September 2026 Patch Tuesday forecast expects record CVE volume after August's 398 fixes, with SharePoint flaws CVE-2026-55040 and CVE-2026-63520 actively exploited.
This Patch Tuesday forecast column notes August 2026 Patch Tuesday was the second largest ever with 398 resolved CVEs, yet only one was confirmed actively exploited. SharePoint flaws CVE-2026-55040 and CVE-2026-63520 are being chained for authentication bypass and remote code execution in active attacks against unpatched servers. Microsoft Defender's ShieldBreak elevation of privilege flaw (CVE-2026-69414) is publicly disclosed with PoC code and a fix is expected, while Chrome CVE-2026-85046 was reported exploited in the wild. Several products, including Windows 11 24H2 Home/Pro and Exchange Server 2016/2019 ESU, reach end of support in October 2026.
Microsoft's September Patch Tuesday fixes a record 974 flaws, including two actively exploited Windows zero-days and critical DNS and Windows Shell bugs.
Microsoft released fixes for 974 vulnerabilities, its largest-ever monthly patch batch, bringing the 2026 total above 2,600. Two zero-day privilege elevation flaws, CVE-2026-81963 and CVE-2026-85880, are being actively exploited. Critical bugs include CVE-2026-69730, an unauthenticated DNS weakness in Windows Server 2012 onward and Windows 10 deemed likely to be exploited, and CVE-2026-69829, a CVSS 9.8 Windows Shell remote code execution flaw requiring no privileges or user interaction. Microsoft and other vendors credit AI-assisted discovery for the growing patch volumes.
Google switches Chrome to two-week release cycles starting with Chrome 153, shrinking the N-day patch gap as AI-driven threats accelerate.
Chrome officially moved from a four-week to a two-week release schedule with Tuesday's launch of Chrome 153 on desktop, iOS, and Android. Google ties the change to its evolving security strategy, saying faster releases shrink the N-day patch gap as AI tools and community bug reports increase patch volume. Mozilla, Microsoft, and Brave have already adopted the two-week cadence, and Google is also racing AI-native browsers like Brave, Dia, Opera Neon, and Perplexity's Comet while experimenting with AI features in Chrome.
Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.
Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.
Mozilla rolls out built-in ad blocking for Firefox on iOS using Apple WebKit Content Blockers; the feature is off by default and iOS-only.
Mozilla began gradually enabling native ad blocking in Firefox for iOS, built on Apple's WebKit Content Blockers with an EasyList-derived filter, because iOS requires all browsers to use WebKit. The feature blocks ad trackers, third-party network ads, and popups, but not sponsored content, search ads, or Mozilla's own new tab promotions, and is off by default. Mozilla says it has no plans to extend built-in ad blocking to desktop or Android, preserving the extension ecosystem.
Canada's Cyber Centre reports Mozilla vulnerabilities fixed in Firefox 155 and Firefox ESR 115.40, 140.15, and 153.2.
Canadian Centre for Cyber Security advisory AV26-868, dated September 1, 2026, notes vulnerabilities in Firefox (versions prior to 155) and Firefox ESR (prior to 115.40, 140.15, and 153.2). The bulletin links to Mozilla's security advisories and urges users and administrators to update. No CVE identifiers or exploitation details are provided.
Researchers found WebKit features bypass proxies and iCloud Private Relay, leaking users' real IP addresses; Apple patched in iOS 26.6.1 and macOS 26.6.2.
Researchers Talal Haj Bakry and Tommy Mysk found that three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — bypass configured proxies and send traffic directly from the device. This leaks the user's real IP address in Safari and all WebKit-based iOS browsers and undermines iCloud Private Relay's dual-hop privacy design. Any website can trigger the leak via WebAuthn without user interaction or passkey use; a proof-of-concept site, leaks.psylo.app, demonstrates the issue. Apple investigated and patched the leaks in iOS 26.6.1 and macOS 26.6.2.
NVIDIA's GeForce NOW cloud gaming service adds Firefox browser support, letting users play supported PC games without a dedicated app.
NVIDIA announced Firefox browser support for GeForce NOW, its cloud gaming platform. Users on school laptops or everyday PCs can now stream supported PC games directly from the browser without installing the dedicated app.
Socket found 40 malicious Firefox extensions impersonating OKX, Rabby Wallet, and TronLink to steal cryptocurrency wallet recovery phrases and private keys.
The Socket Threat Research team identified 40 malicious Firefox extensions masquerading as Web3 products including OKX, Rabby Wallet, and TronLink, part of a broader set of 77 add-ons sharing source code and infrastructure overlaps. The campaign, dubbed Offside Wallet Theft Factory, has been active since March 2026 and remains unattributed. Of the 40 confirmed malicious extensions, 15 capture recovery phrases and private keys exfiltrated through Cloudflare Workers, 13 modified Rabby Wallet builds exfiltrate serialized keyrings before local encryption, seven use attacker-controlled Supabase projects as remote switches, and five capture credentials and clipboard data via hard-coded C2. Some extensions began as sports score or utility shells before being repurposed into wallet stealers under the same Firefox ID.
Attackers can hijack public Wi-Fi DNS to redirect users to credential-stealing fake login pages; commenters debate HTTPS limits and mitigations like encrypted DNS.
The discussion examines how an attacker controlling DNS on shared or public Wi-Fi networks can redirect requests for legitimate services to attacker-controlled servers to steal credentials. Commenters analyze whether HTTPS and certificates mitigate the attack, noting attackers often rely on HTTP or browser trust quirks. Suggested defenses include encrypted DNS (DoH), DNSSEC, and travel routers running OpenWRT. No specific campaign, victims, or indicators are provided.
Mozilla revoked the Firefox and Thunderbird Linux RPM signing subkey after an unencrypted copy landed in a private repo; no unauthorized access found.
Mozilla revoked the OpenPGP signing subkey (fingerprint 09BE ED63 F346 2A2D FFAB 3B87 5ECB 6497 C1A2 0256) used for Firefox and Thunderbird Linux downloads after an unencrypted copy was committed to one of its private repositories, citing reason code 2, 'key material has been compromised.' Audit records showed no sign of unauthorized access, and a replacement subkey (827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3) valid until August 5, 2028 was published. Users who verify signatures manually or install from Mozilla RPM packages may need to import the new key and remove the old one. The rotation came roughly seven months ahead of Mozilla's usual two-year subkey cycle.
Local Privilege Escalation via Link Following in Windows Update Stack
CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.
· Microsoft Windows 11 23H2, 24H2, 25H2, 26H1 · Microsoft Windows Server 2025 KEVmass
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
· Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
Incorrect Authorization in Microsoft Azure Arc Enables Network Privilege Escalation
Microsoft Azure Arc, the service used to manage on-premises and multi-cloud servers from Azure, contains an incorrect authorization flaw (CWE-863) in which permission checks fail to properly restrict what an unauthorized party may do. Per the CVSS vector, the flaw is exploitable over a network with no privileges or user interaction required, and exploitation changes the security scope, allowing an unauthorized attacker to elevate privileges with high impact on confidentiality and integrity. Any organization that has enrolled servers or other resources with Azure Arc is potentially exposed. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS currently estimates only about a 0.4% probability of exploitation within 30 days.
Unauthenticated Privilege Elevation Flaw in Microsoft Azure Arc
Microsoft Azure Arc contains a use of incorrectly-resolved name or reference (CWE-706) that allows an unauthorized, unauthenticated attacker to elevate privileges over a network. The flaw is triggered through network access alone, with no privileges, user interaction, or complex conditions required, as reflected in its maximum CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The scope-changed metric indicates the attack crosses a security boundary, so an attacker who reaches the vulnerable component could gain elevated privileges with high impact on confidentiality, integrity, and availability. Organizations that have enrolled on-premises or multicloud resources into Azure Arc are affected; the source data provides no specific affected version ranges, and the CPE product entry also references Azure Web Apps while the description names Azure Arc. There is currently no known public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns a 0.5% 30-day exploitation probability (43rd percentile), indicating no confirmed in-the-wild exploitation.
· Microsoft Azure Arc · Microsoft Azure Web Apps (listed in CPE product data; description names Azure Arc)large
SSRF Privilege Elevation in Microsoft Exchange Online
CVE-2026-65801 is a server-side request forgery (CWE-918) in Microsoft's cloud-hosted Exchange Online service that an unauthorized attacker can reach over the network without credentials or user interaction. A crafted request causes Exchange Online server components to issue requests toward internal service endpoints, and the scope-changed CVSS 3.1 vector (S:C with high confidentiality, integrity, and availability impact) indicates the resulting privilege elevation extends beyond the initially targeted component. A successful attacker gains elevated privileges within the Exchange Online service, potentially enabling broader access to mailbox data and service functionality. All organizations with mailboxes hosted in Exchange Online are in scope; because this is a flaw in Microsoft's managed service, customers cannot patch it themselves and depend on Microsoft's service-side remediation. Exploitation has not been publicly confirmed: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only about a 0.5% probability of exploitation within 30 days.
· Microsoft Exchange Online (hosted cloud service) Microsoft-managed cloud service; no customer-deployed version numbers apply (none provided in the data)mass
CVE-2026-69730 is a use-after-free memory corruption flaw (CWE-416) in the Windows DNS service that allows an unauthenticated, remote attacker to execute arbitrary code by sending crafted network traffic to the affected system. Because the flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1 9.8), any system running the vulnerable DNS service is a direct target. Successful exploitation would give the attacker code execution in the context of the DNS service, which on Windows Server typically runs with high privileges such as SYSTEM, and could enable wormable spread between vulnerable hosts. Affected organizations are those running the Windows DNS Server role — a component deployed on virtually all Windows Server domain controllers and on dedicated Windows DNS servers, especially those exposed to untrusted networks. As of the September 2026 Patch Tuesday release, there is no known public proof-of-concept, the flaw is not listed in CISA's KEV, and it has not been confirmed exploited in the wild, though it was flagged among roughly 20 'wormable' bugs and described in press coverage as a successor to the 2020 SigRed Windows DNS RCE.
· Microsoft Windows DNS Server role (Windows Server)mass
Unauthenticated Heap Buffer Overflow RCE in Microsoft Windows Shell
CVE-2026-69829 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Shell. According to its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), an unauthorized remote attacker could trigger the flaw over a network without needing privileges, user interaction, or special conditions. Successful exploitation would allow the attacker to execute code on the affected host, with high impact on confidentiality, integrity, and availability. All Windows installations that include the Windows Shell component are potentially affected, though the available data does not enumerate specific vulnerable version ranges. There is currently no known public proof-of-concept, the CVE is not in CISA's KEV, and EPSS assigns roughly a 1.1% probability of exploitation within 30 days; the related headlines note Microsoft's record patch release of 974 flaws included two other exploited Windows zero-days, but no confirmed in-the-wild exploitation of this specific CVE is documented.
· Microsoft Windows Shell (Windows operating system component)mass
Unauthenticated RCE in Microsoft SharePoint Server
CVE-2026-63520 is an improper input validation flaw (CWE-20) in Microsoft Office SharePoint, affecting on-premises SharePoint Server deployments. A remote, unauthenticated attacker can trigger the flaw by sending improperly validated input to the SharePoint service over the network; the high attack complexity (AC:H) indicates exploitation depends on specific conditions, but no privileges or user interaction are required. Successful exploitation results in arbitrary code execution on the server, with high impact to confidentiality, integrity, and availability — effectively full compromise of the SharePoint host. Organizations running self-hosted SharePoint Server are in scope; SharePoint Online/Microsoft 365 is not listed in the affected products. The issue is patched as of Microsoft's Patch Tuesday (headlines mark it FIXED), with Rapid7 analysis and a researcher-disclosed exploit chain available, but there is no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation; EPSS puts exploitation probability at 2.9% (86th percentile).
· Microsoft SharePoint Server (Office SharePoint, on-premises)mass
Capture-Replay Authentication Bypass in Microsoft Exchange Server
Microsoft Exchange Server contains an authentication bypass flaw (CWE-294) in which captured authentication material can be replayed, allowing an authorized attacker to elevate privileges over a network. Per the CVSS vector, the attack is network-based with low complexity but requires the attacker to already hold low privileges and some user interaction, and success yields high impact on confidentiality, integrity, and availability. Affected products include on-premises Exchange Server and Exchange Server Subscription Edition, though specific vulnerable version ranges are not specified in the available data. Public scans indicate nearly 22,000 Exchange servers remain exposed to the flaw following the August 2026 Patch Tuesday fixes. No in-the-wild exploitation, public proof-of-concept, or KEV listing is known; the bug was demonstrated at Pwn2Own (ZDI-26-534) and carries an EPSS estimate of 1.3% probability of exploitation within 30 days.
· microsoft exchange server · microsoft exchange server subscription editionlarge
Local Elevation of Privilege in Microsoft Defender Malware Protection Engine
CVE-2026-69414, publicly dubbed 'ShieldBreak', is a high-severity (CVSS 3.1: 7.8) elevation-of-privilege flaw in the Microsoft Malware Protection Engine (MMPE) that powers Microsoft Defender, rooted in improper access control and improper privilege management (CWE-284/CWE-269). It is triggered locally: an attacker who already holds low privileges on the machine needs no user interaction (AV:L/AC:L/PR:L/UI:N) to trip the engine's flawed access checks, and successful exploitation yields high impact to confidentiality, integrity, and availability. News coverage reports public PoCs released under the 'ShieldBreak'/'ShieldCrash' names demonstrating SYSTEM-level access on Defender-protected Windows systems, including claims that the shipped patch can be bypassed and arbitrary files read as SYSTEM. Because MMPE ships as the scan engine inside Microsoft Defender, effectively every Defender-protected Windows 10/11 endpoint and server is potentially affected, though the source data specifies no affected engine version ranges. There is no confirmed in-the-wild exploitation (EPSS 0.6%, absent from CISA KEV), but given the public PoC claims, defenders should assume working exploit code exists.
· Microsoft Malware Protection Engine (used in Microsoft Defender)mass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.