Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.
- Record 966 flaws fixed, including 105 Critical (81 RCE) and 20 elevation-of-privilege bugs.
- Two actively exploited zero-days: Windows Update Stack link-following EoP and Windows ALPC heap overflow.
- Both zero-days allow local attackers to gain SYSTEM privileges; no exploit details disclosed.
- Credits include Volexity, Proofpoint researchers, Romain Deperne, and Microsoft Threat Intelligence Centre.
- CVEs
- CVE-2026-69805CVE-2026-58649CVE-2026-69806CVE-2026-69439CVE-2026-69821CVE-2026-69624CVE-2026-62810CVE-2026-69395CVE-2026-62762CVE-2026-62813CVE-2026-69809CVE-2026-69359CVE-2026-69524CVE-2026-69546CVE-2026-72978CVE-2026-57099CVE-2026-69304CVE-2026-69401CVE-2026-62895CVE-2026-69857CVE-2026-77909CVE-2026-81349CVE-2026-69329CVE-2026-69516CVE-2026-80098CVE-2026-73014CVE-2026-83941CVE-2026-81381CVE-2026-81380CVE-2026-69576
- Vendors
- MicrosoftVolexityProofpoint
- Organizations
- Microsoft Threat Intelligence Centre
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-57099 | Unauthenticated resource-exhaustion DoS in ASP.NET Core | 7.5 | <1% | ||
CVE-2026-69439+2 related CVEs | Heap overflow in Microsoft .NET and Visual Studio allows network privilege escalation | 8.8 group max | <1% | ||
| CVE-2026-69546 | Use-After-Free RCE in Microsoft Active Directory Domain Services | 8.1 group max | <1% | ||
| CVE-2026-62895 | Permissive Cross-Domain Policy Privilege Elevation in Microsoft Azure Arc | 8.8 | <1% | ||
| CVE-2026-69304 | Unauthenticated DoS via compressed-data amplification in ASP.NET Core | 5.9 | <1% | ||
| CVE-2026-69401 | Use-After-Free Local Privilege Escalation in Microsoft Windows AVCTP Component | 7.0 | <1% | ||
| CVE-2026-69516 | Use-After-Free Local Privilege Escalation in Microsoft Windows Connected Devices Platform (Cdpsvc) | 7.0 | <1% | ||
| CVE-2026-69805 | External File Path Control in Microsoft .NET Enables Network Privilege Escalation | 8.1 | <1% | ||
| CVE-2026-69809 | Unauthenticated Memory-Leak DoS in Microsoft Active Directory Domain Services | 7.5 | 1% | ||
| CVE-2026-69857 | Authorization Bypass Through User-Controlled Key in Microsoft Azure Cosmos DB | 8.8 | <1% | ||
| CVE-2026-77909 | Insufficiently Protected Credentials in Microsoft Azure CycleCloud | 6.5 | <1% | ||
| CVE-2026-80098 | Signature Verification Flaw Allows Privilege Escalation in Microsoft Copilot Studio | 10.0 | <1% | ||
| CVE-2026-81349 | OS Command Injection Privilege Elevation in Microsoft Azure HDInsights | 7.2 | <1% | ||
CVE-2026-81381+1 related CVE | Insufficiently Protected Credentials in GitHub Copilot and Visual Studio Code | 7.5 group max | <1% | ||
| CVE-2026-83941 | Missing Authorization in Microsoft Entra ID Enables Privilege Escalation | 8.8 | <1% |
From the original article
11 min read at bleepingcomputer.com
Today is Microsoft's September 2026 Patch Tuesday, with security updates released for a record-breaking 966 flaws, including two actively exploited zero-day vulnerabilities. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.