Microsoft Patch Tuesday, September 2026 Security Update Review
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.
- 974 vulnerabilities fixed, including 113 critical; largest Patch Tuesday ever, up from 570 in July
- Two exploited-in-the-wild zero-days: CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (ALPC), both grant SYSTEM
- Updates cover HTTP.sys, Hyper-V, Entra ID, Exchange, Office, DNS, SQL Server, and Copilot products
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-58599 | Heap Buffer Overflow in Microsoft Windows Codecs Library Enables Local Code Execution CVE-2026-58599 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Codecs Library, patched by Microsoft as part of the September 2026 Patch Tuesday. The CVSS vector (AV:L, UI:R, no privileges required) indicates the flaw is triggered locally when the codecs library processes specially crafted content, requiring user interaction such as opening a malicious media or image file. A successful attacker can execute arbitrary code in the context of the local user with no prior privileges, with high impact on confidentiality, integrity, and availability. Any Windows system containing the affected Windows Codecs Library is exposed, though the source data does not enumerate specific Windows versions or builds. Exploitation is currently quiet: there is no public proof-of-concept, no CISA KEV listing, and EPSS estimates only about a 0.3% probability of exploitation within 30 days (25th percentile). Do: Apply Microsoft's September 2026 security updates (Windows cumulative updates) to all supported systems, prioritizing user workstations where untrusted image or media files are routinely opened. Until systems are patched, treat unsolicited image and media files with caution, since exploitation requires user interaction to trigger the overflow. Verify through Windows Update or your patch-management tooling that the September 2026 cumulative update has been installed on each endpoint. | 7.8 | <1% |
| masshundreds of millions of Windows devices (the codecs library ships as a default OS component) | ||
| CVE-2026-62906 | Query Logic Flaw Enables Info Disclosure in Microsoft Discovery Studio CVE-2026-62906 is an improper neutralization of special elements in data query logic (CWE-943, an SQL-injection-style flaw) in Microsoft Discovery Studio that allows an unauthorized attacker to disclose information over a network. It is remotely exploitable without authentication (AV:N/PR:N) but requires user interaction (UI:R), meaning a user must perform some action, such as clicking a crafted link or submitting crafted input, for the attack to succeed. Successful exploitation has a high impact on confidentiality, potentially exposing sensitive data, while integrity and availability are unaffected. Any organization running Microsoft Discovery Studio is potentially affected, and Microsoft addressed the issue as part of the September 2026 Patch Tuesday security updates. There is currently no known public proof-of-concept, no inclusion in CISA's Known Exploited Vulnerabilities catalog, and EPSS estimates only a 0.7% probability of exploitation in the next 30 days, so no active exploitation is known at this time. Do: Apply the Microsoft September 2026 Patch Tuesday security updates for Discovery Studio as soon as possible and verify your inventory for deployments of the product, including which users have access. Because exploitation requires user interaction, advise users to avoid clicking unexpected links or submitting unsolicited input while patching is in progress, and monitor Microsoft's advisory for any expanded guidance. | 7.4 | <1% |
| — | ||
| CVE-2026-62916 | Authentication Bypass in Microsoft Entra ID Enables Privilege Elevation CVE-2026-62916 is an authentication bypass (CWE-288) in Microsoft Entra ID, Microsoft's cloud identity and access management service, in which an alternate path or channel allows authentication checks to be circumvented. Per the CVSS vector, it is exploitable remotely over a network with no privileges and no user interaction required, by authenticating via an alternate path instead of the standard sign-in flow. A successful unauthenticated attacker gains the ability to elevate privileges, with high impact on confidentiality, integrity, and availability reflected in the 9.8 critical score. The affected population includes organizations relying on Entra ID, which is the default identity platform for Microsoft 365, Azure, and hybrid deployments; the available data does not specify affected versions or the specific sub-component involved. There is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not in CISA's KEV; EPSS assigns a 0.6% probability of exploitation within 30 days. Do: Since Entra ID is a cloud service patched centrally by Microsoft, verify that the September 2026 security updates have been applied to your tenant and follow the Microsoft advisory for any tenant-side configuration or conditional access actions; no workarounds are documented in the available data. Review Entra ID sign-in and audit logs for unexpected privileged authentication activity, and re-check exposure after any additional Microsoft guidance on affected flows. | 9.8 | <1% |
| masshundreds of millions of user identities across millions of Microsoft 365/Azure tenant organizations | ||
| CVE-2026-65669 | Injection Flaw in Microsoft SQL Server Enables Network Privilege Escalation Microsoft SQL Server contains an injection vulnerability (CWE-74) in which special elements in output used by a downstream component are not properly neutralized. An unauthorized attacker can trigger the flaw remotely over a network, though the CVSS vector indicates that some form of user interaction is required in the attack path. Successful exploitation allows elevation of privileges with high impact on confidentiality, integrity, and availability, and the changed-scope metric suggests the attack crosses a security boundary into another component. Any organization running affected Microsoft SQL Server versions is potentially exposed, although the data provided does not specify exact affected version ranges. No public proof of concept, CISA KEV listing, or known exploitation exists; EPSS estimates only a 0.7% probability of exploitation in the next 30 days, and the fix shipped with Microsoft's record-setting September 2026 Patch Tuesday release (974 flaws patched). Do: Apply the SQL Server security updates from Microsoft's September 2026 Patch Tuesday as soon as practical, prioritizing internet-exposed instances and servers that accept untrusted input whose output feeds downstream components. With no public PoC or KEV listing, near-term risk appears low, but re-prioritize if technical details or exploit code emerge. Verify deployed SQL Server builds against Microsoft's advisory for CVE-2026-65669 to confirm remediation. | 9.6 | <1% |
| mass≥1M deployments (SQL Server's global installed base; affected version subset unspecified) | ||
| CVE-2026-65772 | Deserialization RCE in Microsoft Dynamics 365 CVE-2026-65772 is a deserialization of untrusted data flaw (CWE-502) in Microsoft Dynamics 365 that allows an authorized (authenticated, low-privilege) attacker to execute code over the network. It is triggered when the application processes attacker-controlled serialized data, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network exploitation with low attack complexity, low required privileges, and no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability, effectively amounting to remote code execution within the affected Dynamics 365 environment. Any organization running the affected Microsoft Dynamics 365 deployments is in scope, with authenticated users or compromised low-privileged accounts able to trigger the flaw; the available data does not specify which Dynamics 365 editions or version ranges are affected. As of the September 2026 Patch Tuesday coverage, there is no evidence of in-the-wild exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns roughly a 0.9% probability of exploitation within 30 days (58th percentile). Do: Apply the Microsoft security update for CVE-2026-65772 released in the September 2026 Patch Tuesday cycle, prioritizing internet-facing, multi-user, or production Dynamics 365 environments where low-privileged users can reach the vulnerable endpoint. Because the affected version range is not specified here, verify applicability against Microsoft's advisory and confirm your deployed editions/versions before and after patching. Until patched, restrict and monitor authenticated access to Dynamics 365, and watch for changes in EPSS, KEV, or public proof-of-concept status. | 8.8 | <1% |
| masson the order of millions of users across hundreds of thousands of customer organizations (estimate; the subset running vulnerable versions is unknown) | ||
| CVE-2026-69530 | Use-After-Free RCE in Microsoft Windows Reliable Multicast Transport (RMCAST) Driver CVE-2026-69530 is a use-after-free memory-corruption flaw (CWE-416) in Microsoft's Reliable Multicast Transport Driver (RMCAST), the Windows networking component associated with the optional Message Queuing (MSMQ) feature. An unauthenticated attacker can reach the flaw over the network by sending traffic that leads the driver to use memory after it has been freed, though the High attack-complexity rating indicates exploitation depends on favorable runtime conditions rather than a simple request. A successful attack yields remote code execution on the affected host, with CVSS rating the impact high across confidentiality, integrity, and availability. Only systems where the RMCAST/MSMQ capability is installed and enabled are exposed, and the flaw was addressed in Microsoft's September 2026 Patch Tuesday release. There is currently no known exploitation, no public proof-of-concept, and no CISA KEV listing, with EPSS estimating roughly a 0.6% chance of exploitation in the next 30 days. Do: Apply Microsoft's September 2026 security updates as soon as practical. Inventory Windows hosts — especially servers reachable from untrusted networks — for the Message Queuing (MSMQ)/Reliable Multicast Transport feature and disable it where it is not required, since exposure requires the component to be installed and enabled. Given the High attack complexity, the absence of a public PoC, and no known exploitation, there is no indication of urgent in-the-wild risk, but patching should not be deferred. | 8.1 | <1% |
| largeon the order of 100,000–1,000,000 Windows hosts with MSMQ/RMCAST installed (rough estimate; no public install-base counts provided) | ||
| CVE-2026-69590 | Unauthenticated RCE in Microsoft Windows Routing and Remote Access Service (RRAS) CVE-2026-69590 is a heap-based buffer overflow (CWE-122) in the Windows Routing and Remote Access Service (RRAS) that allows remote code execution, rated 9.8 Critical with a network attack vector requiring no privileges or user interaction. An attacker can trigger the flaw by sending crafted network traffic to a system running the RRAS service, and successful exploitation grants unauthorized access and code execution on the victim machine with high impact to confidentiality, integrity, and availability. Affected systems are Windows machines with the RRAS role/service enabled, typically servers used as VPN endpoints, routers, or NAT gateways; the specific affected Windows version ranges are not specified in the available data. The flaw was addressed in Microsoft's September 2026 Patch Tuesday release (September 8, 2026). There is no known exploitation in the wild, no public proof-of-concept, and it is not in CISA KEV, with EPSS estimating only a 1.0% chance of exploitation within 30 days (60th percentile). Do: Apply the September 2026 (Sep 8, 2026) Windows security updates on all systems with the Routing and Remote Access Service enabled, prioritizing internet-facing VPN and routing servers. As an interim mitigation, restrict exposure of RRAS-related ports (e.g., TCP 1723 and related VPN traffic) to trusted networks or disable the RRAS role if it is not in use. Inventory systems for the RRAS role before patching, since the service is off by default on most Windows installations. | 9.8 group max | <1% |
| largeorder of 10^5 internet-exposed Windows RRAS/PPTP endpoints (a subset of the several hundred thousand hosts seen in public scans of TCP 1723), plus an unknown… | ||
| CVE-2026-69632 | Use-After-Free Remote Code Execution in Microsoft Office CVE-2026-69632 is a use-after-free memory corruption flaw (CWE-416) in Microsoft Office that an unauthorized attacker can trigger over a network to execute arbitrary code. The network attack vector requires user interaction (the CVSS vector includes UI:R), meaning a victim typically must open a malicious Office document or click a crafted link for the bug to be reached, and no privileges are required. Successful exploitation yields code execution in the context of the Office user, with high impact on the confidentiality, integrity, and availability of the endpoint. Any organization or individual running affected Microsoft Office builds is potentially affected, though current exploitation risk is low: there is no known in-the-wild exploitation, no public proof-of-concept, no CISA KEV listing, and EPSS assigns only a 0.8% probability of exploitation within 30 days. Microsoft addressed the issue in its September 2026 Patch Tuesday security updates. Do: Apply Microsoft's September 2026 Patch Tuesday security updates for Office as soon as feasible and verify installed Office build numbers against Microsoft's advisory, since the affected version list is not enumerated in this data. As interim mitigation, discourage opening unsolicited Office documents and links, and apply attack-surface-reduction controls (e.g., blocking macros/files from untrusted sources). Monitor for KEV addition, public PoC emergence, or EPSS movement to reprioritize this fix within your Patch Tuesday backlog. | 8.8 group max | <1% |
| masshundreds of millions of users (Office runs on an estimated ~1 billion Windows/enterprise devices worldwide) | ||
| CVE-2026-69730 | Use-After-Free RCE in Windows DNS Server CVE-2026-69730 is a use-after-free memory corruption flaw (CWE-416) in the Windows DNS service that allows an unauthenticated, remote attacker to execute arbitrary code by sending crafted network traffic to the affected system. Because the flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1 9.8), any system running the vulnerable DNS service is a direct target. Successful exploitation would give the attacker code execution in the context of the DNS service, which on Windows Server typically runs with high privileges such as SYSTEM, and could enable wormable spread between vulnerable hosts. Affected organizations are those running the Windows DNS Server role — a component deployed on virtually all Windows Server domain controllers and on dedicated Windows DNS servers, especially those exposed to untrusted networks. As of the September 2026 Patch Tuesday release, there is no known public proof-of-concept, the flaw is not listed in CISA's KEV, and it has not been confirmed exploited in the wild, though it was flagged among roughly 20 'wormable' bugs and described in press coverage as a successor to the 2020 SigRed Windows DNS RCE. Do: Apply Microsoft's September 2026 Patch Tuesday security updates to every Windows Server running the DNS Server role as soon as possible, prioritizing internet-facing DNS servers and domain controllers. Until patched, limit exposure of TCP/UDP port 53 from untrusted networks and restrict remote management surfaces. Because the bug is rated wormable and shares characteristics with the 2020 SigRed DNS RCE, treat unpatched domain controllers as high priority and check DNS service event logs for unexpected restarts or anomalous query handling. | 9.8 group max | 1% |
| massplausibly millions of Windows Server deployments running the DNS Server role (ubiquitous on Active Directory domain controllers), with tens of thousands of… | ||
| CVE-2026-69740 +1 in the same advisory: …69784 | Use-After-Free Local Privilege Escalation in Windows Hello CVE-2026-69740 is a use-after-free memory-corruption flaw (CWE-416) in Windows Hello, Microsoft's biometric and PIN sign-in component of Windows. Per the CVSS vector, an attacker who already holds low-privileged authorized access on a machine can trigger the bug locally without any user interaction. Successful exploitation crosses the security scope, allowing the attacker to elevate privileges with high impact on confidentiality, integrity, and availability. The disclosure data does not specify exact affected Windows builds; the flaw was addressed as part of Microsoft's September 2026 Patch Tuesday release. There is no known exploitation in the wild, no public proof of concept, the flaw is not in CISA KEV, and EPSS puts the 30-day exploitation probability at just 0.3% (24th percentile). Do: Deploy the Windows security updates released in Microsoft's September 2026 Patch Tuesday across all Windows 10/11 endpoints, prioritizing shared workstations, kiosks, and systems where untrusted users hold local accounts. Verify via your patch-management or vulnerability-scanning tooling that the applicable OS update containing this Windows Hello fix is installed. No interim mitigation or public PoC is documented, so prompt patching is the primary action. | 8.8 | <1% |
| masshundreds of millions of Windows endpoints (Windows Hello ships with Windows 10/11 on a >1-billion-device installed base) | ||
| CVE-2026-69860 | Heap-Based Buffer Overflow in Windows Imaging Component Allows Network RCE CVE-2026-69860 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component, the built-in Windows subsystem responsible for decoding image formats. An unauthenticated remote attacker can trigger the flaw by getting a user to open or preview a specially crafted image file (the CVSS vector is network-based but requires user interaction). Successful exploitation allows arbitrary code execution in the context of the affected user, with high impact on confidentiality, integrity, and availability. Any Windows installation carrying the affected Imaging Component is exposed, and the fix is distributed through Microsoft's September 2026 security updates. There is currently no known in-the-wild exploitation, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.8%. Do: Deploy Microsoft's September 2026 security updates on all Windows clients and servers as part of this month's Patch Tuesday cycle, prioritizing end-user workstations where users routinely open images from email, the web, or file shares. Until patching is complete, exercise caution with untrusted image files and attachments. Verify that the WIC-related update for CVE-2026-69860 is included in your organization's September 2026 patch compliance reporting. | 8.8 | <1% |
| mass≈1 billion+ Windows devices (WIC is a default component of the Windows operating system) | ||
| CVE-2026-81963 +1 in the same advisory: …85880 | Local Privilege Escalation via Link Following in Windows Update Stack CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use. Do: Immediately deploy the September 2026 Patch Tuesday cumulative updates to every Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2025 host; as a KEV entry under BOD 26-04, prioritize internet-exposed and high-value assets, apply vendor mitigations (or discontinue use) where patching is delayed, and follow CISA's forensics triage requirements if compromise is suspected. Verify deployment via patch telemetry and review which local accounts can trigger update-stack activity on shared or multi-user systems. | 7.8 | <1% | KEV |
| masswell over 1,000,000 |
Full article2,680 words · extracted from threatprotect.qualys.com · click to collapse
Microsoft kicks off September with its monthly Patch Tuesday release, delivering fixes for security vulnerabilities affecting products. The security updates are packed with security fixes, providing organizations with important updates to help protect their environments from emerging threats.
This Patch Tuesday is Microsoft’s largest security update ever, marking a significant increase over other recent massive releases, including the 570 security flaws fixed in July and 400 fixed inAugust.
This month’s release addresses 974 vulnerabilities, including 113 critical and 860 important-severityvulnerabilities.
In this month’s updates, Microsoft has addressed two vulnerabilities known to be exploited in the wild.
Microsoft has not addressed any vulnerabilities in Microsoft Edge (Chromium-based) in this month’s update.
Microsoft Patch Tuesday, September edition, includes updates for vulnerabilities in Windows HTTP.sys, Windows Hyper-V, GitHub Copilot and Visual Studio Code, Copilot Studio, Data Sharing Service Client, Entra ID, Microsoft Exchange Server, and more.
This month’s release includes fixes for several high-severity issues that could potentially enable remote code execution, privilege escalation, or denial-of-service attacks. As always, timely patch deployment is crucial to reduce exposure and ensure systems remain resilient against exploitation attempts.
The September 2026 Microsoft vulnerabilities are classified as follows:
| Vulnerability Category | Quantity | Severities |
|---|---|---|
| Spoofing Vulnerability | 16 | Critical: 1 Important: 15 |
| Denial of Service Vulnerability | 56 | Important: 56 |
| Elevation of Privilege Vulnerability | 438 | Critical: 27 Important: 411 |
| Information Disclosure Vulnerability | 173 | Critical: 2 Important: 171 |
| Remote Code Execution Vulnerability | 253 | Critical: 82 Important: 171 |
| Security Feature Bypass Vulnerability | 19 | Critical: 1 Important: 18 |
Zero-day Vulnerabilities Patched in September Patch Tuesday Edition
CVE-2026-81963: Windows Update Stack Elevation of Privilege Vulnerability
A link following flaw in the Windows Update Stack may allow an authenticated attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
CVE-2026-85880: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
The heap-based buffer overflow flaw in Windows ALPC may allow an authenticated attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Critical Severity Vulnerabilities Patched in September Patch Tuesday Edition
CVE-2026-58599: HEVC Video Extensions Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Microsoft Windows Codecs Library may allow an unauthenticated attacker to execute code locally.
CVE-2026-62906: Microsoft Discovery Studio Information Disclosure Vulnerability
The improper neutralization of special elements in data query logic in Microsoft Discovery Studio may allow an unauthenticated attacker to disclose information over a network.
CVE-2026-62916: Microsoft Entra ID Elevation of Privilege Vulnerability
An authentication bypass using an alternate path or channel in Microsoft Entra ID may allow an unauthenticated attacker to elevate privileges over a network.
CVE-2026-65669: Microsoft SQL Server Elevation of Privilege Vulnerability
The code injection flaw in SQL Server may allow an unauthenticated attacker to elevate privileges over a network.
CVE-2026-65772: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
The deserialization of untrusted data in Microsoft Dynamics 365 may allow an authenticated attacker to execute code over a network.
CVE-2026-69632, CVE-2026-69678, CVE-2026-69767, & CVE-2026-69797: Microsoft Office PowerPoint Remote Code Execution Vulnerability
The use after free flaw in Microsoft Office PowerPoint may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69730, CVE-2026-69858, & CVE-2026-72987: Windows DNS Server Remote Code Execution Vulnerability
The use after free flaw in Windows DNS may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69860, CVE-2026-73013, CVE-2026-73023, & CVE-2026-77495: Windows Imaging Component Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Windows Imaging Component may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69590, CVE-2026-69852, CVE-2026-72950, & CVE-2026-72959: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Successful exploitation of the vulnerability may allow attacker to gain an unauthenticated access to victim’s machine.
CVE-2026-81948, CVE-2026-81951, & CVE-2026-81959: Microsoft Excel Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Microsoft Office Excel may allow an unauthenticated attacker to execute code locally.
CVE-2026-69530, CVE-2026-78449, & CVE-2026-78450: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
The use after free flaw in Reliable Multicast Transport Driver (RMCAST) may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69740, CVE-2026-69784, & CVE-2026-69864: Windows Hello Elevation of Privilege Vulnerability
The use after free in Windows Hello may allow an authenticated attacker to elevate privileges locally.
CVE-2026-72986 & CVE-2026-73018: Graphic Fonts Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Graphic Fonts may allow an unauthenticated attacker to execute code over a network.
CVE-2026-73006 & CVE-2026-78439: Microsoft Office Graphics Component Remote Code Execution Vulnerability
The stack-based buffer overflow flaw in Microsoft Graphics Component may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69285 & CVE-2026-78505: Microsoft Office Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Microsoft Office may allow an unauthenticated attacker to execute code over a network.
CVE-2026-78509 & CVE-2026-78510: Microsoft Office Outlook Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Microsoft Office Outlook may allow an unauthenticated attacker to execute code over a network.
CVE-2026-67631 & CVE-2026-67643: Microsoft SQL Server Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in SQL Server may allow an authenticated attacker to execute code over a network.
CVE-2026-69710 & CVE-2026-69799: Windows Hello Elevation of Privilege Vulnerability
A race condition in Windows Hello may allow an authenticated attacker to elevate privileges locally.
CVE-2026-69820 & CVE-2026-81354: Windows Hello Elevation of Privilege Vulnerability
The heap-based buffer overflow flaw in Windows Hello may allow an authenticated attacker to elevate privileges locally.
CVE-2026-70203 & CVE-2026-72960: Windows Media Player Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Windows Media Player may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69501 & CVE-2026-83939: Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Secure Kernel Mode may allow an authenticated attacker to elevate privileges locally.
CVE-2026-69595 & CVE-2026-78445: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
The use after free flaw in Windows Services for NFS ONCRPC XDR Driver may allow an unauthenticated attacker to execute code over a network.
CVE-2026-65818: Power Automate Elevation of Privilege Vulnerability
The server-side request forgery (SSRF) flaw in Power Automate may allow an authenticated attacker to elevate privileges over a network.
CVE-2026-66302: Skype for Business Remote Code Execution Vulnerability
Successful exploitation of the vulnerability may allow an unauthenticated attacker to execute code over a network.
CVE-2026-67378: Microsoft SQL Server Remote Code Execution Vulnerability
Successful exploitation of the vulnerability may allow an authenticated attacker to execute code over a network.
CVE-2026-67636: Microsoft SQL Server Remote Code Execution Vulnerability
An out-of-bounds read flaw in SQL Server may allow an authenticated attacker to execute code over a network.
CVE-2026-69499: Windows Imaging Component Remote Code Execution Vulnerability
An integer overflow flaw in Windows Imaging Component may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69518: Windows Remote Desktop Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Windows Remote Desktop may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69579: Windows Message Queuing Remote Code Execution Vulnerability
The use-after-free flaw in Windows Message Queuing may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69601: Microsoft Windows Media Foundation Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Microsoft Windows Media Foundation may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69603: Windows Hyper-V Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Windows Hyper-V may allow an authenticated attacker to execute code locally.
CVE-2026-69676: Windows Kerberos Remote Code Execution Vulnerability
An authentication bypass flaw by capture-replay in Windows Kerberos may allow an authenticated attacker to execute code over a network.
CVE-2026-69712: Windows Key Distribution Center Remote Code Execution Vulnerability
The use after free flaw in Windows Key Distribution Center may allow an authenticated attacker to execute code over a network.
CVE-2026-69725: Windows Hello Elevation of Privilege Vulnerability
A double free flaw in Windows Hello may allow an authenticated attacker to elevate privileges locally.
CVE-2026-69769: Windows HTTP Print Provider Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Windows HTTP Print Provider may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69829: Windows Shell Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Windows Shell may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69845: Windows DHCP Server Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Windows DHCP Server may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69846: Windows Secure Kernel Mode Elevation of Privilege Vulnerability
An integer overflow flaw in Windows Secure Kernel Mode may allow an authenticated attacker to elevate privileges locally.
CVE-2026-69854: Spring Cloud Azure Elevation of Privilege Vulnerability
An improper authentication flaw in Spring Cloud Azure may allow an unauthenticated attacker to elevate privileges over a network.
CVE-2026-69857: Azure Cosmos DB Spoofing Vulnerability
An authorization bypass through user-controlled key in Azure Cosmos DB may allow an authenticated attacker to perform spoofing over a network.
CVE-2026-69874: Windows ALPC Elevation of Privilege Vulnerability
Successful exploitation of the vulnerability may allow an authenticated attacker to elevate privileges locally.
CVE-2026-69890: Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
The use after free flaw in Windows Virtual Trusted Platform Module may allow an authenticated attacker to elevate privileges locally.
CVE-2026-69906: Windows Secure Kernel Mode Elevation of Privilege Vulnerability
The heap-based buffer overflow flaw in Windows Secure Kernel Mode may allow an authenticated attacker to elevate privileges locally.
CVE-2026-70178: Microsoft Fabric Elevation of Privilege Vulnerability
A missing authorization flaw in Microsoft Fabric may allow an authenticated attacker to elevate privileges over a network.
CVE-2026-70296: Windows Imaging Component Remote Code Execution Vulnerability
An out-of-bounds write flaw in Windows Imaging Component may allow an unauthenticated attacker to execute code over a network.
CVE-2026-70351: Microsoft WebP Image Extension Remote Code Execution Vulnerability
An integer overflow flaw in Microsoft WebP Image Extension may allow an unauthenticated attacker to execute code over a network.
CVE-2026-70352: Azure AI Language Elevation of Privilege Vulnerability
A missing authentication for critical function in Azure AI Language may allow an unauthenticated attacker to elevate privileges over a network.
CVE-2026-70585: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
The use after free flaw in Windows Services for NFS ONCRPC XDR Driver may allow an authenticated attacker to execute code locally.
CVE-2026-70586: Windows Paint Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Windows Paint may allow an unauthenticated attacker to execute code over a network.
CVE-2026-72954: Windows Deployment Services Remote Code Execution Vulnerability
The use after free flaw in Windows Deployment Services may allow an authenticated attacker to execute code over a network.
CVE-2026-72957: Windows Deployment Services Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Windows Deployment Services may allow an authenticated attacker to execute code locally.
CVE-2026-72958: Windows Credential Guard Elevation of Privilege Vulnerability
A double free flaw in Windows Credential Guard may allow an authenticated attacker to elevate privileges locally.
CVE-2026-72961: Windows Hyper-V Elevation of Privilege Vulnerability
An out-of-bounds read flaw in Windows Hyper-V may allow an authenticated attacker to elevate privileges locally.
CVE-2026-72962: Windows USB Video Driver Elevation of Privilege Vulnerability
The heap-based buffer overflow flaw in Windows USB Video Driver may allow an authenticated attacker to elevate privileges locally.
CVE-2026-72979: Windows DHCP Server Remote Code Execution Vulnerability
The use after free flaw in Windows DHCP Server may allow an unauthenticated attacker to execute code over a network.
CVE-2026-72980: Windows Hello Security Feature Bypass Vulnerability
An uncontrolled search path element in Windows Hello may allow an authenticated attacker to bypass a security feature locally.
CVE-2026-72981: IP Helper Remote Code Execution Vulnerability
The use after free flaw in IP Helper may allow an unauthenticated attacker to execute code over a network.
CVE-2026-72982: Windows Netlogon Remote Code Execution Vulnerability
The stack-based buffer overflow flaw in Windows Netlogon may allow an unauthenticated attacker to execute code over a network.
CVE-2026-72983: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
The use after free flaw in Windows Internet Connection Sharing (ICS) may allow an unauthenticated attacker to execute code over a network.
CVE-2026-73009: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
The use after free flaw in Windows Secure Socket Tunneling Protocol (SSTP) may allow an unauthenticated attacker to execute code over a network.
CVE-2026-73010: Microsoft Failover Cluster Remote Code Execution Vulnerability
The use after free flaw in Windows Failover Cluster may allow an unauthenticated attacker to execute code over a network.
CVE-2026-73017: Graphics Kernel Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Windows Graphics Kernel may allow an authenticated attacker to execute code locally.
CVE-2026-77493: Microsoft Office Outlook Remote Code Execution Vulnerability
A double free flaw in Microsoft Office Outlook may allow an unauthenticated attacker to execute code over a network.
CVE-2026-77504: Microsoft Office Word Remote Code Execution Vulnerability
A double free flaw in Microsoft Office Word may allow an unauthenticated attacker to execute code over a network.
CVE-2026-77505: Windows DNS Server Remote Code Execution Vulnerability
The use after free flaw in DNS Server may allow an unauthenticated attacker to execute code over a network.
CVE-2026-77898: Microsoft Office PowerPoint Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Microsoft Office PowerPoint may allow an unauthenticated attacker to execute code over a network.
CVE-2026-78444: Microsoft Failover Cluster Remote Code Execution Vulnerability
An untrusted pointer dereference flaw in Windows Failover Cluster may allow an unauthenticated attacker to execute code over a network.
CVE-2026-78519: Microsoft Office Outlook Remote Code Execution Vulnerability
Use of uninitialized resource in Microsoft Office Outlook may allow an unauthenticated attacker to execute code over a network.
CVE-2026-78520: Microsoft Office Outlook Information Disclosure Vulnerability
An out-of-bounds read flaw in Microsoft Office Outlook may allow an unauthenticated attacker to execute code over a network.
CVE-2026-78525: Microsoft Office Outlook Remote Code Execution Vulnerability
An use after free flaw in Microsoft Office Outlook may allow an unauthenticated attacker to execute code over a network.
CVE-2026-80083: Windows Hyper-V Remote Code Execution Vulnerability
An untrusted pointer dereference flaw in Windows Hyper-V may allow an authenticated attacker to execute code locally.
CVE-2026-80098: Copilot Studio Elevation of Privilege Vulnerability
An improper verification of cryptographic signature in Copilot Studio may allow an unauthenticated attacker to elevate privileges over a network.
CVE-2026-81352: Web Media Extensions Remote Code Execution Vulnerability
The heap-based buffer overflow in Microsoft Windows Codecs Library may allow an unauthenticated attacker to execute code over a network.
CVE-2026-81355: Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
The heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver may allow an authenticated attacker to execute code locally.
CVE-2026-81949: Microsoft Excel Remote Code Execution Vulnerability
An integer overflow flaw in Microsoft Office Excel may allow an unauthenticated attacker to execute code locally.
CVE-2026-81950: Microsoft Excel Remote Code Execution Vulnerability
A double free flaw in Microsoft Office Excel may allow an unauthenticated attacker to execute code locally.
CVE-2026-81952: Microsoft Word Remote Code Execution Vulnerability
The heap-based buffer overflow in Microsoft Office Word may allow an unauthenticated attacker to execute code over a network.
CVE-2026-81953: Microsoft Excel Remote Code Execution Vulnerability
The stack-based buffer overflow flaw in Microsoft Office Excel may allow an unauthenticated attacker to execute code locally.
CVE-2026-81955: Windows Graphics Component Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Microsoft Graphics Component may allow an unauthenticated attacker to execute code over a network.
CVE-2026-83711: Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
An authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C may allow an unauthenticated attacker to elevate privileges over a network.
CVE-2026-83941: Entra ID Elevation of Privilege Vulnerability
A missing authorization flaw in Entra ID may allow an authenticated attacker to elevate privileges over a network.
CVE-2026-83498: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
An untrusted pointer dereference flaw in Windows Virtualization-Based Security (VBS) Enclave may allow an authenticated attacker to elevate privileges locally.
CVE-2026-83501: Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability
An out-of-bounds read flaw in Windows Virtualization-Based Security (VBS) Enclave may allow an authenticated attacker to disclose information locally.
CVE-2026-69649: Raw Image Extension Remote Code Execution Vulnerability
The heap-based buffer overflow flaw in Windows Raw Image Extension may allow an unauthenticated attacker to execute code over a network.
CVE-2026-69827: Windows DNS Server Remote Code Execution Vulnerability
A race condition flaw in DNS Server may allow an unauthenticated attacker to execute code over a network.
Other Microsoft Vulnerability Highlights
- CVE-2026-69467 is an elevation of privilege vulnerability in Microsoft Graphics Component. Stack-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-68846 is an elevation of privilege vulnerability in the Windows Kernel. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-68876 is an elevation of privilege vulnerability in the Windows Program Compatibility Assistant Service. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-68880 is an elevation of privilege vulnerability in the Windows Win32k. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-68884 is an elevation of privilege vulnerability in the Windows Kernel. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69274 is an elevation of privilege vulnerability in the Windows Win32k. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69277 is an elevation of privilege vulnerability in the Microsoft Local Security Authority (LSA) Server. A stack-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69301 is an elevation of privilege vulnerability in the Windows Win32k. A stack-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69305 is an elevation of privilege vulnerability in the Microsoft Windows Search Component. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69310 is an elevation of privilege vulnerability in Windows DNS. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69337 is an elevation of privilege vulnerability in the Windows Registry. A double-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69364 is an elevation of privilege vulnerability in the Windows Print Spooler Components. A race condition flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69366 is an elevation of privilege vulnerability in the Windows Kernel. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69385 is an elevation of privilege vulnerability in the Windows TCP/IP. A race condition flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69391 is an elevation of privilege vulnerability in the Windows Broker Infrastructure Service. A stack-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69406 is an elevation of privilege vulnerability in the Windows Kernel. A type confusion vulnerability may allow an attacker to gain privileges.
- CVE-2026-69436 is an elevation of privilege vulnerability in the Windows Error Reporting. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69450 is an elevation of privilege vulnerability in the Windows Error Reporting. An out-of-bounds read flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69451 is an elevation of privilege vulnerability in the Windows Management Instrumentation. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69459 is an elevation of privilege vulnerability in the Windows Power Dependency Coordinator. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69460 is an elevation of privilege vulnerability in the Windows Modern Device Management (MDM). Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69466 is an elevation of privilege vulnerability in the Windows Kernel. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
- CVE-2026-69473 is an elevation of privilege vulnerability in the Windows Kernel. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69478 is an elevation of privilege vulnerability in the Windows Device Association Service. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69498 is an elevation of privilege vulnerability in the Windows Win32k. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69525 is a remote code execution vulnerability in Remote Desktop Services. Use-after-free flaw may allow an attacker to achieve remote code execution.
- CVE-2026-69541 is an elevation of privilege vulnerability in the Virtual Hard Disk (VHD) Miniport Driver. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69585 is an elevation of privilege vulnerability in the Microsoft Windows Search Component. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
- CVE-2026-69600 is an elevation of privilege vulnerability in the Microsoft Windows Search Component. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69605 is an elevation of privilege vulnerability in the Microsoft Install Service. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69623 is remote code execution vulnerability in Windows HTTP Print Provider. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69714 is an elevation of privilege vulnerability in the Windows Device Association Service. A stack-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69723 is an information disclosure vulnerability in the Windows Kernel. An attacker who successfully exploited this vulnerability could elevate privileges.
- CVE-2026-69757 is an elevation of privilege vulnerability in the Windows TCP/IP. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69777 is an elevation of privilege vulnerability in the Windows DHCP Client. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69779 is an elevation of privilege vulnerability in the Windows Win32k. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
- CVE-2026-69832 is an information disclosure vulnerability in win32k. Successful exploitation of the vulnerability may allow an authenticated attacker to disclose information locally.
- CVE-2026-69911 is an elevation of privilege vulnerability in Microsoft Windows Search Component. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-69921 is an elevation of privilege vulnerability in Windows Print Spooler Components. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-70289 is an elevation of privilege vulnerability in the Windows Win32k. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-70342 is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-70562 is an elevation of privilege vulnerability in the Windows Audio Service. A double-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-70583 is an elevation of privilege vulnerability in the Windows Core Messaging. A heap-based buffer overflow flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-71340 is an elevation of privilege vulnerability in the Windows File History Service. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
- CVE-2026-71343 is a remote code execution vulnerability in the Windows Remote Access Connection Manager. A heap-based buffer overflow flaw may allow an attacker to execute code.
- CVE-2026-72936 is a remote code execution vulnerability in the Windows SMB Client. Use-after-free flaw may allow an attacker to execute code.
- CVE-2026-72940 is a remote code execution vulnerability in the Windows Schannel. A heap-based buffer overflow flaw may allow an attacker to execute code.
- CVE-2026-77500 is an elevation of privilege vulnerability in the Windows Device Association Service. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
- CVE-2026-78454 is an information disclosure vulnerability in the Windows CD-ROM Driver. An out-of-bounds read flaw may allow an attacker to disclose information locally.
- CVE-2026-80093 is an elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver. Use-after-free flaw may allow an attacker to gain SYSTEM privileges.
Microsoft Release Summary
This month’s release notes cover multiple Microsoft product families affected, including, but not limited to, .NET, .NET and Visual Studio, ASP.NET Core, Active Directory Certificate Services (AD CS), Active Directory Domain Services, Active Directory Federation Services (AD FS), Audio Video Control Transport Protocol, Azure AI Language, Azure Arc, Azure Cosmos DB, Azure CycleCloud, Azure HDInsights, BranchCache, Connected Devices Platform Service (Cdpsvc), Graphic Fonts, HID class driver, IP Helper, Internet Storage Name Service, Kernel Streaming WOW Thunk Service Driver, Microsoft Account, Microsoft Authentication Library for JavaScript, Microsoft Authenticator, Microsoft Azure Active Directory B2C, Microsoft Azure CLI, Microsoft COM for Windows, Microsoft Discovery Studio, Microsoft Dynamics 365, Microsoft Edge (Chromium-based), Microsoft Entra ID, Microsoft Fabric, Microsoft Graphics Component, Microsoft Install Service, Microsoft JScript, Microsoft Local Security Authority Server (lsasrv), Microsoft Office, Microsoft Office Access, Microsoft Office Excel, Microsoft Office Outlook, Microsoft Office PowerPoint, Microsoft Office Publisher, Microsoft Office SharePoint, Microsoft Office Word, Microsoft Standard XPS, Microsoft Teams for Android, Microsoft Trace Data Helper, Microsoft UxTheme Library (uxtheme.dll), Microsoft WDAC OLE DB provider for SQL, Microsoft WebP Image Extension, Microsoft Windows Codecs Library, Microsoft Windows Media Foundation, Microsoft Windows PDF, Microsoft Windows SCSI Class System File, Microsoft Windows Search Component, Microsoft Windows Speech, OpenSSH for Windows, Power Automate, Push Message Routing Service, RPC Runtime, Reliable Multicast Transport Driver (RMCAST), Remote Desktop Client, Remote Desktop Gateway Service, Role: DNS Server, Role: Windows Fax Service, SQL Server, Skype for Business, Spring Cloud Azure, Storage Port Driver, Telnet Client, Virtual Hard Disk (VHD) Miniport Driver, Visual Studio, Visual Studio Code, Volume Manager Driver, Windows AF_UNIX Socket Provider, Windows ALPC, Windows Accounts Control, Windows Ancillary Function Driver for WinSock, Windows Audio Service, Windows Authentication Methods, Windows Autopilot, Windows Bind Filter Driver, Windows Biometric Service, Windows BitLocker, Windows Bluetooth Port Driver, Windows Bluetooth Service, Windows Boot Manager, Windows Broadcast DVR User Service, Windows Broker Infrastructure Service, Windows CD-ROM Driver, Windows Camera Frame Server Monitor, Windows Cloud Files Mini Filter Driver, Windows Compressed Folder, Windows Connected User Experiences and Telemetry, Windows Container Manager Service, Windows Core Messaging, Windows Credential Guard, Windows Credential Providers, Windows DCOM Server, Windows DHCP Client, Windows DHCP Server, Windows DNS, Windows DWM Core Library, Windows Defender Firewall Service, Windows Deployment Services, Windows Device Association Broker service, Windows Device Association Service, Windows Device Health Attestation (DHA), Windows Devices Human Interface, Windows Direct Show, Windows Display Enhancement Service, Windows Distributed File System (DFS), Windows Embedded Mode Service, Windows Encrypting File System (EFS), Windows Enterprise App Management, Windows Error Reporting, Windows Event Logging Service, Windows Failover Cluster, Windows Fast FAT Driver, Windows File History Service, Windows GDI, Windows GDI+, Windows Graphics Kernel, Windows Group Policy, Windows HTTP Print Provider, Windows Hello, Windows Host Guardian Service, Windows IKE Extension, Windows IP Address Management (IPAM) Service, Windows Image Acquisition, Windows Imaging Component, Windows Installer, Windows Internet Connection Sharing (ICS), Windows Kerberos, Windows Kernel, Windows Kernel Mode Driver, Windows Key Distribution Center, Windows LDAP – Lightweight Directory Access Protocol, Windows License Manager, Windows Link Layer Topology Discovery Protocol, Windows MIDI Service Module, Windows Management Instrumentation, Windows Management Services, Windows Media, Windows Media Player, Windows Message Queuing, Windows Message Queuing Queue Manager, Windows Microsoft DirectMusic, Windows Mobile Broadband, Windows Modern Device Management (MDM), Windows Modern Execution Server, Windows NDIS, Windows NFS Portmapper, Windows NTFS, Windows Netlogon, Windows Network Connection Broker, Windows Network File System, Windows Notification, Windows OLE DB, Windows Online Certificate Status Protocol (OCSP), Windows Overlay Filter, Windows Paint, Windows Partition Management Driver, Windows Performance Monitor, Windows Power Dependency Coordinator, Windows PowerShell, Windows Print Spooler Components, Windows PrintWorkflowUserSvc, Windows Program Compatibility Assistant Service, Windows Push Notifications, Windows RDP Client, Windows RNDIS, Windows Raw Image Extension, Windows Registry, Windows Remote Access Connection Manager, Windows Remote Desktop, Windows Remote Desktop Licensing Service, Windows Remote Desktop Protocol, Windows Remote Desktop Services, Windows Resilient File System (ReFS), Windows Resilient File System (ReFS) Deduplication Service, Windows Routing and Remote Access Service (RRAS), Windows SMB Client, Windows SMB Server, Windows SMB Server Network Transport Driver (srvnet.sys), Windows Schannel, Windows Secure Boot, Windows Secure Kernel Mode, Windows Secure Socket Tunneling Protocol (SSTP), Windows Security Center, Windows Security Health Service, Windows Server, Windows Services for NFS ONCRPC XDR Driver, Windows Setup Files Cleanup, Windows Shell, Windows Smart Card, Windows Spaceport.sys, Windows Storage, Windows Storage Management Provider, Windows Storage Port Driver, Windows Storage Spaces Controller, Windows TCP/IP, Windows Task Scheduler, Windows Text Shaping, Windows URL Moniker, Windows USB Audio Class driver (usbaudio.sys), Windows USB Driver, Windows USB Hub Driver, Windows USB Mass Storage Class Driver, Windows USB Video Driver, Windows Universal Disk Format File System Driver (UDFS), Windows Universal Plug and Play (UPnP) Device Host, Windows Update Stack, Windows VHD miniport driver, Windows VOLSNAP.SYS, Windows Virtual Trusted Platform Module, Windows Volume Manager Extension Driver, Windows Volume Shadow Copy, Windows Web Platform Storage, Windows WebClient Service, Windows Win32 Kernel Subsystem, Windows Win32K, Windows Wireless Networking, Windows Wireless Wide Area Network Service, Windows Work Folder Service, Windows Work Folders, Windows exFAT File System, Windows iSCSI, Windows iSCSI Target Service, Winsock, XBox Gaming Services, Xbox.
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Qualys VMDR automatically detects new Patch Tuesday vulnerabilities using continuous updates to its Knowledgebase (KB).
You can see all your impacted hosts by these vulnerabilities using the following QQL query:
vulnerabilities.vulnerability: ( qid: 110534 or qid: 110535 or qid: 110536 or qid: 388653 or qid: 388654 or qid: 388660 or qid: 388661 or qid: 50150 or qid: 92451 or qid: 92452 or qid: 92453 or qid: 92454 or qid: 92455 or qid: 92456 or qid: 92457 or qid: 92458 or qid: 92459 or qid: 92460 or qid: 92461 or qid: 92462 or qid: 92463 or qid: 92464 )
Rapid Response with TruRisk™ Eliminate
Patch to the Latest Version
VMDR rapidly remediates Windows hosts by deploying the most relevant and applicable per-technology version patches. You can simply select the respective QIDs in the Patch Catalog and filter for “Missing” patches to identify and deploy the applicable, available patches with one click.
The following QQL will return the missing patches for this Patch Tuesday:
( qid: 110534 or qid: 110535 or qid: 110536 or qid: 388653 or qid: 388654 or qid: 388660 or qid: 388661 or qid: 50150 or qid: 92451 or qid: 92452 or qid: 92453 or qid: 92454 or qid: 92455 or qid: 92456 or qid: 92457 or qid: 92458 or qid: 92459 or qid: 92460 or qid: 92461 or qid: 92462 or qid: 92463 or qid: 92464 )
Visit the September 2026 Security Updates to access the full description of each vulnerability and the systems it affects.
Qualys customers can scan their network with QIDs 110534, 110535, 110536, 388653, 388654, 388660, 388661, 50150, 92451, 92452, 92453, 92454, 92455, 92456, 92457, 92458, 92459, 92460, 92461, 92462, 92463, and 92464 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.
References:
https://msrc.microsoft.com/update-guide
https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep
Text extracted automatically; images, tables and formatting may be missing. Original: https://threatprotect.qualys.com/2026/09/09/microsoft-patch-tuesday-september-2026-security-update-review/