Microsoft's Record September 2026 Patch Tuesday Fixes 974 Flaws, Including Two Actively Exploited Zero-Days

CVE-2026-69730 is a use-after-free memory corruption flaw (CWE-416) in the Windows DNS service that allows an unauthenticated, remote attacker to execute arbitrary code by sending crafted network traffic to the affected system. Because the flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1 9.8), any system running the vulnerable DNS service is a direct target. Successful exploitation would give the attacker code execution in the context of the DNS service, which on Windows Server typically runs with high privileges such as SYSTEM, and could enable wormable spread between vulnerable hosts. Affected organizations are those running the Windows DNS Server role — a component deployed on virtually all Windows Server domain controllers and on dedicated Windows DNS servers, especially those exposed to untrusted networks. As of the September 2026 Patch Tuesday release, there is no known public proof-of-concept, the flaw is not listed in CISA's KEV, and it has not been confirmed exploited in the wild, though it was flagged among roughly 20 'wormable' bugs and described in press coverage as a successor to the 2020 SigRed Windows DNS RCE.

Do: Apply Microsoft's September 2026 Patch Tuesday security updates to every Windows Server running the DNS Server role as soon as possible, prioritizing internet-facing DNS servers and domain controllers. Until patched, limit exposure of TCP/UDP port 53 from untrusted networks and restrict remote management surfaces. Because the bug is rated wormable and shares characteristics with the 2020 SigRed DNS RCE, treat unpatched domain controllers as high priority and check DNS service event logs for unexpected restarts or anomalous query handling.

CVE-2026-69829 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Shell. According to its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), an unauthorized remote attacker could trigger the flaw over a network without needing privileges, user interaction, or special conditions. Successful exploitation would allow the attacker to execute code on the affected host, with high impact on confidentiality, integrity, and availability. All Windows installations that include the Windows Shell component are potentially affected, though the available data does not enumerate specific vulnerable version ranges. There is currently no known public proof-of-concept, the CVE is not in CISA's KEV, and EPSS assigns roughly a 1.1% probability of exploitation within 30 days; the related headlines note Microsoft's record patch release of 974 flaws included two other exploited Windows zero-days, but no confirmed in-the-wild exploitation of this specific CVE is documented.

Do: Apply Microsoft's latest Windows security updates across all Windows systems, prioritizing internet-facing machines, and confirm the update covering CVE-2026-69829 is installed on each host. If patching must be deferred, reduce exposure by limiting network access to Windows services that invoke shell functionality, and monitor Microsoft's advisory, CISA KEV, and public PoC releases for signs of rising exploitation risk.

CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.

Do: Immediately deploy the September 2026 Patch Tuesday cumulative updates to every Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2025 host; as a KEV entry under BOD 26-04, prioritize internet-exposed and high-value assets, apply vendor mitigations (or discontinue use) where patching is delayed, and follow CISA's forensics triage requirements if compromise is suspected. Verify deployment via patch telemetry and review which local accounts can trigger update-stack activity on shared or multi-user systems.