September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th)
Microsoft's September 2026 Patch Tuesday fixes a record 973 vulnerabilities, including 113 critical and two Windows privilege-escalation flaws already exploited in the wild.
Microsoft patched 973 vulnerabilities this month, its largest Patch Tuesday ever and far above the previous record of 664 set in July 2026, with 113 rated critical. Two Important elevation-of-privilege flaws (CVSS 7.8) are confirmed exploited in the wild: CVE-2026-81963 in the Windows Update Stack (improper link resolution, affects Windows 11 and Server 2025) and CVE-2026-85880 in Windows ALPC (heap-based buffer overflow allowing sandbox escape to SYSTEM, affects Windows 10 and Server 2012-2022). Critical unauthenticated RCEs (CVSS 9.8) were also fixed in Skype for Business Server (CVE-2026-66302), Windows Message Queuing (CVE-2026-69579), and Windows RRAS (CVE-2026-69590). SANS urges prioritizing the two exploited EoP fixes, then patching exposed MSMQ, RRAS, and Skype for Business deployments.
- Record 973 vulnerabilities patched, 113 critical; prior record was 664 in July 2026.
- CVE-2026-81963 (Windows Update Stack, CVSS 7.8) exploited; affects Windows 11 and Server 2025.
- CVE-2026-85880 (Windows ALPC, CVSS 7.8) exploited; enables sandbox escape to SYSTEM.
- CVE-2026-66302, CVE-2026-69579, and CVE-2026-69590 are critical 9.8 unauthenticated RCEs in Skype for Business, MSMQ, and RRAS.
- Neither exploited flaw is currently in CISA's KEV catalog.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-66302 | Critical unauthenticated file-path RCE in Microsoft Skype for Business | 9.8 | <1% | ||
CVE-2026-69590+1 related CVE | Unauthenticated RCE in Microsoft Windows Routing and Remote Access Service (RRAS) | 9.8 | <1% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
12 min read at isc.sans.eduThis month, Microsoft released patches for a record-breaking 973 vulnerabilities, including 113 rated critical. It is by far the largest Patch Tuesday to date, well ahead of the previous high of 664 set in July 2026. Two vulnerabilities are listed as exploited in the wild, while none were publicly disclosed before Patch Tuesday.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.