September 2026 Patch Tuesday: SAP Fixes Maximum-Severity 'OVERPASS' Kernel Flaw; Microsoft Patches 974 Vulnerabilities Including 2 Exploited Zero-Days

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

CVE-2026-44756 is a critical (CVSS 10.0) memory-safety flaw — a classic buffer overflow (CWE-120) — in the Extended Passport Protocol (EPP) processing library of SAP Kernel, the core runtime underlying SAP NetWeaver components (SAP's advisories tie the issue to SAP Kernel and the NetWeaver Message Server). An unauthenticated remote attacker can trigger it by sending a crafted network request containing a malformed EPP header to a system that processes EPP traffic. The malformed header causes undefined behavior and abnormal program termination, and SAP's maximum-severity rating plus vendor coverage of the flaw indicate it can enable unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the affected SAP Kernel/NetWeaver components — essentially typical ABAP-stack SAP deployments — is exposed until patched. No public proof-of-concept is known, the flaw is not in CISA KEV, EPSS estimates only a 0.3% chance of exploitation within 30 days (25th percentile), and fixes shipped in SAP's September 2026 Security Patch Day.

Do: Apply the SAP Kernel and NetWeaver Message Server fixes released in SAP's September 2026 Security Patch Day (per the 2026-011 advisory covering this flaw), since specific fixed version numbers are not listed in the available data. As interim mitigation, restrict network access to SAP kernel and message-server services to trusted internal networks and identify any SAP instances exposed to the internet. Check SAP's advisory for the exact patch levels applicable to your kernel releases and prioritize externally reachable systems.

CVE-2026-44766 is a SQL injection flaw (CWE-89) in the Intercompany Matching and Reconciliation (IMR) component of SAP S/4HANA. A low-privileged authenticated user can submit crafted input to certain IMR functions, which is passed to the underlying database without proper validation, allowing malicious queries to execute. An attacker gains unauthorized read access to sensitive information in the database — a high confidentiality impact — with no effect on integrity or availability, and no user interaction is required beyond the attacker's own valid low-privilege session. Only organizations running SAP S/4HANA with the IMR component in use are affected; exposure is internal-facing, since exploitation requires an authenticated account rather than anonymous internet access. There is no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS of 0.2% (13th percentile) indicates no known exploitation; fixes were shipped as part of SAP's September 2026 Security Patch Day.

Do: Apply the SAP September 2026 Security Patch Day corrections for S/4HANA IMR, checking the SAP Security Note for this CVE to match the correct patch level to your installed release. Until patched, restrict low-privileged access to the affected IMR functions and review database logs for unexpected or anomalous queries issued by IMR service users.

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components when they register with the service (CWE-308). An unauthenticated attacker with network access to the affected service can send a crafted registration request to add or impersonate an application server component. Once registered, the attacker can potentially perform unauthorized actions within the SAP application environment, resulting in a high impact on confidentiality, integrity, and availability — reflected in the critical CVSS 9.8 score. Any organization running SAP NetWeaver deployments that rely on the Message Server is affected; the source data does not specify exact affected version ranges. There is no evidence of active exploitation, no public proof-of-concept, and the issue is not in CISA KEV, with EPSS assigning only a ~0.3% 30-day exploitation probability; a fix shipped in SAP's September 2026 Security Patch Day (a release that also patched other critical flaws, including the separately reported 'OVERPASS' SAP Kernel issue).

Do: Apply the SAP NetWeaver Message Server fix from the September 2026 SAP Security Patch Day (referenced as advisory 2026-011) as a priority, since the flaw is unauthenticated and network-triggerable; check SAP's portal for the corrected builds applicable to your release, as no specific version numbers were provided in the source data. Until patching, restrict network access to the Message Server (typically TCP 36xx, e.g., 3600) to trusted application server hosts and internal networks, and verify no message server listener is reachable from the internet. Monitor SAP security notes for updates, as no public exploit exists today.

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.

SAP NetWeaver Application Server for ABAP and ABAP Platform contains an unauthenticated session-hijacking flaw (CWE-191, incorrect type validation) in which a specially crafted network packet causes the server to reprocess a previously buffered user request. Because the flaw can only be triggered under narrow timing conditions, an unauthenticated remote attacker may be able to replay another user's buffered request and take over that user's session, gaining high-impact access to the victim's confidentiality and integrity with only low impact on availability. Any organization running SAP NetWeaver AS for ABAP or ABAP Platform is potentially affected, though the attack surface depends on whether the affected service is reachable from untrusted networks. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known; EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

Do: Apply the SAP September 2026 Security Patch Day corrections for NetWeaver AS for ABAP and ABAP Platform, using SAP's advisory to identify the note and patch level matching your installed releases. Until patched, restrict network access to the affected SAP application server services from untrusted networks, and monitor for anomalous session reuse or unexpected session takeover. Given the high attack complexity and lack of known exploitation, prioritize patching within normal monthly maintenance windows unless the service is internet-exposed.

SAP GUI for Java (CWE-807) fails to correctly enforce its trust level policy when certain functions are invoked from a connected backend system, meaning the client relies on untrusted backend input when making security decisions. To exploit it, an attacker needs low-privileged access to a connected backend (for example, a compromised or malicious SAP backend) and must manipulate that backend to trigger the affected functionality, which also requires interaction from the logged-in user (CVSS UI:R). Successful exploitation yields arbitrary command execution on the victim's workstation, with the changed-scope vector (S:C) allowing a backend-level foothold to break out onto the end-user machine and seriously impacting its confidentiality, integrity, and availability. Anyone running SAP GUI for Java to connect to SAP backends is exposed, particularly in scenarios where less-trusted or low-privileged users can influence the backend their colleagues connect to. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no in-the-wild exploitation is currently known; a fix shipped as part of SAP's September 2026 security patch day.

Do: Deploy the SAP GUI for Java patch released with SAP's September 2026 security updates, checking the SAP advisory for the exact affected and fixed versions for your release line. Inventory endpoints running SAP GUI for Java (especially macOS/Linux desktops) and the backends they connect to, prioritizing users who connect to backends accessible to low-privileged or external users. As an interim mitigation, restrict low-privileged accounts' ability to invoke the affected backend functions and treat backend compromise as a path to client workstation takeover when assessing risk.

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components, permitting XML external entity (XXE) injection (CWE-611). An attacker with low-privilege (authenticated) access can submit specially crafted XML payloads containing malicious external entity declarations over the network, with no user interaction required. Successful exploitation lets the attacker read sensitive files from the server, with the contents exposed through monitoring or logging output, and can also cause resource exhaustion; confidentiality impact is high, availability impact is low, and there is no integrity impact (CVSS 3.1 score 8.5, scope changed). Any organization running SAP Integration Suite, a cloud-delivered platform whose tenants consume SAP-managed components, is affected until the September 2026 SAP security updates are applied. No exploitation has been observed so far: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within the next 30 days.

Do: Apply the SAP Integration Suite fixes released in the September 2026 SAP Security Patch Day, locating the corresponding SAP security note via CVE-2026-76958 for the exact component and version details (not disclosed in this data). Because file contents may be exposed through monitoring or logging output, review relevant logs for signs of XXE probing or leaked sensitive data and treat affected log stores as potentially containing sensitive information. Additionally, restrict low-privilege access to XML-accepting endpoints and disable or limit external entity resolution where configuration options allow.

SAP NetWeaver Business Client does not sufficiently validate certain locally stored data that it processes at application startup, a flaw classified as CWE-502 (deserialization of untrusted data). An attacker with low privileges on the local system can replace this data with specially crafted content, and when the application is next launched the crafted content is processed with no further user interaction required. Successful exploitation results in arbitrary code execution in the context of the logged-on user, with high impact on the confidentiality, integrity, and availability of the application. Any organization running the SAP NetWeaver Business Client desktop application is affected, and fixes were delivered as part of SAP's September 2026 Security Patch Day. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.2% probability of exploitation within 30 days.

Do: Apply the SAP security patch released with the September 2026 Patch Day to all systems running SAP NetWeaver Business Client, checking SAP's advisory for the specific affected and corrected releases. Because exploitation requires low-privileged local access, limit write access to the application's locally stored data/configuration locations and maintain endpoint hardening on workstations running the client. No workarounds are described in the available data, so prompt patching is the primary remediation.

CVE-2026-76968 is an information disclosure flaw (CWE-497) in SAP Web Dispatcher, SAP Internet Communication Manager (ICM), and SAP Content Server in which an authenticated user with only low privileges can reach administrative functionality or interfaces that should be off-limits to them. The attacker triggers the flaw by sending requests over the network to these administrative endpoints using valid low-privileged credentials, requiring no user interaction. By reading the exposed administrative interface, the attacker obtains sensitive information about the system state, which could be used to facilitate further attacks, although integrity and availability are not affected. Any organization running the affected SAP components is exposed, and because ICM is embedded in SAP's application server stack, this potentially touches a very broad base of SAP on-premise and cloud deployments. As of now there is no evidence of exploitation, no public proof-of-concept, and the issue is not in CISA's KEV catalog; fixes were shipped with the SAP September 2026 Security Patch Day updates.

Do: Apply the SAP security fixes released with the September 2026 Security Patch Day (check SAP Note/CVE-2026-76968 for the exact patch levels for Web Dispatcher, ICM and Content Server, as version details are not in this data). Until patching, restrict access to the administrative interfaces of these components using network controls and review which low-privileged users can reach them. Since exploitation requires valid credentials, prioritize review of recently created or over-privileged service and end-user accounts.

CVE-2026-76969 is a critical flaw (CVSS 9.4) in SAP's @sap/cds-mtxs npm package, the multitenancy component of the SAP Cloud Application Programming Model (CAP), which performs insufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker who can reach the affected endpoints can send specially crafted requests that cause the service to disclose sensitive credentials. With those credentials, the attacker can replace or delete tenant data, resulting in high impact to integrity and availability and partial impact to the confidentiality of business data. Only deployments running multitenant CAP applications on @sap/cds-mtxs with extensibility enabled are affected. Exploitation has not been observed: there is no known public proof of concept, the issue is not in CISA KEV, and EPSS estimates only a ~0.3% probability of exploitation within 30 days.

Do: Update the @sap/cds-mtxs dependency in all multitenant CAP applications to the fixed version given in SAP's security advisory for CVE-2026-76969 (part of SAP's September 2026 patch batch) and redeploy the affected applications. Audit whether your CAP applications use multitenancy with extensibility enabled and whether the mtxs endpoints are reachable without authentication, and rotate any tenant-scoped credentials that could have been exposed. As an interim mitigation, restrict network access to the mtxs/sidecar endpoints to trusted callers.

A heap-based buffer overflow (CWE-122) in Microsoft Word's document processing allows an unauthorized, remote attacker to execute arbitrary code when the user opens or previews attacker-supplied Word document content, with the CVSS vector indicating no privileges required but user interaction needed. A successful attacker gains code execution in the context of the logged-in user, with high impact on confidentiality, integrity, and availability. Anyone running Word from Office 2016, 2019, 2021, or 2024, Microsoft 365, or Microsoft 365 Apps is affected. As of publication there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns roughly a 0.6% probability of exploitation within 30 days, indicating no known exploitation in the wild.

Do: Apply Microsoft's September 2026 security updates (or later channel builds) on all systems running Office 2016, 2019, 2021, 2024, Microsoft 365, or Microsoft 365 Apps, and confirm the installed Word build is post-patch via the Office Account/About panel. Until patched, instruct users not to open unsolicited Word document attachments and rely on Protected View, since exploitation requires user interaction. With no public PoC, KEV listing, or confirmed in-the-wild exploitation, this can be handled in the normal patch cycle, but the 8.8 CVSS and Word's ubiquitous document-opening attack surface justify prompt prioritization.

CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.

Do: Immediately deploy the September 2026 Patch Tuesday cumulative updates to every Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2025 host; as a KEV entry under BOD 26-04, prioritize internet-exposed and high-value assets, apply vendor mitigations (or discontinue use) where patching is delayed, and follow CISA's forensics triage requirements if compromise is suspected. Verify deployment via patch telemetry and review which local accounts can trigger update-stack activity on shared or multi-user systems.

CVE-2026-83498 is an untrusted pointer dereference (CWE-822) in the Virtualization-Based Security (VBS) Enclave component of Microsoft Windows. An authorized local attacker, meaning someone who already holds low-privileged code execution on the machine, can cause the enclave to dereference attacker-controlled pointers with no user interaction required. Successful exploitation breaks the VBS enclave trust boundary and elevates the attacker's privileges locally, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). All Windows editions that ship the VBS Enclave feature are in scope, but the source data does not enumerate specific vulnerable builds, so defenders should consult Microsoft's advisory for the exact affected-product matrix. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, EPSS assigns only a 0.3% probability of exploitation within 30 days, and fixes shipped in Microsoft's September 2026 Patch Tuesday release, which addressed 974 vulnerabilities including 2 zero-days (this CVE is not confirmed to be one of the actively exploited ones).

Do: Apply Microsoft's September 2026 Patch Tuesday cumulative updates to affected Windows systems, prioritizing multi-user hosts, jump servers, and endpoints where untrusted or low-privileged users can execute code. Verify VBS status via System Information (msinfo32) and confirm the September 2026 update is installed using the fixed-build details in Microsoft's advisory. No workaround is documented, and with no public PoC or in-the-wild exploitation known, routine patch cadence is reasonable for isolated single-user systems.

CVE-2026-83939 is an untrusted pointer dereference (CWE-822) in the Windows Secure Kernel Mode, the high-privilege virtualization-based security component of Windows. A local attacker who is already authorized and holds high privileges on the system can trigger the flaw by causing the Secure Kernel to dereference an attacker-influenced pointer, gaining local elevation of privileges. Because the CVSS scope is 'changed' (S:C), the flaw lets an attacker cross a security boundary beyond the process they started in, with high impact on confidentiality, integrity and availability. Any Windows installation whose Secure Kernel component is affected is at risk, per Microsoft's September 2026 Patch Tuesday advisory; exact version ranges are listed in Microsoft's bulletin. There is no known in-the-wild exploitation, no public proof-of-concept, and a low 0.3% EPSS probability of exploitation in the next 30 days, but a fix shipped as part of the 974-vulnerability September 2026 release.

Do: Install the September 2026 Windows security (cumulative) updates from Microsoft's Patch Tuesday release for every affected Windows version in your environment; do not skip workloads where virtualization-based security features (e.g., HVCI/Credential Guard) are enabled, as they rely on the affected Secure Kernel. Because the flaw requires an attacker to already hold high local privileges, treat it as a chaining/enabler risk for adversary-in-the-middle post-exploitation and prioritize patching hosts with many privileged users or admins. No workaround or mitigation is listed in the source data; check Microsoft's advisory for per-version applicability and any released mitigation guidance.

CVE-2026-83941 is a missing-authorization flaw (CWE-862) in Microsoft Entra ID, the cloud identity service behind Microsoft 365 and Azure. An already-authenticated, low-privileged user can send a network request to an Entra ID endpoint that fails to enforce proper authorization checks, requiring no user interaction. Exploitation lets the attacker elevate their privileges within the directory, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Any organization that uses Microsoft Entra ID is in the affected population. The flaw was patched in Microsoft's September 2026 Patch Tuesday release; it is not in CISA KEV, has no known public proof-of-concept, and carries a low EPSS of roughly 0.7%.

Do: Review Microsoft's September 2026 Patch Tuesday advisory for this CVE and apply any required tenant-side updates or configuration changes, noting that fixes for the cloud-hosted directory service are applied largely by Microsoft. Audit privileged role assignments and sign-in activity in your tenant for signs of unexpected elevation, and tighten who holds elevated roles. Monitor for additions to CISA KEV or public proof-of-concept code, which would raise urgency.

CVE-2026-83948 is a command injection flaw (CWE-77) in Microsoft Azure CLI in which special shell elements are not properly neutralized before the CLI executes commands. To trigger it, an attacker who already holds some authorized (low-privilege) access must get crafted input with special characters processed by Azure CLI in a user's session, over the network, with user interaction required and high attack complexity, per the CVSS vector. A successful attack yields remote code execution in the context of the user running the CLI, and because the CVSS scope is 'changed', code may execute beyond the vulnerable component, with high impact to confidentiality, integrity and availability. Any organization running Azure CLI on admin workstations, servers, or CI/CD pipelines is potentially affected, though specific affected and fixed versions are not stated in the available data; Microsoft shipped the fix in its September 2026 Patch Tuesday release. There is no evidence of exploitation so far: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns only a 0.4% probability of exploitation in the next 30 days.

Do: Update Azure CLI to the patched version delivered in Microsoft's September 2026 security updates (check Microsoft's advisory for the exact fixed version number). Until patched, limit Azure CLI use to trusted sessions and avoid running it with crafted or untrusted input in interactive sessions, and inventory admin workstations, jump hosts, and CI/CD runners where the tool is installed. Because exploitation requires existing authorized access, prioritize remediation on environments where lower-privileged Azure identities or external users can reach CLI sessions.

CVE-2026-83989 is an out-of-bounds read (CWE-125) in the ONCRPC XDR driver of Microsoft's Windows Services for NFS, addressed in Microsoft's September 2026 Patch Tuesday release. A remote, unauthenticated attacker can trigger it by sending crafted ONC RPC/XDR network requests to a host running the NFS service, causing the driver to read past the end of an allocated buffer. Successful exploitation crashes the NFS service, yielding denial of service only; the CVSS vector (C:N/I:N/A:H) confirms there is no data disclosure or tampering impact. Any Windows system with Services for NFS installed and enabled is affected, but practical exposure is limited to environments that actually use this optional feature, particularly where the NFS service is reachable from untrusted networks. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a 0.9% 30-day exploitation probability (57th percentile), so no active exploitation is currently reported.

Do: Apply the September 2026 Patch Tuesday security updates from Microsoft on any Windows systems with Services for NFS installed, checking Microsoft's advisory for the affected Windows versions and fixed builds. Inventory systems for the NFS feature/role and confirm whether the NFS/ONC RPC service is reachable from untrusted networks, restricting access with firewall rules or trusted-subnet limits where patching is delayed. Continue monitoring Microsoft's advisory and CISA KEV, since no public PoC or in-the-wild exploitation is known as of this analysis.

CVE-2026-83991 is a missing-authentication flaw (CWE-306) in the Windows Cloud Files Mini Filter Driver, the kernel component that handles cloud placeholder files such as OneDrive Files On-Demand. A local attacker who already has low-privileged authorized access to a machine can invoke the driver's critical function without proper authentication checks and tamper with cloud-managed file data, with high integrity impact but no confidentiality or availability loss per the CVSS vector. Because the attack vector is local (AV:L) with required privileges of only a standard user, it does not by itself enable remote compromise; it matters most on shared or multi-user systems where untrusted users hold local accounts. All supported Windows 10 releases from 1809 onward, Windows 11 from 23H2 onward, and Windows Server 2019/2022/2025 are listed as affected. The flaw is not in CISA's KEV, its EPSS score is a low 0.3%, but a public proof-of-concept write-up exists on GitHub, and Microsoft shipped a fix as part of its September 2026 Patch Tuesday release.

Do: Apply Microsoft's September 2026 Patch Tuesday security updates to all affected Windows 10, Windows 11, and Windows Server builds. Prioritize shared workstations, VDI hosts, and servers where low-privileged or untrusted users have local sign-in rights, since exploitation requires local access and only tampers with cloud files data. No in-the-wild exploitation is reported (EPSS 0.3%, not in KEV), but a public PoC exists, so treat the patch as routine-high priority rather than emergency.

CVE-2026-83997 is a use-after-free (CWE-416) vulnerability in Microsoft's Windows Message Queuing (MSMQ) service that permits an unauthenticated, remote attacker to execute arbitrary code over the network. It is triggered when the MSMQ service processes specially crafted network traffic that causes memory to be used after it has been freed, with the high attack-complexity rating (AC:H) indicating the attacker likely needs to win a timing or state race to land the free-then-use condition. Successful exploitation yields code execution in the context of the MSMQ service, with high confidentiality, integrity, and availability impact, meaning an attacker could take over the affected host. Only Windows systems that have the optional Message Queuing (MSMQ) feature installed and running are exposed, since MSMQ is not enabled by default on most Windows installations and is typically found on legacy application and queuing servers. There is no evidence of exploitation so far: the flaw is not in CISA's KEV, no public proof-of-concept is known, EPSS is 0.5% (42nd percentile), and the two actively exploited zero-days mentioned in September 2026 Patch Tuesday headlines are separate issues fixed in the same release.

Do: Apply Microsoft's September 2026 Patch Tuesday security updates for Windows, which include the fix for CVE-2026-83997, prioritizing servers where the Message Queuing (msmq/mqsvc) service is installed. Where MSMQ is not required, disable and remove the Message Queuing feature; where it is needed, restrict inbound access to MSMQ network ports from untrusted networks and verify the service is not exposed to the internet.

CVE-2026-83998 is a heap-based buffer overflow (CWE-122) in the Microsoft Remote Desktop Client, the component used to connect out to remote machines over RDP. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated network attacker can trigger the overflow, but only with user interaction — consistent with the flaw being exercised when a client establishes a connection and processes attacker-influenced data from the remote side. Successful exploitation yields remote code execution in the context of the client process, with high impact to confidentiality, integrity, and availability (CVSS 8.8 High). Users and organizations whose workstations run the affected Remote Desktop Client to reach RDP servers — administrators, support staff, and remote workers in particular — are in scope per Microsoft's September 2026 Patch Tuesday advisory. As of this analysis there is no public proof-of-concept, the CVE is not in CISA KEV, and EPSS is a modest 0.4%; the two actively exploited zero-days referenced in the September 2026 release headlines are not identified as this CVE.

Do: Apply Microsoft's September 2026 security updates for the Remote Desktop Client via Windows Update, WSUS, or Intune, prioritizing administrator workstations, jump hosts, and support machines that routinely make outbound RDP connections. Until patched, restrict users to connecting only to trusted RDP servers and consider limiting outbound RDP (TCP 3389) to known hosts or gateways. Verify the exact affected version ranges in Microsoft's advisory, as they are not enumerated in the source data.

CVE-2026-84003 is an authentication bypass by capture-replay (CWE-294) in the Microsoft Authentication Library (MSAL) for Node.js, the library Node.js applications use to authenticate users and services against Microsoft's identity platform. An attacker positioned on the network who can capture authentication material in transit can replay it to authenticate as a legitimate user or client, with no privileges or user interaction required; the high attack complexity reflects the difficulty of intercepting and replaying the exchange while it remains valid. Successful exploitation enables spoofing with high impact on confidentiality and integrity (the attacker can act as the victim), though there is no availability impact. Any organization running Node.js server applications, APIs, daemons, or CLIs that depend on MSAL for Node.js is affected, with end users of those applications exposed through them. As of this writing there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts the 30-day exploitation probability at 0.4% (37th percentile); the fix shipped in Microsoft's September 2026 Patch Tuesday.

Do: Upgrade the @azure/msal-node package to the patched release issued with September 2026 Patch Tuesday (check Microsoft's advisory for the exact fixed version numbers) and redeploy every Node.js service that depends on it. Review Microsoft Entra ID sign-in and authentication logs for the same captured credentials or tokens being replayed from unexpected sources, and prioritize internet-facing or network-exposed services where traffic interception is feasible. Note the high attack complexity: exploitation requires an attacker to capture in-flight authentication material, so exposure depends heavily on network paths and TLS posture.

CVE-2026-85877 is a heap-based buffer overflow (CWE-122) in the Windows Print Spooler components, fixed by Microsoft in its September 2026 Patch Tuesday release. A remote, unauthenticated attacker can trigger the flaw by sending crafted input to the Print Spooler service over the network, though the CVSS vector (UI:R) indicates some form of user interaction is required for successful exploitation. If exploited, the attacker gains arbitrary code execution on the target system, with the CVSS base metrics indicating high impact to confidentiality, integrity, and availability. Any Windows system with the Print Spooler service enabled is affected; the available data does not enumerate specific vulnerable Windows versions or builds. There is currently no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns only a 0.4% probability of exploitation within the next 30 days (37th percentile).

Do: Apply the September 2026 Microsoft Patch Tuesday security updates as soon as possible, prioritizing Windows servers and other systems where the Print Spooler is reachable from untrusted networks. As interim mitigation, disable the Print Spooler service on hosts that do not need printing and restrict inbound RPC/SMB access to spooler-enabled machines. Audit your estate for systems running the Print Spooler service and confirm patched status after deployment.