Microsoft's September Patch Tuesday fixes a record 964 CVEs, including two actively exploited Windows privilege-escalation zero-days, CVE-2026-81963 and CVE-2026-85880.
Microsoft's September 2026 Patch Tuesday addresses 964 customer-patchable CVEs (104 Critical, 860 Important), the largest release on record, out of 974 total listed. Two actively exploited zero-days are fixed: CVE-2026-81963, a link-following elevation-of-privilege flaw in the Windows Update Stack, and CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape, both with CVSS 7.8. Both zero-days were exploited before a patch was available and grant SYSTEM-level access after an initial foothold. The release also includes high-severity RCE fixes for Windows DNS Server, Remote Desktop Services, Exchange Server, SharePoint, and SQL Server.
Microsoft's September 2026 Patch Tuesday fixes a record 973 vulnerabilities, including 113 critical and two Windows privilege-escalation flaws already exploited in the wild.
Microsoft patched 973 vulnerabilities this month, its largest Patch Tuesday ever and far above the previous record of 664 set in July 2026, with 113 rated critical. Two Important elevation-of-privilege flaws (CVSS 7.8) are confirmed exploited in the wild: CVE-2026-81963 in the Windows Update Stack (improper link resolution, affects Windows 11 and Server 2025) and CVE-2026-85880 in Windows ALPC (heap-based buffer overflow allowing sandbox escape to SYSTEM, affects Windows 10 and Server 2012-2022). Critical unauthenticated RCEs (CVSS 9.8) were also fixed in Skype for Business Server (CVE-2026-66302), Windows Message Queuing (CVE-2026-69579), and Windows RRAS (CVE-2026-69590). SANS urges prioritizing the two exploited EoP fixes, then patching exposed MSMQ, RRAS, and Skype for Business deployments.
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities across Windows and Office, including two actively exploited Windows privilege-escalation zero-days.
Microsoft's September 2026 Patch Tuesday addresses 974 vulnerabilities spanning Windows, Office, SQL Server, SharePoint, Exchange, Azure, and developer tools. Two Windows zero-days are confirmed exploited in attacks: CVE-2026-85880, a Windows ALPC elevation-of-privilege flaw, and CVE-2026-81963, a Windows Update Stack privilege-escalation flaw involving link following. The release also includes Critical fixes for Windows Secure Kernel Mode, VBS Enclave, Excel, and Word.
Local Privilege Escalation via Link Following in Windows Update Stack
CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.
· Microsoft Windows 11 23H2, 24H2, 25H2, 26H1 · Microsoft Windows Server 2025 KEVmass
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
· Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
Missing Authorization in Microsoft Entra ID Enables Privilege Escalation
CVE-2026-83941 is a missing-authorization flaw (CWE-862) in Microsoft Entra ID, the cloud identity service behind Microsoft 365 and Azure. An already-authenticated, low-privileged user can send a network request to an Entra ID endpoint that fails to enforce proper authorization checks, requiring no user interaction. Exploitation lets the attacker elevate their privileges within the directory, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Any organization that uses Microsoft Entra ID is in the affected population. The flaw was patched in Microsoft's September 2026 Patch Tuesday release; it is not in CISA KEV, has no known public proof-of-concept, and carries a low EPSS of roughly 0.7%.
External File Path Control in Microsoft .NET Enables Network Privilege Escalation
Microsoft .NET contains a privilege elevation flaw (CWE-73) in which a file name or path processed by the .NET runtime is externally controlled, allowing an unauthorized attacker to elevate privileges over a network. Exploitation requires network access, user interaction, and a high-complexity attack path (CVSS AV:N/AC:H/PR:N/UI:R), meaning the attacker must induce a user into an action that causes .NET to process an attacker-influenced file path, though no privileges are needed. A successful attack carries high impact to confidentiality, integrity, and availability, and the associated CWEs (CWE-200, CWE-522) suggest possible information exposure and insufficiently protected credentials as related effects. Any organization running affected .NET runtimes, SDKs, or .NET Framework installations is potentially exposed; exact version ranges are not specified in the available data, and fixes shipped as part of Microsoft's September 2026 Patch Tuesday (September 8, 2026). There are no known reports of exploitation, no public proof-of-concept, the flaw is absent from CISA's KEV catalog, and EPSS assigns only a 0.5% probability of exploitation within 30 days (42nd percentile).
Local Privilege Escalation via Sensitive Information Exposure in Microsoft .NET
CVE-2026-69806 is an information-exposure flaw in Microsoft .NET (CWE-200, with an associated code-generation issue, CWE-94) that allows an authorized actor to elevate privileges locally. To trigger it, an attacker must already hold a low-privileged foothold on the target system — such as the ability to execute code as a standard local user — and the high-complexity local attack path requires no user interaction. A successful exploit carries high-impact confidentiality, integrity, and availability consequences, effectively yielding elevation of privilege on the affected host. Any organization running the affected .NET components on Windows clients or servers is in scope, and the fix shipped in Microsoft's September 2026 Patch Tuesday (September 8, 2026), part of a record 966-flaw release. There is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known; EPSS assigns a 1.8% probability of exploitation within 30 days (77th percentile).
· Microsoft .NET (sensitive information exposure leading to local elevation of privilege)mass
Origin Validation Error in Microsoft .NET Enables Cross-Origin Information Disclosure
CVE-2026-58649 is an origin validation error (CWE-346) in Microsoft's .NET platform, meaning the runtime fails to correctly verify the origin of network requests, allowing an unauthenticated attacker to trigger an information-disclosure condition. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the flaw is reachable over a network with low attack complexity and no privileges required, but a victim user must interact with attacker-influenced content for it to fire. A successful attacker gains access to confidential information handled by the affected application (confidentiality impact rated High), with no integrity or availability impact. Any organization running supported .NET deployments that have not yet received the September 2026 Patch Tuesday updates is potentially affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation probability at just 0.3%, so no in-the-wild exploitation is known.
Use-After-Free Remote Code Execution in Microsoft Active Directory Domain Services
CVE-2026-69524 is a use-after-free memory corruption flaw (CWE-416) in Microsoft's Active Directory Domain Services (AD DS), patched as part of Microsoft's September 2026 Patch Tuesday release. An unauthorized attacker with no privileges or user interaction can trigger the flaw remotely over the network, though the high attack-complexity rating suggests reliable exploitation may depend on favorable memory or timing conditions. A successful exploit yields remote code execution on the target, with high impact to confidentiality, integrity, and availability — typically a domain controller holding an organization's central authentication data. Any organization running Windows Server with the AD DS role enabled (i.e., operating domain controllers) is affected. As of this data there are no known in-the-wild exploits, no public proof of concept, and a modest 0.7% EPSS probability of exploitation within 30 days.
· Microsoft Windows Server with Active Directory Domain Services (AD DS) rolemass
Out-of-bounds Read in Windows Kerberos KDC Enables Network Denial of Service
CVE-2026-84001 is an out-of-bounds read (CWE-125) in the Windows Key Distribution Center (KDC), the Kerberos authentication component built into Windows. An unauthorized, remote attacker can trigger it by sending specially crafted network requests to the KDC service, causing the service to read beyond allocated memory. According to the CVSS vector, the impact is availability-only (C:N/I:N/A:H): the attacker gains denial of service, not code execution, data theft, or tampering, though taking down the KDC on domain controllers can disrupt Kerberos authentication for an entire Active Directory domain. Any Windows system running the KDC is affected, chiefly Windows domain controllers and servers, although the specific affected Windows version ranges are not enumerated in the available data. There is no known public proof-of-concept, the CVE is not in CISA's KEV catalog, and its EPSS probability of ~0.6% suggests exploitation risk is currently low; the fix shipped in Microsoft's September 2026 Patch Tuesday release.
· Microsoft Windows (Key Distribution Center / Kerberos KDC service, primarily on Windows domain controllers and servers)mass
Unauthenticated out-of-bounds read DoS in Microsoft Windows BranchCache
CVE-2026-69329 is an out-of-bounds read (CWE-125, arising from an integer-overflow condition, CWE-190) in the BranchCache component of Microsoft Windows. A remote, unauthenticated attacker can trigger the flaw over the network with no privileges or user interaction by sending malformed input to a system running BranchCache. Successful exploitation results only in denial of service of the BranchCache service — availability impact with no information disclosure or tampering (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Affected systems are Windows installations with the optional BranchCache feature enabled, such as branch-office caching deployments (Hosted Cache Servers or clients in distributed mode); the provided data does not specify affected version ranges. There is currently no known exploitation: the flaw was addressed in Microsoft's September 2026 Patch Tuesday (part of a 966-flaw release), has no public PoC, is not in CISA KEV, and carries an EPSS of 1.1% (62nd percentile).
· Microsoft Windows BranchCache (component of Windows client and Windows Server)large
Unauthenticated DoS in Microsoft Active Directory Federation Services (AD FS)
CVE-2026-72978 is an unauthenticated denial-of-service flaw in Microsoft Active Directory Federation Services (AD FS) caused by allocation of resources without limits or throttling (CWE-770). An attacker triggers it by sending network requests that cause the AD FS service to allocate resources without bound, exhausting capacity; the high attack-complexity score (AC:H) indicates the exhaustion condition is not reliably achieved on every attempt. A successful attack yields availability impact only (A:H) — the federation service can be knocked offline, interrupting sign-in/SSO for users who depend on it, with no confidentiality or integrity impact. Organizations running AD FS — typically enterprises using federated authentication with Microsoft 365/Entra ID on Windows Server — are affected. There is currently no evidence of exploitation (not in CISA KEV, no public PoC), EPSS puts the 30-day exploitation probability at 0.8%, and the fix shipped in Microsoft's September 2026 Patch Tuesday, which resolved 966 flaws including 2 zero-days.
· Microsoft Active Directory Federation Services (AD FS)large
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.