September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows
Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.
Microsoft's September 2026 Patch Tuesday includes 964 Microsoft vulnerabilities requiring customer action, a record attributed to AI-assisted bug discovery, plus 174 third-party/open-source and 23 Chromium/Edge CVEs. Two zero-days are exploited in the wild: CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape and privilege escalation, and CVE-2026-81963, a Windows Update Stack escalation to SYSTEM. CVE-2026-69730, an unauthenticated Windows DNS RCE, is not yet exploited but Microsoft expects exploitation, and roughly 20 bugs could be wormable. Separately, SAP issued a critical CVSS 10.0 fix for the EPP component used in S/4HANA and NetWeaver.
- CVE-2026-85880: exploited Windows ALPC heap overflow allows AppContainer sandbox escape and privilege escalation
- CVE-2026-81963: Windows Update Stack link-following flaw yields SYSTEM privileges; exploitation detected
- CVE-2026-69730: unauthenticated Windows DNS RCE not yet exploited but expected; potentially wormable
- SAP EPP vulnerability (CVSS 10.0) affects S/4HANA and NetWeaver; patching urgently required
- Experts urge risk-based prioritization as AI-assisted discovery inflates patch volumes
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-62893 | Pre-auth use-after-free RCE in Microsoft Windows Deployment Services (WDS) | 9.8 | 3% | ||
CVE-2026-69730+1 related CVE | Use-After-Free RCE in Windows DNS Server | 9.8 | 1% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
6 min read at csoonline.com
Possibly wormable bugs and two zero-day holes highlight the almost 1,000 fixes issued today by Microsoft in its September Patch Tuesday release. The 964 vulnerabilities, another record since Microsoft began using AI in the middle of the year to find holes, require customer action.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.