Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1
Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.
Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.
- CISA added CVE-2026-81963 and CVE-2026-85880 to the KEV database on September 8, 2026
- Affected products span Windows, Windows Server, Office, .NET, ASP.NET Core, Exchange, SharePoint and Azure services
- Cyber Centre recommends administrators review links and apply Microsoft's September 2026 updates promptly
- Vendors
- Microsoft
- Organizations
- Canadian Centre for Cyber SecurityCISA
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
2 min read at cyber.gc.ca
Serial Number: AV26-896 Date: September 8, 2026 As of September 8, 2026, Microsoft is affected by vulnerabilities in the following products: . NET 10. 0 installed on Linux .
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.