Microsoft's September Patch Tuesday update KB5002914 breaks copy-and-paste and formula dragging in Excel 2016 through 2024; uninstalling the update restores functionality.
Users on Reddit and Microsoft Q&A report that the KB5002914 security update shipped in the September 2026 Patch Tuesday breaks copy-and-paste, autofill, and formula dragging in Excel. The problem spans Office 2016 through 2024 across MSI and Click-to-Run installations, including Office LTSC Standard 2021, with some teams blocked after widespread patching. Uninstalling KB5002914 or downgrading the Office build restores functionality, though replacing the excel.exe binary is not recommended. BleepingComputer could not reproduce the issue on Excel 2019 Version 2508 Build 19127.20302 and contacted Microsoft for comment.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.
Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.
Huntress maps AD RMS architecture and recon paths, setting up an offline key-extraction attack against its unrotatable 255-year root key.
Huntress's multi-part research examines Active Directory Rights Management Services, Microsoft's enterprise DRM role that still ships in Windows Server 2025 despite migration guidance favoring Azure Information Protection. Part 1 covers the trust model and how an ordinary domain account can locate RMS clusters and read rights-policy templates. Part 2 will detail four independent paths for extracting the Server Licensor Certificate (SLC) private key via service-group membership and the configuration database, enabling fully offline decryption of protected documents. The SLC certificate is valid from 2002 to 2258 and has no key-rotation mechanism, so a stolen key decrypts protected content indefinitely.
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
· Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
Local Privilege Escalation via Link Following in Windows Update Stack
CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.
· Microsoft Windows 11 23H2, 24H2, 25H2, 26H1 · Microsoft Windows Server 2025 KEVmass
Heap-Based Buffer Overflow in Windows Imaging Component Allows Network RCE
CVE-2026-69860 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component, the built-in Windows subsystem responsible for decoding image formats. An unauthenticated remote attacker can trigger the flaw by getting a user to open or preview a specially crafted image file (the CVSS vector is network-based but requires user interaction). Successful exploitation allows arbitrary code execution in the context of the affected user, with high impact on confidentiality, integrity, and availability. Any Windows installation carrying the affected Imaging Component is exposed, and the fix is distributed through Microsoft's September 2026 security updates. There is currently no known in-the-wild exploitation, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.8%.
· Microsoft Windows Imaging Component (component of Windows client and server editions)mass
Heap Buffer Overflow RCE in Windows Routing and Remote Access Service (RRAS)
Microsoft's Routing and Remote Access Service (RRAS) contains a heap-based buffer overflow (CWE-122) that permits remote code execution on the host running the service. An attacker can trigger the flaw by sending crafted network requests to the RRAS service, such as on a server configured as a VPN, dial-in, or routing endpoint; the CVSS vector (AV:N/PR:L/UI:N) indicates the attacker needs low-privilege access and no user interaction is required. Successful exploitation yields code execution with high confidentiality, integrity, and availability impact, giving the attacker unauthorized access to the victim machine. Only systems with RRAS enabled are affected — typically Windows Servers acting as VPN or remote-access/routing endpoints — because the role is optional and not installed by default. As of the September 2026 Patch Tuesday release there are no reports of in-the-wild exploitation, no known public proof-of-concept, and the CVE is not in CISA's KEV catalog, with EPSS estimating roughly a 0.9% probability of exploitation within 30 days.
· Microsoft Windows Routing and Remote Access Service (RRAS)large
Authenticated RCE in Windows Routing and Remote Access Service (RRAS)
CVE-2026-72959 is a heap-based buffer overflow (CWE-122) in Windows' Routing and Remote Access Service (RRAS) that can lead to remote code execution. It is triggered by sending crafted network traffic to the RRAS service on an affected host; per the CVSS vector, exploitation is network-based with low attack complexity, requires only low-privileged (authenticated) credentials, and needs no user interaction. A successful attacker gains the ability to execute code on the victim's machine and obtain unauthorized access, with high impact on confidentiality, integrity, and availability. Affected systems are Windows hosts with the RRAS role/service enabled, most commonly servers acting as VPN/remote-access gateways or routers. The flaw was disclosed in Microsoft's September 2026 Patch Tuesday; it is not yet in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.9% chance of exploitation within 30 days, so exploitation is plausible but not yet widely observed.
· Microsoft Windows Routing and Remote Access Service (RRAS)large
Heap-Based Buffer Overflow RCE in Microsoft Windows Imaging Component
CVE-2026-77495 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component (WIC), the Windows subsystem that decodes and processes image files. The CVSS vector (AV:N/PR:N/UI:R) indicates an unauthenticated remote attacker can exploit it, but only with user interaction — typically by getting a user to open, view or preview a crafted image that WIC then decodes, for example in a viewer or file-explorer thumbnail pane. Successful exploitation yields remote code execution with the privileges of the current user, with high impact on confidentiality, integrity and availability. Any Windows system that uses WIC to handle images is affected — effectively the entire installed Windows base — and the flaw was fixed in Microsoft's September 2026 Patch Tuesday. It is not yet known to be exploited in the wild: there is no public proof-of-concept, it is absent from CISA's KEV catalog, and EPSS puts 30-day exploitation probability at about 0.6%.
· Microsoft Windows Imaging Component (shipped with Windows operating systems) Windows versions addressed in the September 2026 security updates (specific version ranges not enumerated in the available data; all affected Windows editions rmass
Use-After-Free Remote Code Execution in Windows DNS Server
CVE-2026-69858 is a use-after-free memory-corruption flaw (CWE-416) in the Windows DNS Server component, addressed by Microsoft in the September 2026 Patch Tuesday release. An unauthorized remote attacker who can send crafted DNS traffic to an affected Windows DNS server can trigger the flaw, in which memory is freed while still in use, potentially corrupting it. Successful exploitation yields arbitrary code execution on the DNS server, though the network-accessible attack carries High attack complexity (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N), indicating reliable exploitation is harder to achieve. Affected are any organizations running the DNS Server role on Windows Server, which is nearly universal on Active Directory domain controllers and common on standalone and internet-facing DNS servers. As of the available data there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns a 0.7% probability of exploitation within 30 days, so no confirmed in-the-wild exploitation is known.
· Microsoft Windows DNS Server (DNS Server role on Windows Server)mass
Use-After-Free RCE in Microsoft Windows Reliable Multicast Transport Driver (RMCAST)
CVE-2026-78450 is a use-after-free (CWE-416) in Microsoft's Reliable Multicast Transport Driver (RMCAST), the Windows networking component that handles reliable multicast transport traffic. An unauthenticated attacker can trigger the flaw by sending crafted network packets to a host running the affected driver; the high-attack-complexity rating (AV:N/AC:H) indicates exploitation depends on atypical conditions rather than a trivially reproducible request. Successful exploitation results in remote code execution on the target system. Any Windows system with the RMCAST driver loaded and reachable over the network is potentially affected; the reviewed data does not list specific Windows version ranges, and fixes were delivered in Microsoft's September 2026 Patch Tuesday. No public proof-of-concept or in-the-wild exploitation is currently known, and EPSS assigns only about a 0.5% probability of exploitation in the next 30 days.
· Microsoft Windows Reliable Multicast Transport Driver (RMCAST)mass
Heap-based Buffer Overflow in Microsoft Excel Enables Local Code Execution
CVE-2026-81951 is a heap-based buffer overflow (CWE-122) in Microsoft Excel, the spreadsheet component of Microsoft Office and Microsoft 365. Per the CVSS vector (AV:L with UI:R and no privileges required), exploitation requires user interaction, most plausibly a user opening a crafted spreadsheet, rather than any network-reachable service. Successful exploitation lets an unauthorized attacker execute arbitrary code locally, with the CVSS scoring high impact on confidentiality, integrity, and availability. All supported Excel-bearing releases are affected: Microsoft 365 Apps/Microsoft 365, Office 2016, Office 2019, Office 2021, and Office 2024. No public proof of concept is known, the flaw is not in CISA's KEV, and EPSS estimates only a ~0.4% chance of exploitation within 30 days, indicating no known in-the-wild exploitation as of the September 2026 Patch Tuesday that shipped the fix.
Query Logic Flaw Enables Info Disclosure in Microsoft Discovery Studio
CVE-2026-62906 is an improper neutralization of special elements in data query logic (CWE-943, an SQL-injection-style flaw) in Microsoft Discovery Studio that allows an unauthorized attacker to disclose information over a network. It is remotely exploitable without authentication (AV:N/PR:N) but requires user interaction (UI:R), meaning a user must perform some action, such as clicking a crafted link or submitting crafted input, for the attack to succeed. Successful exploitation has a high impact on confidentiality, potentially exposing sensitive data, while integrity and availability are unaffected. Any organization running Microsoft Discovery Studio is potentially affected, and Microsoft addressed the issue as part of the September 2026 Patch Tuesday security updates. There is currently no known public proof-of-concept, no inclusion in CISA's Known Exploited Vulnerabilities catalog, and EPSS estimates only a 0.7% probability of exploitation in the next 30 days, so no active exploitation is known at this time.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.