Microsoft Patch Tuesday, September 2026 Security Update Review
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.
- 974 vulnerabilities fixed, including 113 critical; largest Patch Tuesday ever, up from 570 in July
- Two exploited-in-the-wild zero-days: CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (ALPC), both grant SYSTEM
- Updates cover HTTP.sys, Hyper-V, Entra ID, Exchange, Office, DNS, SQL Server, and Copilot products
- CVEs
- CVE-2026-81963CVE-2026-85880CVE-2026-58599CVE-2026-62906CVE-2026-62916CVE-2026-65669CVE-2026-65772CVE-2026-69632CVE-2026-69678CVE-2026-69767CVE-2026-69797CVE-2026-69730CVE-2026-69858CVE-2026-72987CVE-2026-69860CVE-2026-73013CVE-2026-73023CVE-2026-77495CVE-2026-69590CVE-2026-69852CVE-2026-72950CVE-2026-72959CVE-2026-81948CVE-2026-81951CVE-2026-81959CVE-2026-69530CVE-2026-78449CVE-2026-78450CVE-2026-69740CVE-2026-69784
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58599 | Heap Buffer Overflow in Microsoft Windows Codecs Library Enables Local Code Execution | 7.8 | <1% | ||
| CVE-2026-62906 | Query Logic Flaw Enables Info Disclosure in Microsoft Discovery Studio | 7.4 | <1% | ||
| CVE-2026-62916 | Authentication Bypass in Microsoft Entra ID Enables Privilege Elevation | 9.8 | <1% | ||
| CVE-2026-65669 | Injection Flaw in Microsoft SQL Server Enables Network Privilege Escalation | 9.6 | <1% | ||
| CVE-2026-65772 | Deserialization RCE in Microsoft Dynamics 365 | 8.8 | <1% | ||
CVE-2026-69530+1 related CVE | Use-After-Free RCE in Microsoft Windows Reliable Multicast Transport (RMCAST) Driver | 8.1 | <1% | ||
| CVE-2026-69730 | Use-After-Free RCE in Windows DNS Server | 9.8 group max | 1% | ||
| CVE-2026-69632 | Use-After-Free Remote Code Execution in Microsoft Office | 8.8 group max | <1% | ||
| CVE-2026-69740 | Use-After-Free Local Privilege Escalation in Windows Hello | 8.8 | <1% | ||
| CVE-2026-69784 | Use-After-Free Local Privilege Escalation in Microsoft Windows Hello | 8.8 | <1% | ||
| CVE-2026-69858 | Use-After-Free Remote Code Execution in Windows DNS Server | 8.1 | <1% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
12 min read at threatprotect.qualys.comMicrosoft kicks off September with its monthly Patch Tuesday release, delivering fixes for security vulnerabilities affecting products. The security updates are packed with security fixes, providing organizations with important updates to help protect their environments from emerging threats.
By Diksha Ojha · threatprotect.qualys.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.