September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor
Microsoft's September 2026 Patch Tuesday delivers a record patch count, fixing two exploited zero-days and a wormable DNS flaw dubbed a SigRed successor.
Microsoft's September 2026 Patch Tuesday sets another record patch count, fixing two vulnerabilities exploited as zero-days: CVE-2026-81963, a Windows Update Stack low-privilege-to-SYSTEM escalation reported by MSTIC, and CVE-2026-85880, a Windows Advanced Local Procedure Call escalation reported by Proofpoint. Zero Day Initiative's Dustin Childs urges priority on a cluster of 20 potentially wormable bugs including DNS RCE CVE-2026-69730, described as a spiritual successor to SigRed, plus Kerberos authentication bypass CVE-2026-69676 that could give any authenticated domain user RCE on domain controllers, and Exchange RCE CVE-2026-55007 via a malicious Visio attachment. All Windows fixes are bundled in cumulative updates, and experts stress prioritizing exploitable, reachable flaws over raw patch counts.
- CVE-2026-81963: Windows Update Stack EoP exploited as zero-day
- CVE-2026-85880: Windows ALPC EoP also exploited; reported by Proofpoint
- CVE-2026-69730: wormable DNS RCE, spiritual successor to SigRed
- CVE-2026-69676: Kerberos bypass could give any domain user DC RCE
- Researchers advise risk-based prioritization over patch counts
- CVEs
- CVE-2026-81963CVE-2026-85880CVE-2026-69730CVE-2026-69676CVE-2026-80093CVE-2026-55007CVE-2026-69414
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-55007 | Double Free Enables Unauthenticated RCE in Microsoft Exchange Server | 8.1 | <1% | ||
| CVE-2026-69414 | Local Elevation of Privilege in Microsoft Defender Malware Protection Engine | 7.8 | 1% | PoC | |
CVE-2026-69730+1 related CVE | Use-After-Free RCE in Windows DNS Server | 9.8 group max | 1% | ||
| CVE-2026-80093 | Use-After-Free in Windows Cloud Files Mini Filter Driver: Local Privilege Escalation | 7.0 | <1% | PoC | |
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
4 min read at helpnetsecurity.com
September 2026 Patch Tuesday is here, with Microsoft delivering another record-breaking number of patches, including those for two vulnerabilities that have been exploited as zero-days. Another “new normal” is the anonymous security researcher Nightmare Eclipse publishing a zero-day proof-of-concept exploit targeting Microsoft software mere hours after Microsoft drops its Patch Tuesday fixes.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.