Microsoft Patch Tuesday Update September 2026 – 974 Vulnerabilities Fixed, Including 2 Zero-Days
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities across Windows and Office, including two actively exploited Windows privilege-escalation zero-days.
Microsoft's September 2026 Patch Tuesday addresses 974 vulnerabilities spanning Windows, Office, SQL Server, SharePoint, Exchange, Azure, and developer tools. Two Windows zero-days are confirmed exploited in attacks: CVE-2026-85880, a Windows ALPC elevation-of-privilege flaw, and CVE-2026-81963, a Windows Update Stack privilege-escalation flaw involving link following. The release also includes Critical fixes for Windows Secure Kernel Mode, VBS Enclave, Excel, and Word.
- 974 vulnerabilities fixed; 723 in Windows, 111 in Office, 62 in SQL Server
- CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack) actively exploited, both EoP
- Critical fixes include CVE-2026-83939 (Secure Kernel Mode), CVE-2026-83498 (VBS Enclave), Excel RCE CVE-2026-81959/CVE-2026-81953, and Word RCE CVE-2026-81952
- 25 republished non-Microsoft CVEs are excluded from the 974 total
- Both zero-days rated Important; limiting emergency patching to Critical-rated flaws would miss them
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-81952+3 related CVEs | Heap Buffer Overflow RCE in Microsoft Word (Office 2016-2024, Microsoft 365 & Apps) | 8.8 group max | <1% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
CVE-2026-83498+1 related CVE | Untrusted Pointer Dereference in Windows VBS Enclave Allows Local Privilege Escalation | 7.8 group max | <1% | ||
| CVE-2026-83939 | Untrusted Pointer Dereference LPE in Windows Secure Kernel Mode | 8.2 | <1% | ||
| CVE-2026-83941 | Missing Authorization in Microsoft Entra ID Enables Privilege Escalation | 8.8 | <1% | ||
| CVE-2026-83948 | Command Injection in Microsoft Azure CLI Allows Authenticated Remote Code Execution | 8.0 | <1% | ||
CVE-2026-83998+2 related CVEs | Heap Buffer Overflow RCE in Microsoft Remote Desktop Client | 8.8 group max | <1% | ||
| CVE-2026-83991 | Missing Authentication in Windows Cloud Files Mini Filter Enables Local Tampering | 5.5 | <1% | PoC | |
| CVE-2026-83997 | Use-After-Free RCE in Windows Message Queuing (MSMQ) | 8.1 | <1% | ||
| CVE-2026-84003 | Capture-replay authentication bypass in Microsoft MSAL for Node.js | 7.4 | <1% | ||
| CVE-2026-85877 | Heap-Based Buffer Overflow RCE in Windows Print Spooler Components (CVE-2026-85877) | 8.8 | <1% |
From the original article
3 min read at cybersecuritynews.com
Microsoft released its September 2026 Patch Tuesday security updates on September 8, addressing 974 vulnerabilities, including two zero-days already exploited in attacks. The release spans Windows, Microsoft Office, SQL Server, Exchange, SharePoint, Azure, and developer tools, requiring organizations to coordinate remediation across endpoints, servers, and enterprise application environments.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.