Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.
Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.
Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including 113 critical, with two Windows privilege-escalation bugs (CVE-2026-81963, CVE-2026-85880) exploited in the wild.
Microsoft's September 2026 security update addresses 973 vulnerabilities across its product lineup, 113 rated critical, of which 82 are remote code execution flaws. Two vulnerabilities are confirmed exploited in the wild: CVE-2026-81963, an elevation-of-privilege flaw in the Windows Update Stack (CVSS 7.8), and CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call (CVSS 7.8). Microsoft flags several bugs as more likely to be exploited, including a 9.8 RCE in Windows DNS Server (CVE-2026-69730), an 8.8 RCE in Windows Kerberos (CVE-2026-69676), and a 9.0 EoP in Spring Cloud Azure (CVE-2026-69854). Cisco Talos published accompanying Snort rules to detect exploitation attempts against the prominent flaws.
Microsoft's August Patch Tuesday fixes 398 CVEs, including actively exploited Windows zero-day CVE-2026-68820 used by Lazarus for SYSTEM privilege escalation.
Microsoft's August 2026 Patch Tuesday release addresses 398 new vulnerabilities, 62 rated Critical by the Zero Day Initiative, with CVE-2026-68820 (CVSS 7.0), a use-after-free in the afd.sys Windows kernel driver, the only flaw flagged as actively exploited. Check Point Research attributed exploitation of the privilege escalation bug to Lazarus' Operation Dream Job campaign. Four unauthenticated remote code execution flaws rated 9.8 affect Windows DNS Server (CVE-2026-62878, called wormable by ZDI), Windows Deployment Services (CVE-2026-62893), Microsoft QUIC (CVE-2026-62815) and HPC Pack (CVE-2026-59124). The release also completes a two-part SharePoint fix with RCE component CVE-2026-63520, following July's authentication bypass fix CVE-2026-55040.
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
· Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
Local Privilege Escalation via Link Following in Windows Update Stack
CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.
· Microsoft Windows 11 23H2, 24H2, 25H2, 26H1 · Microsoft Windows Server 2025 KEVmass
Unauthenticated Stack Buffer Overflow RCE in Windows DNS (CVE-2026-62878)
Windows DNS contains a stack-based buffer overflow (CWE-121) that an unauthenticated, network-adjacent or internet-reachable attacker can trigger by sending crafted input to the DNS service. Successful exploitation yields remote code execution on the target host, with high impact on confidentiality, integrity and availability (CVSS 3.1: 9.8). The flaw affects the DNS component shipped with Windows 10 1607 and 1809 and with Windows Server 2012, 2016, 2019, 2022 and 2025; systems running the DNS Server role, especially internet-facing DNS servers and domain controllers, are the primary targets. Microsoft, which assigned the CVE, has issued a fix, and the flaw appeared amid a record-sized run of Patch Tuesday releases. No in-the-wild exploitation is currently known: it is not in CISA's KEV, no public proof-of-concept is available, and EPSS estimates only a 1.3% probability of exploitation within 30 days.
· microsoft Windows 10 1607 · microsoft Windows 10 1809mass
Pre-auth use-after-free RCE in Microsoft Windows Deployment Services (WDS)
Microsoft Windows Deployment Services (WDS) contains a use-after-free memory-safety flaw (CWE-416) that an unauthenticated attacker can trigger by sending crafted network traffic to the WDS service, leading to remote code execution on the target system. The vulnerability affects Windows 10 1607 and 1809 and Windows Server 2012, 2016, 2019, 2022, and 2025 on systems where WDS is deployed, a role typically used for network-based (PXE) operating system imaging. A successful exploit grants the attacker code execution with high confidentiality, integrity, and availability impact, reflected in the critical CVSS 3.1 score of 9.8 with network vector, low complexity, and no privileges or user interaction required. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known, although EPSS estimates a 2.7% probability of exploitation within 30 days (85th percentile). The flaw was disclosed alongside Microsoft's record September 2026 Patch Tuesday, which shipped nearly 1,000 fixes including two Windows zero-days.
· microsoft Windows 10 1607 · microsoft Windows 10 1809large
Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that handles Winsock socket operations. A local, authenticated attacker can trigger the memory corruption through crafted socket activity, and the high attack-complexity score (AV:L/AC:H/PR:L) indicates exploitation requires a specific, likely race-sensitive sequence of operations. Successful exploitation elevates privileges to SYSTEM, giving the attacker full control of the host, and public reporting describes deployment of a backdoor after privilege escalation. Virtually every Windows 10, Windows 11, and Windows Server (2012-2022) installation ships this driver, so the affected population is essentially the entire supported Windows installed base. The flaw is being exploited in the wild: CISA added it to the KEV on 2026-08-11, Microsoft fixed it in the August 2026 Patch Tuesday release, and reporting ties active exploitation to North Korea's Lazarus group, who paired the zero-day with fake job-offer lures.
· Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) as shipped with the Windows versions listed below · Microsoft Windows 10 1607, 1809, 21H2, 22H2 KEVmass
Critical unauthenticated file-path RCE in Microsoft Skype for Business
CVE-2026-66302 is a critical (CVSS 9.8) vulnerability in Microsoft Skype for Business in which an external attacker controls the file name or path used by the software (CWE-73, external control of file name or path). The flaw is exploitable over a network with no authentication, no privileges, and no user interaction, so a remote unauthenticated attacker who can reach the affected Skype for Business service can trigger it. Successful exploitation yields remote code execution on the target, with high impact on confidentiality, integrity, and availability. Any organization running the affected Skype for Business deployment, presumably the on-premises Skype for Business server product, is affected; the available data does not specify the exact affected version ranges. No public proof-of-concept is known, the CVE is not in CISA's KEV catalog, and EPSS assigns roughly a 0.5% probability of exploitation in the next 30 days, so no exploitation is currently known.
Integer Overflow in Windows Secure Kernel Mode Enables Local Privilege Escalation
CVE-2026-69846 is an integer overflow or wraparound flaw (CWE-190) in the Windows Secure Kernel Mode, the isolated kernel component that underpins Virtualization-Based Security features such as Credential Guard. It is triggered locally by an authorized attacker who already holds high privileges on the machine (per the CVSS PR:H vector), by causing a size or count computation to wrap around and corrupt secure kernel memory. Successful exploitation lets the attacker elevate privileges across a security boundary (CVSS Scope: Changed), potentially gaining code execution at a higher trust level and undermining VBS-based protections. All Windows builds listed for this CVE in Microsoft's September 2026 Patch Tuesday advisory are affected; the available data does not enumerate specific versions, so administrators should consult the advisory for exact ranges. There is currently no public proof-of-concept, no entry in CISA's KEV catalog, and only a modest 0.3% EPSS probability of exploitation within 30 days, so no in-the-wild exploitation is known.
Heap Overflow in Microsoft Windows Secure Kernel Mode Allows Local Privilege Escalation
CVE-2026-69906 is a heap-based buffer overflow (CWE-122) in Windows Secure Kernel Mode, the isolated, higher-trust kernel component that underpins Microsoft's Virtualization-Based Security (VBS). It is triggered locally by an already-authorized attacker who holds high privileges on the machine (CVSS PR:H), with no user interaction required. Successful exploitation allows the attacker to elevate privileges into the secure kernel's trust scope (CVSS scope-changed, S:C), with high impact to confidentiality, integrity, and availability, and potential undermining of VBS-protected assets such as credential isolation. Affected systems are Microsoft Windows releases that ship the Secure Kernel Mode component; the source data does not enumerate specific affected version ranges, and fixes shipped in Microsoft's September 2026 Patch Tuesday, whose coverage also highlighted related Snort detection rules. As of publication there is no known public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation within 30 days (25th percentile).
· Microsoft Windows (Secure Kernel Mode component / Virtualization-Based Security)mass
Use-after-free in Windows Services for NFS ONCRPC XDR Driver enables local code execution
CVE-2026-70585 is a use-after-free (CWE-416) memory-safety flaw in the Windows Services for NFS ONCRPC XDR driver, the Windows component that handles ONCRPC/XDR protocol processing for NFS interoperability. An authorized attacker with low privileges on the host can trigger the flaw locally with no user interaction, though exploitation is rated high attack complexity, and successful exploitation yields local code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.0 High). Exposure is limited to Windows systems where the optional Services for NFS / Client for NFS feature is enabled, since the vulnerable driver is tied to that NFS interoperability functionality. As of the September 2026 Patch Tuesday release, there is no known in-the-wild exploitation, no public proof of concept, the flaw is not in CISA KEV, and EPSS assigns a low 0.3% 30-day exploitation probability.
· Microsoft Windows Services for NFS ONCRPC XDR Driver (Services for NFS / Client for NFS component)large
Out-of-Bounds Read in Windows Virtualization-Based Security (VBS) Enclave
An out-of-bounds read (CWE-125) in the Windows Virtualization-Based Security (VBS) Enclave allows a locally authenticated, low-privilege attacker to read memory beyond the enclave's intended boundary. It is triggered by code running locally under an authorized account that interacts with the enclave, with no user interaction required. The result is information disclosure only - potentially leaking data the enclave was meant to isolate, such as secrets or protected content - with no impact on integrity or availability. Any Windows system with VBS Enclave support is affected; Microsoft patched the issue in its September 2026 Patch Tuesday release, which fixed 974 vulnerabilities. No public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and EPSS assigns roughly a 0.3 percent 30-day exploitation probability, so no exploitation is currently known.
· Microsoft Windows Virtualization-Based Security (VBS) Enclavemass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.