September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th)

CVE-2026-58649 is an origin validation error (CWE-346) in Microsoft's .NET platform, meaning the runtime fails to correctly verify the origin of network requests, allowing an unauthenticated attacker to trigger an information-disclosure condition. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the flaw is reachable over a network with low attack complexity and no privileges required, but a victim user must interact with attacker-influenced content for it to fire. A successful attacker gains access to confidential information handled by the affected application (confidentiality impact rated High), with no integrity or availability impact. Any organization running supported .NET deployments that have not yet received the September 2026 Patch Tuesday updates is potentially affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation probability at just 0.3%, so no in-the-wild exploitation is known.

Do: Apply Microsoft's September 2026 .NET security updates as part of this month's Patch Tuesday rollout, and check Microsoft's advisory for the exact version ranges that need upgrading. Prioritize internet-facing .NET/ASP.NET applications that perform cross-origin request handling, and review their origin-verification (CORS) configuration as an interim risk reduction. Because exploitation requires user interaction, also treat user-facing lure links as part of the realistic attack path until systems are patched.

CVE-2026-66302 is a critical (CVSS 9.8) vulnerability in Microsoft Skype for Business in which an external attacker controls the file name or path used by the software (CWE-73, external control of file name or path). The flaw is exploitable over a network with no authentication, no privileges, and no user interaction, so a remote unauthenticated attacker who can reach the affected Skype for Business service can trigger it. Successful exploitation yields remote code execution on the target, with high impact on confidentiality, integrity, and availability. Any organization running the affected Skype for Business deployment, presumably the on-premises Skype for Business server product, is affected; the available data does not specify the exact affected version ranges. No public proof-of-concept is known, the CVE is not in CISA's KEV catalog, and EPSS assigns roughly a 0.5% probability of exploitation in the next 30 days, so no exploitation is currently known.

Do: Apply Microsoft's September 2026 Patch Tuesday updates for Skype for Business as soon as testing permits, since the fix is delivered through that release. Until patched, restrict network access to Skype for Business services (for example, firewall or VPN rules limiting who can reach the server), and identify any Skype for Business endpoints exposed to the internet for prioritized patching and monitoring. Check vendor advisory pages for the specific affected and fixed version numbers for your deployment.

CVE-2026-69579 is a use-after-free memory corruption flaw (CWE-416) in Microsoft's Windows Message Queuing (MSMQ) component, patched as part of Microsoft's September 2026 Patch Tuesday. A remote, unauthenticated attacker can trigger the flaw over the network by sending crafted traffic to the MSMQ service, with no user interaction or privileges required (CVSS 3.1 9.8: AV:N/AC:L/PR:N/UI:N). Successful exploitation yields remote code execution in the context of the Message Queuing service, with high impact on confidentiality, integrity, and availability. Only Windows systems where the optional MSM feature/role is installed and enabled are exposed; systems without MSMQ are not affected. As of the advisory data, there is no known public proof-of-concept, it is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported (EPSS 1.0%, 60th percentile).

Do: Apply the September 2026 Patch Tuesday security updates from Microsoft to all Windows hosts running Message Queuing, prioritizing any MSMQ servers exposed to untrusted networks or the internet. As an interim mitigation, consider disabling the MSMQ service/feature if it is not required by legacy line-of-business applications, or restrict inbound access to MSMQ ports (e.g., TCP/UDP 1801 and related) at the firewall. Audit your estate to confirm whether MSMQ is installed/enabled (e.g., via Server Manager or Get-WindowsFeature on Windows Server) before patching.

CVE-2026-69590 is a heap-based buffer overflow (CWE-122) in the Windows Routing and Remote Access Service (RRAS) that allows remote code execution, rated 9.8 Critical with a network attack vector requiring no privileges or user interaction. An attacker can trigger the flaw by sending crafted network traffic to a system running the RRAS service, and successful exploitation grants unauthorized access and code execution on the victim machine with high impact to confidentiality, integrity, and availability. Affected systems are Windows machines with the RRAS role/service enabled, typically servers used as VPN endpoints, routers, or NAT gateways; the specific affected Windows version ranges are not specified in the available data. The flaw was addressed in Microsoft's September 2026 Patch Tuesday release (September 8, 2026). There is no known exploitation in the wild, no public proof-of-concept, and it is not in CISA KEV, with EPSS estimating only a 1.0% chance of exploitation within 30 days (60th percentile).

Do: Apply the September 2026 (Sep 8, 2026) Windows security updates on all systems with the Routing and Remote Access Service enabled, prioritizing internet-facing VPN and routing servers. As an interim mitigation, restrict exposure of RRAS-related ports (e.g., TCP 1723 and related VPN traffic) to trusted networks or disable the RRAS role if it is not in use. Inventory systems for the RRAS role before patching, since the service is off by default on most Windows installations.

Microsoft .NET contains a privilege elevation flaw (CWE-73) in which a file name or path processed by the .NET runtime is externally controlled, allowing an unauthorized attacker to elevate privileges over a network. Exploitation requires network access, user interaction, and a high-complexity attack path (CVSS AV:N/AC:H/PR:N/UI:R), meaning the attacker must induce a user into an action that causes .NET to process an attacker-influenced file path, though no privileges are needed. A successful attack carries high impact to confidentiality, integrity, and availability, and the associated CWEs (CWE-200, CWE-522) suggest possible information exposure and insufficiently protected credentials as related effects. Any organization running affected .NET runtimes, SDKs, or .NET Framework installations is potentially exposed; exact version ranges are not specified in the available data, and fixes shipped as part of Microsoft's September 2026 Patch Tuesday (September 8, 2026). There are no known reports of exploitation, no public proof-of-concept, the flaw is absent from CISA's KEV catalog, and EPSS assigns only a 0.5% probability of exploitation within 30 days (42nd percentile).

Do: Inventory all .NET runtimes, SDKs, and .NET Framework installations and apply the .NET updates released in Microsoft's September 2026 Patch Tuesday, checking Microsoft's advisory for the specific affected version ranges since they are not listed in the available data. Prioritize user-facing and developer systems where users may be induced to handle untrusted content, and watch Microsoft's guidance for any published workarounds or version-specific remediation details.

CVE-2026-69806 is an information-exposure flaw in Microsoft .NET (CWE-200, with an associated code-generation issue, CWE-94) that allows an authorized actor to elevate privileges locally. To trigger it, an attacker must already hold a low-privileged foothold on the target system — such as the ability to execute code as a standard local user — and the high-complexity local attack path requires no user interaction. A successful exploit carries high-impact confidentiality, integrity, and availability consequences, effectively yielding elevation of privilege on the affected host. Any organization running the affected .NET components on Windows clients or servers is in scope, and the fix shipped in Microsoft's September 2026 Patch Tuesday (September 8, 2026), part of a record 966-flaw release. There is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known; EPSS assigns a 1.8% probability of exploitation within 30 days (77th percentile).

Do: Apply the .NET updates released with the September 2026 Patch Tuesday set via Windows Update, WSUS, or the Microsoft Update Catalog, verifying both .NET Framework and modern .NET runtimes against Microsoft's advisory for exact affected version ranges. Prioritize multi-user systems where standard users can already run code — RDS/terminal hosts, build and CI servers, and shared workstations — since the attack requires local access. No workaround is described in the available data, so patching is the primary mitigation.

CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.

Do: Immediately deploy the September 2026 Patch Tuesday cumulative updates to every Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2025 host; as a KEV entry under BOD 26-04, prioritize internet-exposed and high-value assets, apply vendor mitigations (or discontinue use) where patching is delayed, and follow CISA's forensics triage requirements if compromise is suspected. Verify deployment via patch telemetry and review which local accounts can trigger update-stack activity on shared or multi-user systems.