Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including 113 critical, with two Windows privilege-escalation bugs (CVE-2026-81963, CVE-2026-85880) exploited in the wild.
Microsoft's September 2026 security update addresses 973 vulnerabilities across its product lineup, 113 rated critical, of which 82 are remote code execution flaws. Two vulnerabilities are confirmed exploited in the wild: CVE-2026-81963, an elevation-of-privilege flaw in the Windows Update Stack (CVSS 7.8), and CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call (CVSS 7.8). Microsoft flags several bugs as more likely to be exploited, including a 9.8 RCE in Windows DNS Server (CVE-2026-69730), an 8.8 RCE in Windows Kerberos (CVE-2026-69676), and a 9.0 EoP in Spring Cloud Azure (CVE-2026-69854). Cisco Talos published accompanying Snort rules to detect exploitation attempts against the prominent flaws.
- 973 vulnerabilities patched; 113 rated critical, 82 of them remote code execution bugs.
- CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows ALPC) exploited in the wild, both CVSS 7.8 EoP flaws.
- Windows DNS Server 9.8 RCE (CVE-2026-69730) and Kerberos 8.8 RCE (CVE-2026-69676) rated more likely to be exploited.
- Cisco Talos published Snort rules covering the most prominent September 2026 Microsoft vulnerabilities.
- CVEs
- CVE-2026-81963CVE-2026-85880CVE-2026-69676CVE-2026-69852CVE-2026-72957CVE-2026-69854CVE-2026-83501CVE-2026-70585CVE-2026-69730CVE-2026-69857CVE-2026-69845CVE-2026-72979CVE-2026-58599CVE-2026-65772CVE-2026-66302CVE-2026-67631CVE-2026-65669CVE-2026-67378CVE-2026-69499CVE-2026-70296CVE-2026-73023CVE-2026-77495CVE-2026-73013CVE-2026-69501CVE-2026-83939CVE-2026-69906CVE-2026-69846CVE-2026-69590CVE-2026-72959CVE-2026-69601
- Tags
- dns-servermicrosoftpatch-tuesdayprivilege-escalationremote-code-executionsnortvulnerability-managementwindows
- Vendors
- MicrosoftCisco Talos
- Organizations
- MicrosoftCisco Talos
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58599 | Heap Buffer Overflow in Microsoft Windows Codecs Library Enables Local Code Execution | 7.8 | <1% | ||
| CVE-2026-65669 | Injection Flaw in Microsoft SQL Server Enables Network Privilege Escalation | 9.6 | <1% | ||
| CVE-2026-65772 | Deserialization RCE in Microsoft Dynamics 365 | 8.8 | <1% | ||
| CVE-2026-66302 | Critical unauthenticated file-path RCE in Microsoft Skype for Business | 9.8 | <1% | ||
| CVE-2026-67378 | Untrusted Pointer Dereference RCE in Microsoft SQL Server (authorized attacker) | 9.0 | <1% | ||
| CVE-2026-67631 | Heap-Based Buffer Overflow in Microsoft SQL Server Allows Authenticated RCE | 9.8 | <1% | ||
| CVE-2026-69730 | Use-After-Free RCE in Windows DNS Server | 9.8 group max | 1% | ||
| CVE-2026-69501 | Untrusted Pointer Dereference Privilege Elevation in Windows Secure Kernel Mode | 7.0 | <1% | ||
| CVE-2026-69854 | Improper Authentication in Spring Cloud Azure Enables Network Privilege Elevation | 8.1 | <1% | ||
| CVE-2026-69857 | Authorization Bypass Through User-Controlled Key in Microsoft Azure Cosmos DB | 8.8 | <1% | ||
| CVE-2026-70585 | Use-after-free in Windows Services for NFS ONCRPC XDR Driver enables local code execution | 7.0 | <1% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
| CVE-2026-83501 | Out-of-Bounds Read in Windows Virtualization-Based Security (VBS) Enclave | 5.5 | <1% | ||
| CVE-2026-83939 | Untrusted Pointer Dereference LPE in Windows Secure Kernel Mode | 8.2 | <1% |
From the original article
12 min read at blog.talosintelligence.com
Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical."
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.