Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

CVE-2026-58599 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Codecs Library, patched by Microsoft as part of the September 2026 Patch Tuesday. The CVSS vector (AV:L, UI:R, no privileges required) indicates the flaw is triggered locally when the codecs library processes specially crafted content, requiring user interaction such as opening a malicious media or image file. A successful attacker can execute arbitrary code in the context of the local user with no prior privileges, with high impact on confidentiality, integrity, and availability. Any Windows system containing the affected Windows Codecs Library is exposed, though the source data does not enumerate specific Windows versions or builds. Exploitation is currently quiet: there is no public proof-of-concept, no CISA KEV listing, and EPSS estimates only about a 0.3% probability of exploitation within 30 days (25th percentile).

Do: Apply Microsoft's September 2026 security updates (Windows cumulative updates) to all supported systems, prioritizing user workstations where untrusted image or media files are routinely opened. Until systems are patched, treat unsolicited image and media files with caution, since exploitation requires user interaction to trigger the overflow. Verify through Windows Update or your patch-management tooling that the September 2026 cumulative update has been installed on each endpoint.

Microsoft SQL Server contains an injection vulnerability (CWE-74) in which special elements in output used by a downstream component are not properly neutralized. An unauthorized attacker can trigger the flaw remotely over a network, though the CVSS vector indicates that some form of user interaction is required in the attack path. Successful exploitation allows elevation of privileges with high impact on confidentiality, integrity, and availability, and the changed-scope metric suggests the attack crosses a security boundary into another component. Any organization running affected Microsoft SQL Server versions is potentially exposed, although the data provided does not specify exact affected version ranges. No public proof of concept, CISA KEV listing, or known exploitation exists; EPSS estimates only a 0.7% probability of exploitation in the next 30 days, and the fix shipped with Microsoft's record-setting September 2026 Patch Tuesday release (974 flaws patched).

Do: Apply the SQL Server security updates from Microsoft's September 2026 Patch Tuesday as soon as practical, prioritizing internet-exposed instances and servers that accept untrusted input whose output feeds downstream components. With no public PoC or KEV listing, near-term risk appears low, but re-prioritize if technical details or exploit code emerge. Verify deployed SQL Server builds against Microsoft's advisory for CVE-2026-65669 to confirm remediation.

CVE-2026-65772 is a deserialization of untrusted data flaw (CWE-502) in Microsoft Dynamics 365 that allows an authorized (authenticated, low-privilege) attacker to execute code over the network. It is triggered when the application processes attacker-controlled serialized data, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network exploitation with low attack complexity, low required privileges, and no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability, effectively amounting to remote code execution within the affected Dynamics 365 environment. Any organization running the affected Microsoft Dynamics 365 deployments is in scope, with authenticated users or compromised low-privileged accounts able to trigger the flaw; the available data does not specify which Dynamics 365 editions or version ranges are affected. As of the September 2026 Patch Tuesday coverage, there is no evidence of in-the-wild exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns roughly a 0.9% probability of exploitation within 30 days (58th percentile).

Do: Apply the Microsoft security update for CVE-2026-65772 released in the September 2026 Patch Tuesday cycle, prioritizing internet-facing, multi-user, or production Dynamics 365 environments where low-privileged users can reach the vulnerable endpoint. Because the affected version range is not specified here, verify applicability against Microsoft's advisory and confirm your deployed editions/versions before and after patching. Until patched, restrict and monitor authenticated access to Dynamics 365, and watch for changes in EPSS, KEV, or public proof-of-concept status.

CVE-2026-66302 is a critical (CVSS 9.8) vulnerability in Microsoft Skype for Business in which an external attacker controls the file name or path used by the software (CWE-73, external control of file name or path). The flaw is exploitable over a network with no authentication, no privileges, and no user interaction, so a remote unauthenticated attacker who can reach the affected Skype for Business service can trigger it. Successful exploitation yields remote code execution on the target, with high impact on confidentiality, integrity, and availability. Any organization running the affected Skype for Business deployment, presumably the on-premises Skype for Business server product, is affected; the available data does not specify the exact affected version ranges. No public proof-of-concept is known, the CVE is not in CISA's KEV catalog, and EPSS assigns roughly a 0.5% probability of exploitation in the next 30 days, so no exploitation is currently known.

Do: Apply Microsoft's September 2026 Patch Tuesday updates for Skype for Business as soon as testing permits, since the fix is delivered through that release. Until patched, restrict network access to Skype for Business services (for example, firewall or VPN rules limiting who can reach the server), and identify any Skype for Business endpoints exposed to the internet for prioritized patching and monitoring. Check vendor advisory pages for the specific affected and fixed version numbers for your deployment.

Microsoft SQL Server contains an untrusted pointer dereference (CWE-822), a memory-safety flaw in which the database engine dereferences a pointer derived from untrusted input. It is triggered remotely by an authorized, low-privileged attacker whose input causes the engine to follow the invalid pointer; the high attack complexity (AC:H) in the CVSS vector means successful exploitation depends on specific runtime conditions. A successful attacker gains remote code execution, and the changed-scope (S:C) designation plus high confidentiality, integrity, and availability scores indicate code may execute beyond the SQL Server service's normal security context with severe impact. Any organization running affected Microsoft SQL Server builds is exposed, though the available data does not specify affected version ranges, so defenders should consult Microsoft's advisory for exact builds. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known, and EPSS estimates only a 0.5% probability of exploitation within the next 30 days.

Do: Apply the security updates released in Microsoft's September 2026 Patch Tuesday for SQL Server, prioritizing internet-facing and multi-tenant instances, and confirm your installed builds against the affected ranges in Microsoft's advisory. Since exploitation requires an authorized account, restrict TCP 1433 to trusted networks, minimize and rotate SQL logins, and enforce least-privilege database roles. Monitor Microsoft's advisory for updated version information and any changes in exploitation status.

CVE-2026-67631 is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server, rated 8.8 (High) on CVSS 3.1 by Microsoft. A remote attacker who already holds valid low-privileged credentials - an "authorized attacker" per Microsoft - can send crafted input to the database engine over the network to overflow a heap buffer, with no user interaction required. Successful exploitation runs code in the context of the SQL Server process and carries high impact on confidentiality, integrity, and availability, typically meaning full compromise of the affected service. Organizations running Microsoft SQL Server are in scope; the available data does not specify affected version ranges, and fixes were distributed through Microsoft's September 2026 Patch Tuesday, per related Patch Tuesday coverage. There are no known public exploits, the flaw is not in CISA's KEV catalog, and EPSS assigns a 0.6% (roughly median) probability of exploitation within 30 days.

Do: Install the SQL Server security updates from Microsoft's September 2026 Patch Tuesday on all instances, prioritizing any that are internet-facing or reachable on TCP 1433. Because exploitation requires an authorized account, audit low-privileged SQL logins and application service accounts, restrict network exposure of database ports, and monitor using the Snort signatures released alongside the September 2026 updates.

CVE-2026-69499 is an integer overflow/wraparound flaw (CWE-190) in the Windows Imaging Component (WIC), the Windows subsystem that decodes image formats such as those used by photos, previews, and thumbnails. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated remote attacker must induce user interaction, most plausibly by having a user open or preview a specially crafted image file delivered over a network. Successful exploitation would allow the attacker to execute arbitrary code in the context of the affected user, with high impact on confidentiality, integrity, and availability. Because WIC is a built-in Windows component, any Windows system that processes images from untrusted sources is affected; the source data does not enumerate specific affected Windows versions. As of the reported data there is no known exploitation, no public proof-of-concept, and the flaw is not in CISA KEV, with EPSS estimating only a 0.8% chance of exploitation within 30 days.

Do: Install the Windows security updates released in Microsoft's September 2026 Patch Tuesday as they become available to your environment, prioritizing endpoints and servers where users routinely open untrusted image files. Because the affected Windows version list was not provided in the source data, consult Microsoft's advisory to confirm which builds your estate runs and ensure updates cover them. There are no published workarounds, so patching is the primary mitigation; monitor the dashboard for exploitation indicators given the EPSS score may rise if a PoC emerges.

CVE-2026-69501 is an untrusted pointer dereference (CWE-822) in Microsoft Windows' Secure Kernel Mode, the isolated kernel component that supports Windows security features such as virtualization-based security. The flaw is triggered locally by an authorized attacker with low privileges and requires no user interaction, although the high attack complexity (AV:L/AC:H/PR:L) means exploitation depends on difficult-to-arrange conditions. Successful exploitation allows the attacker to elevate their privileges locally on the host, with high impact on confidentiality, integrity, and availability. All Windows systems running the affected Secure Kernel code are potentially affected, but the specific affected Windows versions were not provided in the available data. As of the September 2026 Patch Tuesday reporting, no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation in the next 30 days (15th percentile).

Do: Apply Microsoft's September 2026 Patch Tuesday security updates for Windows promptly and verify installed OS builds against the Microsoft advisory, since affected version details were not included here. As interim mitigation, restrict local/interactive sign-in on high-value hosts to trusted users. Monitor for public PoC releases or CISA KEV addition given the high-severity rating.

CVE-2026-69590 is a heap-based buffer overflow (CWE-122) in the Windows Routing and Remote Access Service (RRAS) that allows remote code execution, rated 9.8 Critical with a network attack vector requiring no privileges or user interaction. An attacker can trigger the flaw by sending crafted network traffic to a system running the RRAS service, and successful exploitation grants unauthorized access and code execution on the victim machine with high impact to confidentiality, integrity, and availability. Affected systems are Windows machines with the RRAS role/service enabled, typically servers used as VPN endpoints, routers, or NAT gateways; the specific affected Windows version ranges are not specified in the available data. The flaw was addressed in Microsoft's September 2026 Patch Tuesday release (September 8, 2026). There is no known exploitation in the wild, no public proof-of-concept, and it is not in CISA KEV, with EPSS estimating only a 1.0% chance of exploitation within 30 days (60th percentile).

Do: Apply the September 2026 (Sep 8, 2026) Windows security updates on all systems with the Routing and Remote Access Service enabled, prioritizing internet-facing VPN and routing servers. As an interim mitigation, restrict exposure of RRAS-related ports (e.g., TCP 1723 and related VPN traffic) to trusted networks or disable the RRAS role if it is not in use. Inventory systems for the RRAS role before patching, since the service is off by default on most Windows installations.

CVE-2026-69601 is a heap-based buffer overflow (CWE-122) in Microsoft Windows Media Foundation, the multimedia framework bundled with the Windows operating system. The flaw is reached by network-delivered, specially crafted media content; the CVSS vector's user-interaction requirement indicates a user must open or preview malicious media for the overflow to be triggered. A successful attack allows an unauthenticated remote attacker to execute code in the context of the affected user, with high impact on confidentiality, integrity, and availability. Because Media Foundation is a built-in Windows component, essentially all supported Windows client and server deployments are affected; the available data does not list specific vulnerable version ranges. There is no confirmed in-the-wild exploitation so far (not in CISA KEV, no public PoC, EPSS roughly 0.8% over 30 days), and Microsoft shipped fixes in its September 2026 Patch Tuesday release.

Do: Apply the Windows security updates from Microsoft's September 2026 Patch Tuesday to all clients and servers, prioritizing user workstations and shared systems where media files are routinely opened or previewed. Until systems are patched, advise users to exercise caution with media content from untrusted network sources and consider deploying the Snort rules published alongside the Patch Tuesday advisory for detection. Audit patch compliance across the estate, since any Windows host that has not received the September 2026 update should be considered vulnerable.

CVE-2026-69676 is a capture-replay authentication bypass (CWE-294) in the Windows Kerberos implementation, disclosed by Microsoft as part of the September 2026 Patch Tuesday. An attacker who is already authorized (low-privilege credentials) can replay captured authentication material over the network to bypass authentication checks. Successful exploitation results in remote code execution, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score of 8.8). Any organization running Windows in an Active Directory environment is potentially affected, since Kerberos is the default authentication protocol for Windows domains. As of this analysis there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a ~1.2% chance of exploitation within 30 days, though it shipped in a record-sized Patch Tuesday release alongside two actively exploited zero-days.

Do: Apply Microsoft's September 2026 Windows security updates as soon as possible, prioritizing domain controllers, DHCP/DNS servers, and other Kerberos-reliant infrastructure. Review network segmentation and monitor for replayed-ticket anomalies; network defenders can also enable the Snort detection rules published alongside this Patch Tuesday. Confirm applicability against Microsoft's advisory, since the affected version ranges were not enumerated in the available data.

CVE-2026-69730 is a use-after-free memory corruption flaw (CWE-416) in the Windows DNS service that allows an unauthenticated, remote attacker to execute arbitrary code by sending crafted network traffic to the affected system. Because the flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1 9.8), any system running the vulnerable DNS service is a direct target. Successful exploitation would give the attacker code execution in the context of the DNS service, which on Windows Server typically runs with high privileges such as SYSTEM, and could enable wormable spread between vulnerable hosts. Affected organizations are those running the Windows DNS Server role — a component deployed on virtually all Windows Server domain controllers and on dedicated Windows DNS servers, especially those exposed to untrusted networks. As of the September 2026 Patch Tuesday release, there is no known public proof-of-concept, the flaw is not listed in CISA's KEV, and it has not been confirmed exploited in the wild, though it was flagged among roughly 20 'wormable' bugs and described in press coverage as a successor to the 2020 SigRed Windows DNS RCE.

Do: Apply Microsoft's September 2026 Patch Tuesday security updates to every Windows Server running the DNS Server role as soon as possible, prioritizing internet-facing DNS servers and domain controllers. Until patched, limit exposure of TCP/UDP port 53 from untrusted networks and restrict remote management surfaces. Because the bug is rated wormable and shares characteristics with the 2020 SigRed DNS RCE, treat unpatched domain controllers as high priority and check DNS service event logs for unexpected restarts or anomalous query handling.

CVE-2026-69845 is a heap-based buffer overflow caused by improper input validation (CWE-20/CWE-122) in the Windows DHCP Server service, letting an unauthorized remote attacker execute arbitrary code with no privileges or user interaction required. An attacker triggers it by sending specially crafted DHCP network traffic to a machine running the DHCP Server role, and successful exploitation gives full compromise of the affected host (confidentiality, integrity, and availability all rated high per the 9.8 CVSS score). Affected products span Windows 10 1607 and 1807/1809-era releases through Windows Server 2012, 2016, 2019, 2022, and 2025, meaning both legacy out-of-support and current server builds are exposed. Microsoft addressed the flaw in the September 2026 Patch Tuesday release. No public proof-of-concept or in-the-wild exploitation is known, and EPSS currently puts 30-day exploitation probability at about 1%.

Do: Apply the September 2026 Patch Tuesday security updates to every listed Windows 10 and Windows Server build, prioritizing servers actually running the DHCP Server role (often domain controllers). Where patching is delayed, restrict UDP 67/68 traffic to trusted VLANs/segments via firewall or ACL rules so unmanaged hosts cannot send crafted DHCP packets to the server. Watch for repeated crashes of the DHCP service (dhcpserver.exe) or anomalous heap-corruption events in server logs, and confirm Windows Server 2012 systems still under your control have an extended-security-update path, since they are past mainstream support.

CVE-2026-69854 is an improper authentication flaw (CWE-287) in Microsoft's Spring Cloud Azure, the integration library that connects Java/Spring Boot applications to Azure cloud services. A remote, unauthenticated attacker can trigger flawed authentication checks over the network; no privileges or user interaction are required, but the attack carries high complexity per the CVSS score. Successful exploitation allows privilege elevation, with high confidentiality, integrity, and availability impact and a changed scope, meaning the attacker gains authority beyond the intended application trust boundary. Applications built with the affected Spring Cloud Azure components are affected. There is no known exploitation in the wild, no public proof-of-concept, and a low EPSS score (0.6%), and the fix appears to ship with Microsoft's September 2026 Patch Tuesday.

Do: Upgrade Spring Cloud Azure to the fixed release identified in Microsoft's September 2026 Patch Tuesday advisory, since the available data does not include specific fixed version numbers. Prioritize internet-facing Spring Boot applications that rely on the library for Azure authentication, review your dependency tree for the vulnerable component, and monitor authentication logs for anomalies until patched.

CVE-2026-69857 is an authorization bypass through a user-controlled key (CWE-639, an IDOR-style flaw) in Microsoft Azure Cosmos DB, Microsoft's managed NoSQL database service: an authenticated principal can supply or alter a resource identifier (key) that the service fails to validate against the caller's permissions. Triggered over a network by a low-privileged, authorized user who manipulates such a key (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N), the flaw lets the attacker bypass access checks and perform spoofing, i.e., impersonate another identity or act outside their authorized scope. Per the CVSS vector, successful exploitation carries high impact on the confidentiality, integrity, and availability of data in the affected database account, since the attacker can read or modify data as a different authorized identity. Any organization using Azure Cosmos DB is potentially affected; because it is a fully managed Azure service there are no customer-managed installations, and no affected version ranges are specified in the advisory data. The flaw was addressed in Microsoft's September 2026 Patch Tuesday cycle (966 flaws fixed, including 2 zero-days); no public proof-of-concept is known, it is not in CISA's KEV, and EPSS estimates only a ~0.4% chance of exploitation within 30 days.

Do: Review Microsoft's September 2026 security update guidance for CVE-2026-69857 and complete any required updates or customer-side actions for Azure Cosmos DB, confirming whether key rotation, RBAC/permission changes, or SDK updates are needed on your accounts. Because exploitation requires an authorized (authenticated) principal, audit who and what has access to Cosmos DB accounts, enforce least privilege on account keys and RBAC roles, and rotate account keys if exposure is suspected. No public PoC or in-the-wild exploitation is known and EPSS is low (~0.4% over 30 days), so treat this as high-priority routine patching within the normal Patch Tuesday cycle rather than an emergency.

CVE-2026-70296 is a critical (CVSS 9.8) out-of-bounds write vulnerability (CWE-787) in the Windows Imaging Component (WIC), the built-in Microsoft Windows component that handles image and codec processing. Per the advisory and CVSS vector, an unauthorized attacker can trigger the flaw over a network without credentials or user interaction, though the available data does not specify the exact trigger path. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability of the affected system. Because WIC ships as a standard part of Windows, essentially every system running an affected Windows build is exposed until patched. As of the data available, there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 1.0% (60th percentile); fixes were distributed as part of Microsoft's September 2026 Patch Tuesday, with Snort detection rules published.

Do: Apply the September 2026 Microsoft security updates for CVE-2026-70296 as soon as possible, prioritizing internet-facing and shared Windows systems, and verify against the affected builds listed in the Microsoft advisory. Until patched, deploy the Snort rules released alongside the September 2026 Patch Tuesday to detect exploitation attempts. Inventory Windows assets for pending Patch Tuesday status to confirm remediation coverage.

CVE-2026-70585 is a use-after-free (CWE-416) memory-safety flaw in the Windows Services for NFS ONCRPC XDR driver, the Windows component that handles ONCRPC/XDR protocol processing for NFS interoperability. An authorized attacker with low privileges on the host can trigger the flaw locally with no user interaction, though exploitation is rated high attack complexity, and successful exploitation yields local code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.0 High). Exposure is limited to Windows systems where the optional Services for NFS / Client for NFS feature is enabled, since the vulnerable driver is tied to that NFS interoperability functionality. As of the September 2026 Patch Tuesday release, there is no known in-the-wild exploitation, no public proof of concept, the flaw is not in CISA KEV, and EPSS assigns a low 0.3% 30-day exploitation probability.

Do: Apply Microsoft's September 2026 Patch Tuesday cumulative updates to Windows hosts, prioritizing servers and workstations where the Client for NFS / Services for NFS feature is enabled and untrusted local users can log on. Where NFS interoperability is not required, disabling the optional Services for NFS feature is a reasonable interim mitigation. Confirm remediation via the Windows update history for the September 2026 release, and note that high attack complexity plus low EPSS make this urgent-but-not-critical patching.

CVE-2026-72957 is a heap-based buffer overflow (CWE-122) in Microsoft's Windows Deployment Services (WDS), the optional Windows Server role used for network-based operating system deployment such as PXE boot and imaging. The flaw is triggered locally: an authorized, low-privileged attacker sends crafted input to the WDS service, overflowing a heap buffer with no user interaction required. Successful exploitation allows the attacker to execute code locally on the affected server, and the high confidentiality, integrity, and availability ratings combined with the low privilege requirement are consistent with a local elevation-of-privilege outcome. Any organization running the WDS server role on Windows Server is affected; the provided data does not specify which Windows Server versions are impacted. As of the available data the flaw is not known to be exploited: it is absent from CISA KEV, has no public proof-of-concept, carries a low 0.3% EPSS score, and was addressed in Microsoft's September 2026 Patch Tuesday.

Do: Apply Microsoft's September 2026 security updates (Patch Tuesday) covering Windows Deployment Services on every server with the WDS role installed; no specific KB number or fixed version is provided in the available data. Inventory servers for the role (for example via Server Manager or Get-WindowsFeature WDS) and prioritize patching hosts where low-privileged users can log on locally. Because the attack vector is local and there is no known exploitation, standard patch cadence is likely sufficient, but monitor for the emergence of public PoCs or KEV listings.

CVE-2026-7296 is a use-after-free memory-corruption flaw (CWE-416) in the Windows DHCP Server role, rated critical (CVSS 9.8). An unauthenticated attacker can trigger it by sending network traffic to the DHCP service, with no credentials or user interaction required. Successful exploitation allows arbitrary code execution on the DHCP server, with high impact on confidentiality, integrity, and availability per the CVSS vector. Any Windows Server with the DHCP Server role enabled is affected; the available data does not enumerate specific affected or fixed build numbers. As of the September 2026 Patch Tuesday release (which patched a record 974 flaws, including two separately exploited Windows zero-days), there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates roughly a 1% probability of exploitation within 30 days.

Do: Apply the September 2026 Microsoft security updates to every Windows Server with the DHCP Server role, prioritizing servers reachable from untrusted networks such as guest Wi-Fi, branch, and edge sites. Until patched, restrict DHCP traffic (UDP ports 67 and 68) to trusted network segments and monitor for anomalous DHCP activity. Inventory the role on your estate (e.g., via Windows Server role/DHCP server audits) to confirm patch coverage.

CVE-2026-73013 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component, the built-in Windows framework that decodes and processes image files. The flaw is reachable over the network but requires user interaction (CVSS AV:N with UI:R): an unauthenticated ('unauthorized') attacker must get a user to open or preview a specially crafted image — for example via an email attachment or web-delivered file — causing heap memory corruption in the imaging pipeline. Successful exploitation yields remote code execution running as the logged-on user, with high-rated impacts on confidentiality, integrity, and availability. Any user of the affected Windows versions that ship Windows Imaging Component is exposed, and the issue was addressed as part of Microsoft's September 2026 Patch Tuesday. Exploitation is currently not known: there is no public proof-of-concept, the CVE is not in the CISA KEV catalog, and EPSS assigns a 0.6% probability of exploitation within 30 days (45th percentile).

Do: Deploy the September 2026 Windows security updates from Microsoft as soon as possible, prioritizing endpoints whose users routinely handle images and documents from untrusted sources. Check Microsoft's advisory for the exact affected Windows versions and builds applicable to your fleet. Until patched, caution users against opening image files from untrusted senders or websites; no in-the-wild exploits or public PoCs are currently known.

CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.

Do: Immediately deploy the September 2026 Patch Tuesday cumulative updates to every Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2025 host; as a KEV entry under BOD 26-04, prioritize internet-exposed and high-value assets, apply vendor mitigations (or discontinue use) where patching is delayed, and follow CISA's forensics triage requirements if compromise is suspected. Verify deployment via patch telemetry and review which local accounts can trigger update-stack activity on shared or multi-user systems.

An out-of-bounds read (CWE-125) in the Windows Virtualization-Based Security (VBS) Enclave allows a locally authenticated, low-privilege attacker to read memory beyond the enclave's intended boundary. It is triggered by code running locally under an authorized account that interacts with the enclave, with no user interaction required. The result is information disclosure only - potentially leaking data the enclave was meant to isolate, such as secrets or protected content - with no impact on integrity or availability. Any Windows system with VBS Enclave support is affected; Microsoft patched the issue in its September 2026 Patch Tuesday release, which fixed 974 vulnerabilities. No public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and EPSS assigns roughly a 0.3 percent 30-day exploitation probability, so no exploitation is currently known.

Do: Install the September 2026 Windows security updates that include the fix for CVE-2026-83501, prioritizing shared workstations, terminal servers and enterprise/developer systems where untrusted local users can run code and VBS enclaves are in use. Check whether VBS is running and whether any deployed applications rely on enclaves (for example, via the Virtualization-based security status in msinfo32). Given no public PoC or known exploitation, standard patch-cycle urgency is reasonable.

CVE-2026-83939 is an untrusted pointer dereference (CWE-822) in the Windows Secure Kernel Mode, the high-privilege virtualization-based security component of Windows. A local attacker who is already authorized and holds high privileges on the system can trigger the flaw by causing the Secure Kernel to dereference an attacker-influenced pointer, gaining local elevation of privileges. Because the CVSS scope is 'changed' (S:C), the flaw lets an attacker cross a security boundary beyond the process they started in, with high impact on confidentiality, integrity and availability. Any Windows installation whose Secure Kernel component is affected is at risk, per Microsoft's September 2026 Patch Tuesday advisory; exact version ranges are listed in Microsoft's bulletin. There is no known in-the-wild exploitation, no public proof-of-concept, and a low 0.3% EPSS probability of exploitation in the next 30 days, but a fix shipped as part of the 974-vulnerability September 2026 release.

Do: Install the September 2026 Windows security (cumulative) updates from Microsoft's Patch Tuesday release for every affected Windows version in your environment; do not skip workloads where virtualization-based security features (e.g., HVCI/Credential Guard) are enabled, as they rely on the affected Secure Kernel. Because the flaw requires an attacker to already hold high local privileges, treat it as a chaining/enabler risk for adversary-in-the-middle post-exploitation and prioritize patching hosts with many privileged users or admins. No workaround or mitigation is listed in the source data; check Microsoft's advisory for per-version applicability and any released mitigation guidance.