The September 2026 Security Update Review
ZDI's September 2026 Microsoft update review lists two already-exploited Windows EoP zero-days and dozens of critical RCEs across Office, SQL Server, and Windows services.
The review catalogs Microsoft's September 2026 fixes, marking CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack) as already exploited elevation-of-privilege issues. It also lists critical RCE flaws in Office, Word, Excel, PowerPoint, Outlook, SQL Server, Windows DNS, DHCP and Failover Cluster, plus graphics component RCEs. Azure-side fixes include Entra ID, Copilot Studio, Azure AI Language and Azure AD B2C elevation-of-privilege flaws.
- CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack) are already-exploited EoP bugs.
- Critical RCEs affect Office apps, SQL Server, Windows DNS, DHCP, and Failover Cluster.
- Azure fixes include Entra ID, Copilot Studio, Azure AI Language, and Azure AD B2C EoP flaws.
- CVEs
- CVE-2026-85880CVE-2026-81963CVE-2026-70352CVE-2026-69857CVE-2026-80098CVE-2026-73006CVE-2026-83941CVE-2026-72986CVE-2026-73018CVE-2026-73017CVE-2026-58599CVE-2026-72981CVE-2026-72983CVE-2026-83711CVE-2026-62906CVE-2026-65772CVE-2026-62916CVE-2026-81948CVE-2026-81949CVE-2026-81950CVE-2026-81951CVE-2026-81953CVE-2026-81959CVE-2026-70178CVE-2026-73010CVE-2026-78444CVE-2026-78439CVE-2026-78520CVE-2026-78509CVE-2026-78519
- Vendors
- MicrosoftZero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58599 | Heap Buffer Overflow in Microsoft Windows Codecs Library Enables Local Code Execution | 7.8 | <1% | ||
| CVE-2026-62906 | Query Logic Flaw Enables Info Disclosure in Microsoft Discovery Studio | 7.4 | <1% | ||
| CVE-2026-62916 | Authentication Bypass in Microsoft Entra ID Enables Privilege Elevation | 9.8 | <1% | ||
| CVE-2026-65772 | Deserialization RCE in Microsoft Dynamics 365 | 8.8 | <1% | ||
| CVE-2026-69857 | Authorization Bypass Through User-Controlled Key in Microsoft Azure Cosmos DB | 8.8 | <1% | ||
| CVE-2026-70178 | Missing Authorization in Microsoft Fabric Allows Network Privilege Escalation | 8.8 | <1% | ||
| CVE-2026-70352 | Unauthenticated Privilege Elevation in Microsoft Azure AI Language | 10.0 | <1% | ||
CVE-2026-72983+4 related CVEs | Use-after-free RCE in Windows Internet Connection Sharing (ICS) | 9.8 group max | <1% | ||
CVE-2026-73010+2 related CVEs | Unauthenticated Use-After-Free RCE in Windows Failover Cluster | 9.8 group max | <1% | ||
| CVE-2026-78439 | Stack-Based Buffer Overflow in Microsoft Graphics Component Enables Network RCE | 8.8 | <1% | ||
| CVE-2026-78509 | Heap-Based Buffer Overflow RCE in Microsoft Office and Outlook | 9.8 group max | <1% | ||
| CVE-2026-80098 | Signature Verification Flaw Allows Privilege Escalation in Microsoft Copilot Studio | 10.0 | <1% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
| CVE-2026-83711 | Unauthenticated Privilege Escalation via Authorization Bypass in Azure AD B2C | 10.0 | <1% | ||
| CVE-2026-83941 | Missing Authorization in Microsoft Entra ID Enables Privilege Escalation | 8.8 | <1% |
From the original article
11 min read at thezdi.com
Whelp, here we are. Deep into the new normal. With nearly 1,000 CVEs coming out from Microsoft and a healthy release from Adobe as well, there’s a phrase from my military days that comes to mind: embrace the suck.
By Dustin Childs · thezdi.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.