Patch Tuesday: September 2026

Microsoft has just delivered the largest Patch Tuesday in its history. 

September addresses 974 vulnerabilities in a single release, substantially more than previous months and the largest Patch Tuesday Microsoft has ever shipped. Of those, 113 are rated Critical, and two are zero-days that were already being exploited before today's updates were available.

A number that size is more than most teams can triage line by line, so the practical question is where to focus. Around twenty of this month's fixes are considered wormable, capable of spreading without any user interaction, and one of them has drawn comparisons to SigRed, the Windows DNS Server flaw that alarmed the industry back in 2020.

Coverage of this release also points to Microsoft's expanded use of AI-assisted vulnerability discovery as a major factor behind the jump in volume, which is worth keeping in mind: it means more issues are being found and fixed, not necessarily that Microsoft's products suddenly became less secure. Below is what actually deserves attention: the two exploited zero-days, the unauthenticated remote code execution flaws worth moving to the front of the queue, and a Remote Desktop Services bug that carries a Critical-level CVSS score without a Critical label attached.

Key Updates

• 974 vulnerabilities patched this month, the largest Patch Tuesday release in Microsoft's history
• 113 critical vulnerabilities
• 2 zero-day vulnerabilities, both actively exploited before a patch was available
  
  

Vulnerability Types Released in September 2026

Zero-Day Vulnerabilities

Microsoft is treating two vulnerabilities as zero-days this month. Here's what each one involves:

CVE-2026-85880: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

This is a heap-based buffer overflow in the Windows Advanced Local Procedure Call driver. Microsoft says an attacker who already has authenticated access to a system can use it to elevate to SYSTEM-level privileges. It carries a CVSS score of 7.8 and is rated Important rather than Critical, which is typical for elevation-of-privilege bugs that need existing local access rather than being reachable directly over a network. Microsoft's own advisory notes that an attacker who can already run code inside a low-privilege AppContainer sandbox could use this flaw to escape that sandbox and gain broader control of the system. Researchers at Volexity and Proofpoint are credited with finding it, and it's been added to CISA's Known Exploited Vulnerabilities catalogue, with a remediation deadline of 22 September for US federal agencies. It's also the first vulnerability in this specific ALPC driver to be patched in several years. Elevation-of-privilege bugs like this typically aren't how an attacker gets into a network in the first place, but they're a reliable way to turn an initial foothold into full control once they're in, so it's worth prioritising ahead of its Important rating alone.

CVE-2026-81963: Windows Update Stack Elevation of Privilege Vulnerability

The second is a link-following flaw in the Windows Update Stack. Microsoft describes it as improper link resolution that lets an authenticated attacker with low-level access elevate to SYSTEM privileges. It also carries a CVSS score of 7.8 and an Important rating. It was reported by external researcher Romain Deperne alongside Microsoft's own Threat Intelligence Center, which often means Microsoft's telemetry picked up signs of exploitation independently rather than relying solely on an outside tip. Like the ALPC flaw above, it's been added to CISA's Known Exploited Vulnerabilities catalogue with the same 22 September deadline, and the same logic applies: it isn't the way in, but it's a fast route from a foothold to full control.

Critical Vulnerability Summary

With 113 critical vulnerabilities in a single release, no table can cover all of them, so here are the ones worth moving to the front of the queue: the ones that don't need authentication, are reachable over a network, and either carry the highest CVSS scores or match Microsoft's own "exploitation more likely" assessment.

Other Vulnerabilities Worth Watching

The Remote Desktop Services entry above deserves a bit more explanation, the same way a couple of entries did last month. CVE-2026-69525 carries a 9.8 CVSS score, identical to several of the Critical-rated flaws sitting above it in the table, but Microsoft has rated it Important rather than Critical. That kind of split usually comes down to factors like default configuration or exactly how the affected component is reached, rather than the underlying technical severity, and Microsoft still rates exploitation of this flaw as more likely. It's a good reminder that the CVSS score and the severity label are two different signals, and it's worth reading both rather than triaging off the label alone.

Exchange Server picked up nine fixes this month, and two are worth a second look. CVE-2026-55007 is a remote code execution flaw reportedly triggered through a malicious Visio attachment, and CVE-2026-69380 is an elevation of privilege bug caused by missing authorization checks that could let an attacker reach mailbox content beyond their own account. Neither needs the same urgency as the unauthenticated flaws in the table above, since both require some user interaction or existing access, but Exchange issues that touch mailbox access are usually worth prioritising given how much sensitive data typically sits behind them.

Actions to Take

With more than 900 vulnerabilities landing in a single release, prioritisation matters even more than usual. A few places to start:

• Patch the two exploited zero-days first. CVE-2026-85880 and CVE-2026-81963 are both already in CISA's Known Exploited Vulnerabilities catalogue, with a remediation deadline of 22 September for US federal agencies, and both let an attacker turn an existing foothold into full SYSTEM access.
• Move quickly on the unauthenticated remote code execution flaws. Windows DNS Server, DHCP Server, the NFS driver and Windows Shell are all reachable without authentication,
• Don't let the Remote Desktop Services flaw slip because of its Important label. CVE-2026-69525 carries the same 9.8 CVSS score as several Critical-rated bugs in this release.
• Check Exchange Server for both of this month's notable fixes. CVE-2026-55007 and CVE-2026-69380 both touch mailbox access in different ways.
• Don't assume a bigger release means proportionally more risk. A large part of this month's volume comes from Microsoft's expanded use of AI-assisted vulnerability discovery, which appears to be surfacing more issues rather than reflecting a sudden decline in product security, so treat the record-breaking total as a scale problem to manage rather than a five-alarm fire.

To Conclude

September's Patch Tuesday is a scale problem as much as a security one. Nearly a thousand vulnerabilities in one release is more than any team can meaningfully triage line by line, and the two zero-days, while already being exploited, are elevation-of-privilege bugs rather than something that hands an attacker initial access on its own. The bigger practical risk sits in the smaller pile of unauthenticated remote code execution flaws in core Windows services, several of which Microsoft rates as wormable, and in at least one case, Remote Desktop Services, a Critical-level CVSS score doesn't come with a Critical label attached.

Working out which of the 974 fixes actually apply to your environment, and which of those handle the exposure that matters most, is the hard part, especially at this scale. RoboShadow helps with that by continuously mapping your external attack surface, so you can see what's actually exposed, which vulnerabilities are relevant to your specific setup, and where to focus patching first rather than working through Microsoft's list from top to bottom.

Frequently Asked Questions

How many vulnerabilities did Microsoft patch in September 2026?

Microsoft addressed 974 vulnerabilities in the September 2026 Patch Tuesday release, published on 8 September 2026, making it the largest single Patch Tuesday release in the company's history. Of those, 113 are rated Critical, with most of the remainder rated Important.

Were any zero-days actively exploited in September 2026?

Yes. Microsoft confirms that both of this month's zero-days, CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), were being exploited before patches were available. Both are elevation-of-privilege vulnerabilities, and both have been added to CISA's Known Exploited Vulnerabilities catalogue.

What should be patched first this month?

There's no single "worst" vulnerability in a release this size, but a few stand out: the two actively exploited zero-days, because they're already confirmed in use, and CVE-2026-69730 (Windows DNS Server), because it's an unauthenticated, network-reachable remote code execution flaw that researchers have compared to SigRed.

Which Microsoft products are affected this month?

The release touches Windows 10 and 11, Windows Server, Microsoft Office, SharePoint Server, Exchange Server, SQL Server, Skype for Business, Azure services and Developer Tools, among others. Windows components make up by far the largest share, at 723 of the 974 fixes.

Why is this Patch Tuesday so much larger than usual?

Coverage of this release points to Microsoft's expanded use of AI-assisted vulnerability discovery tooling as a major contributing factor. That means more issues are being found and fixed, not necessarily that Microsoft's products became less secure overnight, so the record-breaking total is worth treating as a triage challenge rather than a sign that this specific month is dramatically more dangerous than recent ones.

As always, thank you for your continuous support and feedback, and if you have any questions, please don’t hesitate to reach out to us at hello@roboshadow.com - we are always more than happy to walk through things with you :).