September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows

Possibly wormable bugs and two zero-day holes highlight the almost 1,000 fixes issued today by Microsoft in its September Patch Tuesday release.

The 964 vulnerabilities, another record since Microsoft began using AI in the middle of the year to find holes, require customer action. Excluded are 174 third-party/open-source CVEs and 23 Chromium/Edge CVEs, as well as nine Microsoft mitigated vulnerabilities in applications like Azure, Entra, and Copilot Studio where no customer action is required.

Separately, developers and SAP admins whose staff use SAP’s ABAP (Advanced Business Application Programming) should take action to close a critical vulnerability, with a CVSS score of 10.0, in the Extended Passport Processing (EPP) component. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application, say researchers at Onapsis. EPP is used in enterprise suites like SAP S/4Hana and NetWeaver to log document creation or trace end-to-end transactions.

Microsoft vulnerabilities

The two zero-days revealed today are:

• CVE-2026-85880, a heap-based buffer overflow in Windows ALPC (Advanced Local Procedure Call), which is already being exploited. ALPC is an internal messaging system in Windows that lets programs talk to each other. An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system. No additional user interaction is required, said Action1. 
  Microsoft said affected products include certain versions of Windows Server 2012, Windows Server 2016, and Windows 10 Desktop.
  Chris Goettl, Ivanti’s vice-president of product management, said this vulnerability “affects the entire Windows fleet.”

• CVE-2026-81963, an escalation of privilege stemming from an improper link resolution before file access (also called link following) in Windows Update Stack. An attacker who successfully exploits this vulnerability could gain System privileges. Affected versions include Windows 11 Desktop and Windows Server 2025, said Microsoft. However researchers at Action1 said specific affected Windows versions cannot be confirmed from the available data.
  There is no workaround other than installing the fix. Exploitation has been detected, Action1 noted, making remediation a high priority even though the severity and CVSS score cannot be confirmed. 
  This is the first zero-day of the seven privilege escalation flaws discovered in Windows Update Stack since 2022, and the first to be exploited, added Satnam Narang, senior staff research engineer at Tenable.

The sheer number of this month’s Microsoft patches stunned some experts. Dustin Childs, head of threat awareness at the Zero Day Initiative, said, in a reference to the film 2001: A Space Odyssey, “looking at nearly 1,000 vulnerabilities in a single month, all I can think is: ‘My God, it’s full of stars.'”

“AI-assisted bug discovery has exploded patch counts into a whole new galaxy,” he said, “and defenders simply have to embrace the suck.”

About 20 of the vulnerabilities could be wormable bugs, he warned. “We haven’t seen a global worm in years, but with a DNS flaw acting as the spiritual successor to SigRed, that reality could change fast.”

That new vulnerability is CVE-2026-69730, a Windows DNS remote code execution hole. As of Tuesday, it hadn’t yet been exploited, Microsoft said, but the company expects it will be. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system, with no authentication or user interaction required.

Asked about vulnerabilities that could be wormed, Jack Bicer, Action1’s director of vulnerability research, drew attention to CVE-2026-62893, a Windows Deployment Services TFTP Server Remote Code Execution issue first patched in August, and CVE-2026-69590, a Windows Routing and Remote Access Service Remote Code Execution. Neither requires authentication or user interaction. Because of this, he said, these types of vulnerability could spread quickly across a network if affected systems are not patched.

Tyler Reguly, Fortra’s associate director of security R&D, pointed out that as long as Microsoft is playing catch-up on patching vulnerabilities, numbers have lost all meaning.

“This is not a Microsoft-specific problem,” he noted. “We see the same issue with Oracle and other large vendors that are being proactive. We need to remember that these large CVE counts are a good thing, as we’re reducing attack surface before attackers get a chance to find and utilize the vulnerabilities. Eventually, all those long-standing, hard to find vulnerabilities will be fixed, and Patch Tuesday will return to its typical cadence. Until that happens, prioritization is key, and gift cards for extra coffee for your admins would likely be appreciated.”

Bicer added that the scale of this month’s Microsoft releases requires security leaders to move beyond CVSS-driven patching and prioritize systems according to exploitability, network exposure, privilege requirements, business criticality, and the consequences of compromise. The most consequential risks, he said, are concentrated in remotely reachable infrastructure, identity and authentication services, database platforms, virtualization environments, and Windows components where successful exploitation could provide code execution or elevated privileges. 

“One of the most important things to recognize across the recent rise in Patch Tuesday releases is that while the number of vulnerabilities being patched is rising, the number of vulnerabilities that can and will affect most organizations remains quite low,” Bicer stressed. “AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles. It’s critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context.”

Patches from other vendors

Researchers at Nightwing also noted that this week Adobe patched an actively exploited zero-day in Adobe Commerce and Magento (CVE-2026-75650, CVSS 10.0), dubbed StyleSmuggler, which drops Linux backdoors and web shells. Adobe said “Urgent Action” is required.

Fortinet confirmed ongoing active exploitation of older two authentication bypass vulnerabilities in FortiOS (CVE-2024-55591 and CVE-2025-24472), allowing unauthenticated remote attackers to seize administrative control of edge firewalls.

Cisco Systems addressed eight serious vulnerabilities across IOS XR systems while warning of active exploitation targeting an unauthenticated denial-of-service flaw in Secure Firewall ASA devices (CVE-2026-20349) first described last month.

 Red Hat fixed a critical privilege escalation vulnerability in Advanced Cluster Management for Kubernetes 2 (CVE-2026-10090, CVSS 9.0, described last month) that enables attackers to breach multi-tenant container boundaries; and Tenable resolved a critical flaw in Sensor Proxy protecting the core pipeline organizations rely on for security auditing (CVE-2026-18667, CVSS 9.6) that had permitted code execution with elevated privileges.

SAP vulnerabilities

Jonathan Stross, Pathlock’s senior product manager for cybersecurity R&I, noted that three of the Security Notes this month reach full compromise territory without a single valid credential. “That is an unusually concentrated cluster of unauthenticated, network-reachable, maximum-impact issues for a single Patch Day,” he said in a commentary.

The critical hole plugged by SAP Security Note #3747649 is a memory corruption vulnerability in the Extended Passport Processing (EPP) component in ABAP-based systems. Researchers at Onapsis Research Labs, who discovered the vulnerability, have dubbed it OVERPASS.

Boundary validation is missing during the deserialization of EPP data, resulting in a memory safety violation when processing externally supplied length fields. This allows an unauthenticated attacker to send crafted network requests containing a malformed EPP header, causing undefined behavior and abnormal program termination. The SAP Security Note provides a patch for ABAP and Java kernels, and for SAP Web Dispatcher, version 9.16. Other Web Dispatcher versions and Web Dispatcher included in SAP S/4HANA Extended Application Services are not affected.

Onapsis urged immediate patching, since the vulnerability exists by default in a wide range of SAP components, is exploitable remotely and without authentication, allows remote attackers to run arbitrary operating system commands on the SAP host with SAP administrative privileges that results in full compromise of the underlying SAP business data and processes, and is reachable through several SAP components and several communication protocols. None of these require credentials, Onapsis pointed out, so no single network control can fully mitigate risk.

Onapsis also drew attention to SAP Security Note #3759472, with a CVSS score of 9.8, in NetWeaver Message Server. This bug is the result of insufficient validation of the authenticity of internal application server components during registration. Consequently, unauthenticated attackers with network access can register unauthorized components and potentially perform unauthorized actions within the application environment.

A successful exploitation could result in a high impact on the confidentiality, integrity, and availability of the affected system, SAP said. The vulnerability, which the Onapsis Research Labs is dubbing S4GET, is present across SAP’s entire modern kernel family (9.16, 9.18, 9.19, 9.20), meaning every S/4HANA 2025 system, and any earlier release already moved to one of those kernels, is affected.