Patch Tuesday - September 2026
Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.
Microsoft published 974 own-product vulnerabilities plus 25 non-Microsoft CVEs, totaling 999 — the most CVEs Microsoft has ever released in a single day. Two flaws are exploited in the wild: CVE-2026-85880, an out-of-bounds write in Windows ALPC granting SYSTEM privileges, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack also leading to SYSTEM. Chrome's V8 zero-day CVE-2026-85046 was patched in Edge on September 2, but Microsoft had not published a corresponding advisory, leaving uncertainty about other Chromium fixes in Edge. October 14 lifecycle changes end servicing for Windows 11 24H2 Home/Pro, Office 2021, and Exchange Server 2016/2019.
- Record 999 CVEs fixed on September 2026 Patch Tuesday
- CVE-2026-85880: Windows ALPC zero-day EoP exploited in the wild, grants SYSTEM
- CVE-2026-81963: Windows Update Stack EoP zero-day exploited in the wild
- Edge patched Chrome V8 zero-day CVE-2026-85046 without publishing an advisory
- Major Windows, Office, and Exchange end-of-support milestones arrive October 14, 2026
- CVEs
- CVE-2026-85880CVE-2026-81963CVE-2026-85046CVE-2026-85045CVE-2026-80097CVE-2026-58611CVE-2026-70352CVE-2026-62895CVE-2026-69857CVE-2026-77909CVE-2026-81349CVE-2026-83941CVE-2026-84003
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58611 | Local Privilege Escalation in Microsoft Xbox Gaming Services (CVE-2026-58611) | 7.8 | <1% | ||
| CVE-2026-62895 | Permissive Cross-Domain Policy Privilege Elevation in Microsoft Azure Arc | 8.8 | <1% | ||
| CVE-2026-69857 | Authorization Bypass Through User-Controlled Key in Microsoft Azure Cosmos DB | 8.8 | <1% | ||
| CVE-2026-70352 | Unauthenticated Privilege Elevation in Microsoft Azure AI Language | 10.0 | <1% | ||
| CVE-2026-77909 | Insufficiently Protected Credentials in Microsoft Azure CycleCloud | 6.5 | <1% | ||
| CVE-2026-80097 | Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation | 8.6 | <1% | ||
| CVE-2026-81349 | OS Command Injection Privilege Elevation in Microsoft Azure HDInsights | 7.2 | <1% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
| CVE-2026-83941 | Missing Authorization in Microsoft Entra ID Enables Privilege Escalation | 8.8 | <1% | ||
| CVE-2026-84003 | Capture-replay authentication bypass in Microsoft MSAL for Node.js | 7.4 | <1% | ||
| CVE-2026-85045 | Race condition in Google Chrome V8 allows sandboxed code execution via crafted web page | 7.5 | <1% | PoC | |
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
From the original article
11 min read at rapid7.com
Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday, including 723 vulnerabilities in Windows. Along with Microsoft fixes for 25 non-Microsoft CVEs, that brings the total number of vulnerabilities on the table today to 999. Whether this is the biggest Patch Tuesday ever depends on how we count, but this is by far the most CVEs that Microsoft has ever published in a single day.
By Rapid7 · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.