The September 2026 Security Update Review

CVE-2026-58599 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Codecs Library, patched by Microsoft as part of the September 2026 Patch Tuesday. The CVSS vector (AV:L, UI:R, no privileges required) indicates the flaw is triggered locally when the codecs library processes specially crafted content, requiring user interaction such as opening a malicious media or image file. A successful attacker can execute arbitrary code in the context of the local user with no prior privileges, with high impact on confidentiality, integrity, and availability. Any Windows system containing the affected Windows Codecs Library is exposed, though the source data does not enumerate specific Windows versions or builds. Exploitation is currently quiet: there is no public proof-of-concept, no CISA KEV listing, and EPSS estimates only about a 0.3% probability of exploitation within 30 days (25th percentile).

Do: Apply Microsoft's September 2026 security updates (Windows cumulative updates) to all supported systems, prioritizing user workstations where untrusted image or media files are routinely opened. Until systems are patched, treat unsolicited image and media files with caution, since exploitation requires user interaction to trigger the overflow. Verify through Windows Update or your patch-management tooling that the September 2026 cumulative update has been installed on each endpoint.

CVE-2026-62906 is an improper neutralization of special elements in data query logic (CWE-943, an SQL-injection-style flaw) in Microsoft Discovery Studio that allows an unauthorized attacker to disclose information over a network. It is remotely exploitable without authentication (AV:N/PR:N) but requires user interaction (UI:R), meaning a user must perform some action, such as clicking a crafted link or submitting crafted input, for the attack to succeed. Successful exploitation has a high impact on confidentiality, potentially exposing sensitive data, while integrity and availability are unaffected. Any organization running Microsoft Discovery Studio is potentially affected, and Microsoft addressed the issue as part of the September 2026 Patch Tuesday security updates. There is currently no known public proof-of-concept, no inclusion in CISA's Known Exploited Vulnerabilities catalog, and EPSS estimates only a 0.7% probability of exploitation in the next 30 days, so no active exploitation is known at this time.

Do: Apply the Microsoft September 2026 Patch Tuesday security updates for Discovery Studio as soon as possible and verify your inventory for deployments of the product, including which users have access. Because exploitation requires user interaction, advise users to avoid clicking unexpected links or submitting unsolicited input while patching is in progress, and monitor Microsoft's advisory for any expanded guidance.

CVE-2026-62916 is an authentication bypass (CWE-288) in Microsoft Entra ID, Microsoft's cloud identity and access management service, in which an alternate path or channel allows authentication checks to be circumvented. Per the CVSS vector, it is exploitable remotely over a network with no privileges and no user interaction required, by authenticating via an alternate path instead of the standard sign-in flow. A successful unauthenticated attacker gains the ability to elevate privileges, with high impact on confidentiality, integrity, and availability reflected in the 9.8 critical score. The affected population includes organizations relying on Entra ID, which is the default identity platform for Microsoft 365, Azure, and hybrid deployments; the available data does not specify affected versions or the specific sub-component involved. There is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not in CISA's KEV; EPSS assigns a 0.6% probability of exploitation within 30 days.

Do: Since Entra ID is a cloud service patched centrally by Microsoft, verify that the September 2026 security updates have been applied to your tenant and follow the Microsoft advisory for any tenant-side configuration or conditional access actions; no workarounds are documented in the available data. Review Entra ID sign-in and audit logs for unexpected privileged authentication activity, and re-check exposure after any additional Microsoft guidance on affected flows.

CVE-2026-65772 is a deserialization of untrusted data flaw (CWE-502) in Microsoft Dynamics 365 that allows an authorized (authenticated, low-privilege) attacker to execute code over the network. It is triggered when the application processes attacker-controlled serialized data, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network exploitation with low attack complexity, low required privileges, and no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability, effectively amounting to remote code execution within the affected Dynamics 365 environment. Any organization running the affected Microsoft Dynamics 365 deployments is in scope, with authenticated users or compromised low-privileged accounts able to trigger the flaw; the available data does not specify which Dynamics 365 editions or version ranges are affected. As of the September 2026 Patch Tuesday coverage, there is no evidence of in-the-wild exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns roughly a 0.9% probability of exploitation within 30 days (58th percentile).

Do: Apply the Microsoft security update for CVE-2026-65772 released in the September 2026 Patch Tuesday cycle, prioritizing internet-facing, multi-user, or production Dynamics 365 environments where low-privileged users can reach the vulnerable endpoint. Because the affected version range is not specified here, verify applicability against Microsoft's advisory and confirm your deployed editions/versions before and after patching. Until patched, restrict and monitor authenticated access to Dynamics 365, and watch for changes in EPSS, KEV, or public proof-of-concept status.

CVE-2026-69857 is an authorization bypass through a user-controlled key (CWE-639, an IDOR-style flaw) in Microsoft Azure Cosmos DB, Microsoft's managed NoSQL database service: an authenticated principal can supply or alter a resource identifier (key) that the service fails to validate against the caller's permissions. Triggered over a network by a low-privileged, authorized user who manipulates such a key (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N), the flaw lets the attacker bypass access checks and perform spoofing, i.e., impersonate another identity or act outside their authorized scope. Per the CVSS vector, successful exploitation carries high impact on the confidentiality, integrity, and availability of data in the affected database account, since the attacker can read or modify data as a different authorized identity. Any organization using Azure Cosmos DB is potentially affected; because it is a fully managed Azure service there are no customer-managed installations, and no affected version ranges are specified in the advisory data. The flaw was addressed in Microsoft's September 2026 Patch Tuesday cycle (966 flaws fixed, including 2 zero-days); no public proof-of-concept is known, it is not in CISA's KEV, and EPSS estimates only a ~0.4% chance of exploitation within 30 days.

Do: Review Microsoft's September 2026 security update guidance for CVE-2026-69857 and complete any required updates or customer-side actions for Azure Cosmos DB, confirming whether key rotation, RBAC/permission changes, or SDK updates are needed on your accounts. Because exploitation requires an authorized (authenticated) principal, audit who and what has access to Cosmos DB accounts, enforce least privilege on account keys and RBAC roles, and rotate account keys if exposure is suspected. No public PoC or in-the-wild exploitation is known and EPSS is low (~0.4% over 30 days), so treat this as high-priority routine patching within the normal Patch Tuesday cycle rather than an emergency.

CVE-2026-70178 is a missing authorization flaw (CWE-862) in Microsoft Fabric in which the service fails to verify whether a user is actually permitted to perform certain privileged actions. It is triggered over the network: an attacker who already holds low-privileged, authorized access to a Fabric tenant sends crafted requests, and because the authorization check is absent, the service executes them as if they were privileged. Successful exploitation yields elevation of privilege with high impact on confidentiality, integrity, and availability within the affected tenant, with no user interaction required. Any organization using Microsoft Fabric is in scope, with exposure concentrated in tenants where low-privilege users are provisioned. Exploitation has not been observed: there is no public proof-of-concept, the CVE is not in CISA's KEV, and EPSS assigns only a 0.4% probability of exploitation in the next 30 days.

Do: Confirm your tenant has received the September 2026 security updates referenced in Microsoft's Security Update Review; because Fabric is cloud-delivered, most tenants inherit fixes automatically, but check the Microsoft 365 admin center service health and the Microsoft advisory for component-specific notes. Audit role assignments and enforce least privilege for Fabric users, since any authenticated low-privileged user is the attack vector, and monitor for updated guidance or workarounds from Microsoft.

CVE-2026-70352 is a missing-authentication flaw (CWE-306) in Microsoft Azure AI Language, where a critical function can be reached without any credential check. An attacker triggers it by sending unauthenticated network requests to the affected Azure AI Language service, and per the CVSS score (AV:N/AC:L/PR:N/UI:N/S:C) the weakness is trivially exploitable remotely with no privileges or user interaction required. Because the impact is scoped-changed (S:C) with high confidentiality, integrity, and availability impact, a successful attacker gains elevated privileges within the service context, potentially reaching resources beyond the intended trust boundary. Any organization using the Azure AI Language cloud service is affected; as a Microsoft-managed service it was addressed through Microsoft's September 2026 security updates. There is currently no evidence of in-the-wild exploitation, no known public proof-of-concept, it is not on the CISA KEV list, and EPSS estimates only a 0.6% chance of exploitation in the next 30 days.

Do: Because Azure AI Language is a Microsoft-managed service, confirm via the Azure Service Health portal or Microsoft's September 2026 advisory that your tenant has received the patched service update — no customer-side patching should be required for the cloud service. Review Azure AI Language access logs for anomalous or unexpected unauthenticated requests, and as defense-in-depth restrict endpoints with network controls such as private endpoints, firewalls, or restricted network access rules.

CVE-2026-72981 is a use-after-free memory corruption flaw (CWE-416) in the IP Helper service of Microsoft Windows, assigned by Microsoft and addressed in the September 2026 security updates. An unauthenticated remote attacker can trigger the condition by getting the service to process malicious network input, though the high attack-complexity metric (AC:H) means reliable exploitation likely depends on specific memory layout or timing conditions. Successful exploitation grants the attacker arbitrary code execution on the target host with the privileges of the IP Helper service. Any Windows system running the IP Helper service, which is enabled by default on typical Windows installations, is potentially affected, although the disclosure does not specify exact affected version ranges. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists; EPSS currently estimates only a 0.5% probability of exploitation within 30 days.

Do: Apply Microsoft's September 2026 security updates (the relevant cumulative update for each Windows build) across endpoints and servers, prioritizing internet-exposed Windows hosts. Because the disclosure does not list exact affected versions, verify against Microsoft's advisory which builds require the fix before scheduling. Until patched, favor standard patch-cycle prioritization given the high attack complexity and lack of known exploitation, and review systems where the IP Helper service processes untrusted network traffic.

CVE-2026-72983 is a use-after-free memory-safety flaw (CWE-416) in the Windows Internet Connection Sharing (ICS) component, rated Critical (CVSS 9.8) because it is reachable over the network by an unauthenticated attacker with no user interaction. It is triggered by sending crafted network traffic to a Windows host running ICS — for example a machine sharing its connection or acting as a gateway/hotspot — causing the service to use memory that has already been freed. A successful attack lets the adversary execute arbitrary code on the affected host, giving full confidentiality, integrity and availability impact (C:H/I:H/A:H). Affected are Windows systems on which ICS is enabled and network-reachable; specific Windows version ranges are not provided in the source data, and Microsoft shipped the fix in its September 2026 security updates. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists yet; EPSS puts the 30-day exploitation probability at 0.9% (58th percentile).

Do: Apply Microsoft's September 2026 security updates on all Windows systems, prioritizing hosts that have Internet Connection Sharing or the mobile hotspot feature enabled or that sit on untrusted/exposed network segments. Where ICS is not needed, disable the SharedAccess service and restrict which hosts are permitted to act as network gateways. With no public PoC or KEV listing yet but a Critical network-reachable rating, treat patching as urgent before exploit details emerge.

CVE-2026-72986 is a heap-based buffer overflow (with an underlying integer overflow, per CWE-190) in the Graphic Fonts component assigned by Microsoft, the part of the Windows font-parsing/rendering stack that processes font data. An unauthorized, unauthenticated remote attacker can trigger the flaw by getting a user to load maliciously crafted font content — the CVSS vector requires user interaction, consistent with the victim opening a crafted document, email attachment, or web content that renders the malicious font. Successful exploitation gives the attacker arbitrary code execution on the victim system, with high impact to confidentiality, integrity, and availability. Anyone running affected Microsoft software that renders untrusted fonts is exposed until patched, which given the component is effectively the broad Windows installed base. As of this data there is no known public proof-of-concept, it is not in CISA's KEV catalog, EPSS estimates only a ~0.8% chance of exploitation within 30 days, and the fix shipped in Microsoft's September 2026 security updates.

Do: Apply Microsoft's September 2026 security updates to all Windows systems as soon as your patch cycle allows, prioritizing endpoints and servers that routinely handle untrusted documents, email attachments, or web content, and confirm the affected version ranges for your specific Windows builds in Microsoft's Security Update Guide. Until patched, caution users about opening untrusted font-bearing files, since exploitation requires user interaction; no public PoC or in-the-wild exploitation is currently known.

CVE-2026-73006 is a stack-based buffer overflow (CWE-121) in the Microsoft Graphics Component that an unauthenticated attacker can exploit remotely to execute code. The CVSS vector (AV:N/PR:N/UI:R) indicates the attack requires user interaction, meaning it is most likely triggered when a user opens or previews attacker-supplied content, such as a crafted document or image, that the Graphics Component renders. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability, typically in the context of the application or user handling the content. Affected systems are those running the impacted Microsoft software that includes the Graphics Component; specific product lists and version ranges are not enumerated in the available data, though related coverage ties the fix to Microsoft's September 2026 security updates. Exploitation is not currently observed: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns a 0.8% probability of exploitation within 30 days (55th percentile).

Do: Apply Microsoft's September 2026 security updates to all Windows systems as soon as feasible, prioritizing hosts that process untrusted files such as workstations, mail clients, and file-handling servers. No workaround is documented in the available data; because user interaction is required, caution around opening or previewing untrusted documents and images adds defense in depth. Verify patch compliance through Windows Update/WSUS and your vulnerability management tooling.

CVE-2026-73010 is a use-after-free memory-safety flaw (CWE-416) in the Windows Failover Cluster component, rated critical at CVSS 9.8 with a fully network-based attack vector. An unauthorized remote attacker can trigger the condition by sending network traffic that causes the component to use freed memory, with no privileges or user interaction required. Successful exploitation allows the attacker to execute arbitrary code over the network on the targeted system, with high impact on confidentiality, integrity, and availability. Affected organizations are those running Windows Server with the Failover Clustering feature enabled, particularly where cluster nodes or their service endpoints are reachable from untrusted networks. The flaw was addressed in Microsoft's September 2026 Security Update Review; there is no known public proof-of-concept, it is not yet in CISA's KEV catalog, and EPSS currently estimates only about a 0.9% chance of exploitation in the next 30 days.

Do: Apply the September 2026 Windows security updates from Microsoft to all cluster nodes, using Microsoft's recommended rolling-update procedure for clusters. Inventory servers with the Failover Clustering feature enabled and restrict network access to cluster service/RPC endpoints so they are not reachable from untrusted networks. Prioritize patching cluster nodes exposed to broader networks, and watch for updated KEV/EPSS signals given the critical severity despite the currently low exploitation probability.

CVE-2026-78444 is an untrusted pointer dereference (CWE-822) in the Windows Failover Cluster (Failover Clustering) feature of Windows Server. Per the CVSS vector, it can be triggered by an unauthorized attacker over a network with no privileges or user interaction required, though the high attack complexity means reliable exploitation is more difficult than in typical unauthenticated RCE flaws. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability on the affected cluster node. Only environments running Windows Server with Failover Clustering enabled are affected. As of the September 2026 Security Update Review, there is no known exploitation, no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a 0.5% probability of exploitation within 30 days (42nd percentile).

Do: Apply Microsoft's September 2026 security updates to every node in each failover cluster, since cluster patching is only complete when all nodes are updated. Check whether the Failover Clustering feature is enabled on any Windows Servers you manage and prioritize nodes reachable from untrusted network segments. Until patched, reduce exposure by restricting network access to cluster service endpoints through firewall and segmentation rules.

CVE-2026-78439 is a stack-based buffer overflow (CWE-121) in the Microsoft Graphics Component, rated High severity (CVSS 3.1: 8.8). It is reachable over a network without authentication, but the CVSS vector includes UI:R (user interaction required), meaning an attacker most plausibly triggers it by convincing a user to open or preview attacker-supplied content such as a crafted file. Successful exploitation gives the attacker code execution in the context of the local user, with high impact on confidentiality, integrity, and availability. Any Windows system running an affected version of the Graphics Component is potentially exposed; the source data does not enumerate specific Windows versions or builds, so defenders should check Microsoft's September 2026 security release for the exact affected ranges. There is currently no known in-the-wild exploitation, no public proof of concept, and the flaw is not listed in CISA's KEV, with EPSS assigning a 0.6% probability of exploitation within 30 days (48th percentile).

Do: Apply the Windows/Graphics Component fixes included in Microsoft's September 2026 security updates across all endpoints, prioritizing user workstations where file previewing is common. Until systems are patched, encourage users not to open or preview untrusted files and email attachments. Because exploitation requires user interaction and there is no public PoC or KEV listing, normal monthly patching cadence is likely adequate, but monitor Microsoft's advisory for revised affected-version details.

CVE-2026-78509 is a heap-based buffer overflow (CWE-122) in Microsoft Office Outlook that Microsoft rates Critical (CVSS 3.1: 9.8) and scores as exploitable over a network without authentication or user interaction (AV:N/AC:L/PR:N/UI:N). Per the vector, an attacker who can reach the vulnerable code path can corrupt heap memory and execute arbitrary code without credentials or user action, gaining code execution in the context of the affected Office/Outlook process. Successful exploitation carries high impact to confidentiality, integrity, and availability, effectively full remote code execution on the host, which in enterprise environments typically enables credential theft and lateral movement. Affected products per Microsoft's CPE data are Microsoft 365 / Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word, with the CVE description specifically naming Outlook; the flaw was addressed in the September 2026 Security Update Review. No public proof-of-concept is known, the CVE is not in CISA's KEV, and EPSS estimates only a ~1% probability of exploitation within 30 days (59th percentile), so no in-the-wild exploitation is currently known.

Do: Deploy the September 2026 security updates for Microsoft 365 Apps, Office 2019/2021/2024, and the Outlook/Word components, and verify installed build numbers against Microsoft's advisory, since no specific fixed versions are given in the source data. Because the flaw is scored as network-exploitable with no user interaction, prioritize Outlook/Office hosts, especially mail-processing endpoints, high-privilege workstations, and RDS/VDI servers. No workarounds are listed in the source data; watch for the addition of a public PoC or a CISA KEV listing as a trigger for accelerated patching.

Microsoft Copilot Studio, the low-code cloud service in the Power Platform used to build AI copilots and agents, fails to properly verify cryptographic signatures on certain network traffic (CWE-347), allowing signature checks to be bypassed. An unauthenticated attacker can trigger the flaw remotely over a network with no user interaction by sending a crafted request whose signature is accepted without correct verification. Successful exploitation elevates the attacker's privileges, and the changed-scope CVSS metric plus high confidentiality, integrity, and availability ratings indicate impact that extends beyond the immediate component. Because Copilot Studio is a multi-tenant Microsoft-hosted service, every organization using the service falls within the blast radius, and there are no on-premises versions to inventory. As of the September 2026 Patch Tuesday disclosure, no in-the-wild exploitation is known, there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a modest 0.3% probability of exploitation within 30 days.

Do: Because Copilot Studio is a Microsoft-managed SaaS offering, there is no customer-side patch to install; verify via the Microsoft 365 admin center (message center and service health) that the September 2026 service update has been applied to your tenant. In the meantime, review tenant audit logs for anomalous privilege changes or unexpected agent activity, and scrutinize the permissions and authentication settings of any agents exposed to unauthenticated users. Follow Microsoft's advisory for the CVE in case compensating controls or configuration guidance are provided.

CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.

Do: Immediately deploy the September 2026 Patch Tuesday cumulative updates to every Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2025 host; as a KEV entry under BOD 26-04, prioritize internet-exposed and high-value assets, apply vendor mitigations (or discontinue use) where patching is delayed, and follow CISA's forensics triage requirements if compromise is suspected. Verify deployment via patch telemetry and review which local accounts can trigger update-stack activity on shared or multi-user systems.

Microsoft Azure Active Directory B2C contains a critical authorization flaw (CWE-639, authorization bypass through user-controlled key) in which access decisions rely on an identifier supplied by the caller without fully verifying that the caller is entitled to use it. An unauthenticated attacker can trigger the flaw remotely over a network with low attack complexity and no user interaction, per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C). By supplying or tampering with the user-controlled key, the attacker bypasses authorization checks and elevates privileges, gaining high-impact access to data confidentiality and integrity (both rated High; availability is unaffected). All organizations using Azure AD B2C as their customer identity platform, and the end users behind those tenants, are potentially affected, since it is a Microsoft-hosted cloud service rather than customer-installed software. Per the September 2026 Security Update Review, the issue appears remediated through Microsoft's September 2026 update cycle; there is no public proof-of-concept, it is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS estimates only a 0.6% chance of exploitation in the next 30 days.

Do: Confirm via Microsoft's September 2026 advisory and your tenant's service health notifications that Azure AD B2C has received the fix; as a hosted service there is no customer-side version to install. Review tenant audit and sign-in logs for unexpected privilege changes or cross-user record access, and check custom policies and applications for authorization logic that trusts user-supplied identifiers (e.g., object IDs) without verification. Given the CVSS 10.0 rating, prioritize this validation now even though no in-the-wild exploitation or public PoC is known.

CVE-2026-83941 is a missing-authorization flaw (CWE-862) in Microsoft Entra ID, the cloud identity service behind Microsoft 365 and Azure. An already-authenticated, low-privileged user can send a network request to an Entra ID endpoint that fails to enforce proper authorization checks, requiring no user interaction. Exploitation lets the attacker elevate their privileges within the directory, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Any organization that uses Microsoft Entra ID is in the affected population. The flaw was patched in Microsoft's September 2026 Patch Tuesday release; it is not in CISA KEV, has no known public proof-of-concept, and carries a low EPSS of roughly 0.7%.

Do: Review Microsoft's September 2026 Patch Tuesday advisory for this CVE and apply any required tenant-side updates or configuration changes, noting that fixes for the cloud-hosted directory service are applied largely by Microsoft. Audit privileged role assignments and sign-in activity in your tenant for signs of unexpected elevation, and tighten who holds elevated roles. Monitor for additions to CISA KEV or public proof-of-concept code, which would raise urgency.