Microsoft September 2026 Patch Tuesday Fixes 973 Vulnerabilities and 2 Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including two zero-days already exploited in the wild.
Microsoft's September 2026 Patch Tuesday addresses 973 vulnerabilities across Windows, Office, and Azure components, including two zero-days already exploited in the wild. CVE-2026-81963, an elevation of privilege flaw in the Windows Update Stack, is flagged as an exploited zero-day. The release includes numerous remote code execution and information disclosure fixes for Microsoft Excel and Word, plus patches for the Windows kernel, ALPC, Print Spooler, ReFS, Entra ID, and Azure CLI.
- 973 vulnerabilities patched, including two zero-days exploited in the wild
- CVE-2026-81963 Windows Update Stack EoP marked as exploited zero-day
- Dozens of Excel and Word RCE and information disclosure fixes
- Patches span Windows kernel, ALPC, Print Spooler, ReFS, Entra ID, Azure CLI
- CVEs
- CVE-2026-85880CVE-2026-85877CVE-2026-85875CVE-2026-85360CVE-2026-84003CVE-2026-84001CVE-2026-84000CVE-2026-83999CVE-2026-83998CVE-2026-83997CVE-2026-83996CVE-2026-83995CVE-2026-83992CVE-2026-83991CVE-2026-83990CVE-2026-83989CVE-2026-83988CVE-2026-83987CVE-2026-83986CVE-2026-83985CVE-2026-83983CVE-2026-83982CVE-2026-83981CVE-2026-83980CVE-2026-83979CVE-2026-83978CVE-2026-83977CVE-2026-83976CVE-2026-83975CVE-2026-83974
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-83992 | Heap-Based Buffer Overflow RCE in Microsoft Windows Imaging Component | 8.8 group max | <1% | ||
| CVE-2026-83990 | Local Privilege Escalation via Stack Overflow in Microsoft Graphics Component | 7.8 | <1% | ||
| CVE-2026-83991 | Missing Authentication in Windows Cloud Files Mini Filter Enables Local Tampering | 5.5 | <1% | PoC | |
| CVE-2026-83997 | Use-After-Free RCE in Windows Message Queuing (MSMQ) | 8.1 | <1% | ||
CVE-2026-85877+1 related CVE | Heap-Based Buffer Overflow RCE in Windows Print Spooler Components (CVE-2026-85877) | 8.8 group max | <1% | ||
| CVE-2026-84003 | Capture-replay authentication bypass in Microsoft MSAL for Node.js | 7.4 | <1% | ||
| CVE-2026-85875 | Out-of-Bounds Read in Microsoft Excel Leads to Local Information Disclosure | 5.5 | <1% | ||
| CVE-2026-85880 | Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
From the original article
9 min read at gbhackers.com
Microsoft’s September 2026 Patch Tuesday security update addresses 973 vulnerabilities across various products, including Windows, Microsoft Office, Azure components, Exchange Server, developer tools, and others. Among these vulnerabilities are two zero-day flaws reported as actively exploited.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.