September 2026 Patch Tuesday forecast: All we need is more time
September 2026 Patch Tuesday forecast expects record CVE volume after August's 398 fixes, with SharePoint flaws CVE-2026-55040 and CVE-2026-63520 actively exploited.
This Patch Tuesday forecast column notes August 2026 Patch Tuesday was the second largest ever with 398 resolved CVEs, yet only one was confirmed actively exploited. SharePoint flaws CVE-2026-55040 and CVE-2026-63520 are being chained for authentication bypass and remote code execution in active attacks against unpatched servers. Microsoft Defender's ShieldBreak elevation of privilege flaw (CVE-2026-69414) is publicly disclosed with PoC code and a fix is expected, while Chrome CVE-2026-85046 was reported exploited in the wild. Several products, including Windows 11 24H2 Home/Pro and Exchange Server 2016/2019 ESU, reach end of support in October 2026.
- August 2026 Patch Tuesday fixed 398 CVEs (42 Critical), but only one was confirmed exploited in the wild
- SharePoint CVE-2026-55040 and CVE-2026-63520 chained for authentication bypass and RCE in active exploitation
- Exchange Server CVE-2026-62911 (CVSS 8.0) allows takeover of all user mailboxes and is considered ripe for exploitation
- Microsoft Defender ShieldBreak CVE-2026-69414 has PoC exploit code; fix expected in September Patch Tuesday
- Chrome update 152.0.7977.82/.83 fixed 12 CVEs including in-the-wild exploited CVE-2026-85046
- CVEs
- CVE-2026-55040CVE-2026-63520CVE-2026-62911CVE-2026-65816CVE-2026-69555CVE-2026-65801CVE-2026-69414CVE-2026-85046
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server | 9.1 | 70% | KEVPoC ×2 | KEV |
| CVE-2026-62911 | Capture-Replay Authentication Bypass in Microsoft Exchange Server | 8.0 | <1% | PoC | |
| CVE-2026-63520 | Unauthenticated RCE in Microsoft SharePoint Server | 8.1 | 3% | ||
| CVE-2026-65801 | SSRF Privilege Elevation in Microsoft Exchange Online | 10.0 | <1% | ||
| CVE-2026-65816 | Unauthenticated Privilege Elevation Flaw in Microsoft Azure Arc | 10.0 | <1% | ||
| CVE-2026-69414 | Local Elevation of Privilege in Microsoft Defender Malware Protection Engine | 7.8 | 1% | PoC | |
| CVE-2026-69555 | Incorrect Authorization in Microsoft Azure Arc Enables Network Privilege Escalation | 10.0 | <1% | ||
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
From the original article
4 min read at helpnetsecurity.com
The Patch Apocalypse is continuing unabated. We are seeing record numbers of patches being released and reported CVEs continue to grow as well. August 2026 Patch Tuesday was the second biggest in history with 398 resolved CVEs: 42 rated Critical, 355 rated Important, and 1 rated Moderate.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.