windows systems that have the optional Message Queuing (MSMQ) feature installed and running are exposed, since MSMQ is not enabled by default on most Windows installations and is typically found on legacy application and queuing servers. There is no evidence of exploitation so far: the flaw is not in CISA's KEV, no public proof-of-concept is known, EPSS is 0.5% (42nd percentile), and the two actively exploited zero-days mentioned in September 2026 Patch Tuesday headlines are separate issues fixed in the same release.
· Microsoft Windows Message Queuing (MSMQ) - Windows releases with the optional Message Queuing feature installed and runninglarge
Heap Buffer Overflow in Microsoft Graphics Component Enables Local Code Execution
CVE-2026-84000 is a heap-based buffer overflow (CWE-122) involving an integer-overflow condition (CWE-190) in the Microsoft Graphics Component. An attacker who is already authorized on the machine with low privileges can trigger the overflow locally, with no user interaction required per the CVSS vector (AV:L/AC:L/PR:L/UI:N). Successful exploitation yields local code execution with high impact on confidentiality, integrity and availability (C:H/I:H/A:H), consistent with an elevation-of-privilege outcome on the affected system. Any supported Windows system containing the Graphics Component is affected, and Microsoft addressed the flaw among the 973 vulnerabilities fixed in the September 2026 Patch Tuesday release. Exploitation has not been observed: the bug is not on CISA's KEV, no public proof-of-concept is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.
· Microsoft Graphics Component (shipped with Windows client and server editions)mass
Use-After-Free Privilege Escalation in Windows Biometric Service
CVE-2026-83979 is a use-after-free flaw (CWE-416) in the Windows Biometric Service, the component that handles fingerprint, facial, and other biometric authentication on Windows. An attacker who is already authorized on the machine with low privileges can trigger the bug, presumably by sending crafted input to the service that causes memory to be used after it has been freed. Successful exploitation allows local elevation of privileges, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected range spans mainstream Windows 10 and Windows 11 client releases plus Windows Server 2016 through 2025, covering nearly the entire currently supported Windows estate. As of the September 2026 Patch Tuesday disclosure there is no CISA KEV listing, no known public proof-of-concept, and EPSS estimates only a 0.3% chance of exploitation within 30 days; the flaw is not identified as one of the two zero-days actively exploited that month.
· Microsoft Windows 10 1607 (builds prior to the September 2026 security updates) · Microsoft Windows 10 1809 (builds prior to the September 2026 security updates)mass
Local Privilege Elevation via Heap Buffer Overflow in Windows Biometric Service
CVE-2026-83978 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the built-in component that handles fingerprint, face, and other biometric authentication on Windows. An attacker who already has a standard (low-privileged) account on the machine can trigger the flaw locally, with no user interaction required, causing memory corruption in the service. Successful exploitation allows the attacker to elevate privileges on the local host, gaining high confidentiality, integrity, and availability impact — a classic local privilege escalation to administrative/SYSTEM-level access. Anyone running the affected Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1) client builds, or Windows Server 2016, 2019, 2022, or 2025, is in scope, and because the Biometric Service ships with Windows by default the exposure spans essentially the entire installed base on those branches. As of the September 2026 Patch Tuesday release (which fixed 973 vulnerabilities and two other actively exploited zero-days), no public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and its EPSS of 0.3% (25th percentile) points to low near-term exploitation risk.
· Microsoft Windows 10 1607 1607 · Microsoft Windows 10 1809 1809mass
Heap Buffer Overflow in Windows Biometric Service Enables Local Privilege Escalation
CVE-2026-83985 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WbioSrvc) on supported Windows 10, Windows 11, and Windows Server releases. A local, already-authenticated user with low privileges and no user interaction can trigger the overflow via a crafted request or operation handled by the service. Successful exploitation yields elevated privileges on the local host, with high impact on confidentiality, integrity, and availability — effectively a full local compromise. Any organization or individual running the listed Windows 10/11 client versions or Windows Server 2016–2025 is exposed, though exploitation requires local code execution first. The flaw is not in CISA KEV, has no known public PoC, a modest 0.3% EPSS, and is believed unexploited; it was addressed in Microsoft's September 2026 Patch Tuesday release, which fixed 973 vulnerabilities (two of them already-exploited zero-days, though not this one).
· microsoft Windows 10 1607, 1809, 21H2, 22H2 · microsoft Windows 11 23H2, 24H2, 25H2, 26H1mass
Out-of-bounds Read in Windows Kerberos KDC Enables Network Denial of Service
CVE-2026-84001 is an out-of-bounds read (CWE-125) in the Windows Key Distribution Center (KDC), the Kerberos authentication component built into Windows. An unauthorized, remote attacker can trigger it by sending specially crafted network requests to the KDC service, causing the service to read beyond allocated memory. According to the CVSS vector, the impact is availability-only (C:N/I:N/A:H): the attacker gains denial of service, not code execution, data theft, or tampering, though taking down the KDC on domain controllers can disrupt Kerberos authentication for an entire Active Directory domain. Any Windows system running the KDC is affected, chiefly Windows domain controllers and servers, although the specific affected Windows version ranges are not enumerated in the available data. There is no known public proof-of-concept, the CVE is not in CISA's KEV catalog, and its EPSS probability of ~0.6% suggests exploitation risk is currently low; the fix shipped in Microsoft's September 2026 Patch Tuesday release.
· Microsoft Windows (Key Distribution Center / Kerberos KDC service, primarily on Windows domain controllers and servers)mass
Use-After-Free Local Privilege Escalation in Windows Kernel (CVE-2026-85360)
CVE-2026-85360 is a use-after-free (CWE-416) memory-safety flaw in the Windows kernel. An attacker with valid low-privileged local access must execute code that triggers the flawed kernel memory handling (rated high attack complexity, suggesting a timing- or race-sensitive trigger), causing the kernel to reference freed memory. Successful exploitation elevates the attacker's privileges locally, typically to SYSTEM, giving full control of the affected machine. It affects a broad range of supported Windows 10 and Windows 11 client builds as well as Windows Server 2012 through 2022, so nearly any Windows endpoint or server in an organization's fleet may be in scope. No public proof-of-concept, no CISA KEV listing, and a low EPSS (0.2%, 14th percentile) indicate exploitation is not known at publication, though the flaw was disclosed amid Microsoft's September 2026 Patch Tuesday, which fixed 973 vulnerabilities including two exploited zero-days.
· microsoft Windows 10 1607 · microsoft Windows 10 1809mass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.