Every second Tuesday of the month, IT teams brace for Microsoft’s security update drop. This time, the Microsoft Patch Tuesday September 2026 release broke the scale entirely. Depending on which vulnerability tracker you check, Microsoft closed out somewhere between 964 and 999 flaws in a single day, easily the largest release in Patch Tuesday’s history. Two of them are already being used in real attacks.
Both have already landed on a federal government watchlist. And roughly twenty more are classified as “wormable,” meaning they can spread between systems with no user interaction at all.
If you manage patching for even a modest Windows environment, the headline number isn’t the part that matters. What matters is knowing exactly which handful of these hundreds of fixes deserve your attention this week, and in what order. That’s what this breakdown is built to answer.
Quick Answer
Microsoft Patch Tuesday September 2026, released on September 8, fixed the largest single batch of vulnerabilities in the program’s history: reported between 964 and 999 depending on which tracker is counting. Two vulnerabilities, both Windows elevation-of-privilege bugs (CVE-2026-81963 and CVE-2026-85880), are already being exploited in the wild and were added to CISA’s Known Exploited Vulnerabilities catalog the same day. Neither one waits for a routine maintenance window. Patch domain controllers and identity infrastructure first, then work outward.
What Microsoft Patched in September 2026’s Patch Tuesday
Microsoft Patch Tuesday September 2026 landed on Tuesday, September 8, addressing vulnerabilities across nearly every major product line. Per Microsoft’s own Security Update Guide, the release breaks down as roughly 723 Windows vulnerabilities, 111 in Office, 62 in SQL Server, 22 in developer tools, 16 in SharePoint Server, and 9 in Exchange Server, alongside 25 republished non-Microsoft CVEs affecting third-party components.
Severity-wise, the release includes over 100 vulnerabilities rated Critical. Trackers report figures between 105 and 121 depending on methodology. Remote code execution (RCE) accounts for the largest share of those: some counts put RCE-capable flaws at over 250 across the full release. Microsoft also flagged roughly 58 vulnerabilities as “Exploitation More Likely,” a forward-looking risk signal distinct from confirmed active exploitation.
This is not an isolated spike. Microsoft’s monthly release volume has been climbing through 2026, with July and August each setting records that September has now dwarfed. Several researchers quoted in coverage of this release point to AI-assisted vulnerability discovery inside Microsoft’s own security teams as a driver.
More automated fuzzing and code analysis is turning up more bugs, but that doesn’t necessarily mean attackers have more usable ones. As one researcher quoted by SecurityWeek put it, the rising numbers reflect a bigger haystack, not more needles.
The Two Actively Exploited Zero-Days
The single most urgent fact buried inside this month’s Patch Tuesday: two vulnerabilities are confirmed under active exploitation, and both are elevation-of-privilege (EoP) bugs in core Windows components.
CVE-2026-81963, Windows Update Stack Elevation of Privilege. This flaw stems from improper link resolution before file access, a “link following” weakness, combined with improper access control in the Windows Update Stack. An attacker who already has some foothold on a system can exploit it to gain SYSTEM-level privileges. Microsoft credits Romain Deperne and its own Microsoft Threat Intelligence Center with the discovery. Microsoft hasn’t published details on how the flaw is being exploited in the wild, which is typical for a live, unresolved attack.
CVE-2026-85880, Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege. This is a heap-based buffer overflow tied to use of an uninitialized resource in ALPC, a core Windows inter-process communication mechanism. Microsoft’s advisory notes that an attacker who can already execute code inside a low-privilege AppContainer sandbox can use this bug to escape the sandbox and elevate to SYSTEM, with no additional user interaction required.
Both vulnerabilities carry a CVSS base score of 7.8 and are rated “Important” rather than “Critical.” That detail is worth flagging on its own: dashboards sorted purely by CVSS or severity label will bury both of these below dozens of higher-scored bugs that aren’t being exploited at all. Neither is a remote, unauthenticated “walk in the front door” vulnerability. Both require an attacker to already have some level of local access. But that’s exactly why they matter operationally. They’re the mechanism that turns a small foothold into full control.
Why the CVE Count Depends on Who’s Counting
If you’ve seen Microsoft Patch Tuesday September 2026 described as “966 flaws” in one place and “974” or even “999” in another, you haven’t stumbled onto conflicting reporting. You’re seeing different, equally defensible counting methods.
- BleepingComputer’s widely cited figure of 966 counts only vulnerabilities Microsoft released as part of Patch Tuesday itself, excluding roughly 204 additional flaws Microsoft had already patched earlier in September across Azure, Copilot Studio, Entra ID, Microsoft Edge, Fabric, and Power Automate.
- Microsoft’s own Security Update Guide lists 974 Microsoft-owned CVEs for the release.
- Zero Day Initiative counted 972 new CVEs in its review.
- Tenable reported 964.
- Action1’s analysis cited figures as high as 995 to 996, and at least one outlet arrived at 999 once Microsoft’s 25 republished non-Microsoft CVEs are added on top of the 974 Microsoft-owned total.
None of these numbers is wrong. They differ because trackers disagree on whether to include already-patched Azure and cloud-service CVEs, republished third-party CVEs, and CVEs without full severity data yet. For patch management purposes, the number that matters isn’t the headline total. It’s which specific CVEs in your own environment are exploited or “more likely” to be exploited, which the next few sections cover directly.
CISA’s KEV Catalog Addition and What BOD 26-04 Requires
On September 8, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both exploited Microsoft vulnerabilities, CVE-2026-81963 and CVE-2026-85880, to its Known Exploited Vulnerabilities (KEV) Catalog, alongside an actively exploited Adobe Commerce flaw and an N-able N-central vulnerability from the same batch.
The KEV Catalog exists specifically to flag vulnerabilities with confirmed real-world exploitation, and its additions carry direct legal weight for U.S. federal agencies under Binding Operational Directive 26-04 (BOD 26-04), which requires Federal Civilian Executive Branch agencies to remediate cataloged vulnerabilities on publicly exposed, high-risk assets within a defined window. BOD 26-04 doesn’t legally bind private organizations.
Still, CISA explicitly encourages every organization to treat KEV additions as a prioritization signal regardless of sector. If CISA’s own analysts consider a CVE important enough for a federal deadline, it belongs at the top of your patch queue too, not in next month’s maintenance window.
The Wormable Vulnerabilities You Can’t Deprioritize
Beyond the two confirmed zero-days, security researchers flagged roughly 20 vulnerabilities in this release as potentially “wormable,” meaning a remote, unauthenticated attacker could achieve code execution with no user interaction. It’s the same category of flaw behind self-propagating outbreaks in years past.
According to Zero Day Initiative’s Dustin Childs, this month’s wormable cluster spans Windows DNS Server, DHCP Server, Routing and Remote Access Service (RRAS), Message Queuing, Failover Cluster, Netlogon, Active Directory Domain Services, SSTP, NFS, SMB Client, IP Helper, Internet Connection Sharing, and Reliable Multicast. DHCP Server alone accounts for 36 CVEs in this release, twelve of which are RCE-capable.
The standout in this group is CVE-2026-69730, a CVSS 9.8 Windows DNS Server RCE that Childs described as reminiscent of the notorious SigRed DNS vulnerability: a zero-click bug on infrastructure that, by design, sits reachable across most enterprise networks. Microsoft has flagged it as “Exploitation More Likely.” That means it hasn’t been confirmed exploited yet, but the company’s own telemetry suggests it’s a strong candidate to be weaponized soon.
Domain Controllers First: A Prioritized Patch Order
Reading across this month’s advisories, a clear pattern emerges. The highest-consequence vulnerabilities cluster around identity infrastructure. If you can only patch in a defined order this week, this is the sequence security researchers covering the release converge on:
- Domain controllers. CVE-2026-69730 (DNS Server, wormable), CVE-2026-69676 (Kerberos, CVSS 8.8, flagged “More Likely” to be exploited), and CVE-2026-72982 (Netlogon) all concentrate risk here. A compromised domain controller compromises the whole domain.
- Identity and remote-access infrastructure. CVE-2026-69525 (Remote Desktop Services RCE, CVSS 9.8, use-after-free, exploitable by an unauthenticated in-network attacker). Prioritize any RDP gateway or jump host reachable from a network you don’t fully trust.
- The two confirmed zero-days (CVE-2026-81963, CVE-2026-85880). Deploy to endpoints broadly, starting with administrator workstations and systems that hold access to sensitive resources.
- Internet-facing and network-reachable services. DHCP Server, HTTP Print Provider, Internet Connection Sharing, and NFS roles wherever they’re enabled.
- Everything else, following your normal patch cadence.
CVE-2026-69676’s Kerberos flaw deserves a specific callout. Tenable describes it as a capture-replay authentication bypass leading to code execution. On a domain controller, a Kerberos bug Microsoft expects to see exploited is an emergency regardless of its CVSS score.
On-premises Exchange Server administrators have two vulnerabilities to weigh this month. CVE-2026-55007 (CVSS 8.1) is an RCE that, per ZDI’s analysis, can be triggered simply by an Exchange server processing an inbound email containing a malicious Visio attachment. No user needs to open anything for the code execution to occur. Separately, CVE-2026-69380 (CVSS 8.1) is an elevation-of-privilege flaw that ZDI’s Childs warns could let a low-privileged attacker impersonate any user and access every mailbox in the organization.
SharePoint Server also receives an RCE fix this month (CVE-2026-69282), continuing a pattern of recurring SharePoint vulnerabilities that CyberInfos has tracked across prior Patch Tuesday cycles. Any organization still running on-premises Exchange or SharePoint should treat both product lines as priority patch targets this month, independent of the Windows-focused headline vulnerabilities.
Critical RCEs Worth Knowing by Name
A handful of this month’s Critical-rated RCEs stand out because they require no authentication and no user interaction. That combination is what makes a vulnerability genuinely dangerous at internet or network scale, rather than merely high-scoring on paper:
| CVE | Component | CVSS | Why it matters |
|---|---|---|---|
| CVE-2026-69730 | Windows DNS Server | 9.8 | Wormable, zero-click, “More Likely” exploited |
| CVE-2026-72983 | Windows Internet Connection Sharing | 9.8 | Unauthenticated, network-reachable |
| CVE-2026-73010 | Microsoft Failover Cluster | 9.8 | Impacts high-availability infrastructure |
| CVE-2026-72979 / CVE-2026-69845 | Windows DHCP Server | 9.8 | Two separate RCE paths in the same service |
| CVE-2026-69769 | Windows HTTP Print Provider | 9.8 | Legacy service, often overlooked in patch triage |
| CVE-2026-69829 | Windows Shell | 9.8 | Broad attack surface across desktop endpoints |
| CVE-2026-69595 | Windows Services for NFS ONCRPC XDR Driver | 9.8 | Relevant to mixed Windows/Unix environments |
| CVE-2026-78510 | Microsoft Word | 9.8 | Document-based attack vector |
If your organization uses any of the affected services, and most enterprise Windows environments use several, these belong ahead of routine patches in this cycle’s rollout plan.
Same Day, Different Vendor: Adobe’s Own Exploited Zero-Day
Patch Tuesday isn’t a Microsoft-only event. Adobe coordinates its own monthly release to the same date, and this September was no exception, nor was it quiet. Adobe shipped roughly ten security bulletins covering around 172 CVEs, split mainly between Adobe Experience Manager and Acrobat/Reader.
The one that matters most: CVE-2026-75650, a CVSS 10.0 template-injection vulnerability in Adobe Commerce and Magento Open Source. Security firm Sansec identified active exploitation dating back to September 4, several days before the public patch, in a campaign researchers have named “StyleSmuggler,” which attackers used to deploy a Rust-based backdoor and PHP web shells on compromised e-commerce sites.
CISA added this CVE to its KEV Catalog the same day as the two Microsoft zero-days. Any organization running Adobe Commerce or Magento should treat this as at least as urgent as the Windows fixes above.
CyberInfos Analyst Insight
The following is CyberInfos analysis, not a new factual claim.
The most common mistake we see security teams make during a Patch Tuesday of this size isn’t skipping patches. It’s triaging by CVSS score alone. This month is a clear example of why that approach fails: both confirmed zero-days sit at a CVSS of 7.8, “Important” severity, comfortably below dozens of 9.8-rated bugs that aren’t being exploited at all. A dashboard sorted purely by score will show those higher-rated, unexploited CVEs first and bury the two flaws attackers are actually using.
The better model is exploitation status first, blast radius second, CVSS third. Confirmed exploited and KEV-listed CVEs jump the queue regardless of score. Identity infrastructure (domain controllers, Kerberos, Netlogon) gets prioritized ahead of endpoint-only bugs because a single compromised domain controller has organization-wide blast radius. Everything else follows normal severity-based triage. Teams that rebuild their triage process around this hierarchy, rather than around CVSS sort order, consistently spend their limited patch-window hours on the vulnerabilities that actually reduce risk.
By the Numbers: September 2026 in Context
- 964 to 999, reported total vulnerabilities fixed, depending on tracker methodology.
- 2, confirmed actively exploited zero-days, both Windows elevation-of-privilege bugs.
- ~20, vulnerabilities classified as potentially wormable.
- 36, CVEs affecting DHCP Server alone, 12 of them RCE-capable.
- 58, vulnerabilities Microsoft flagged as “Exploitation More Likely” but not yet confirmed exploited.
- 7.8, CVSS score shared by both confirmed zero-days, a reminder that severity score and real-world urgency don’t always move together.
Each figure above traces to Microsoft’s own Security Update Guide, CISA’s KEV Catalog entries, or named researcher analysis (Zero Day Initiative, Action1) published alongside the September 8, 2026 release. No figure here is estimated or generalized from prior months.
What This Means If You’re Not Running an Enterprise SOC
If you manage a home network or a small business without a dedicated IT team, the operational advice above still boils down to one action: turn on automatic Windows updates if they aren’t already, and don’t defer this month’s update past a normal restart cycle. The two confirmed zero-days require an attacker to already have some form of access to your device. They’re not “browse to a website and get infected” bugs, which means normal safe-browsing and phishing-awareness habits remain your first line of defense, with this patch closing the door behind them.
Actionable Checklist
- Confirm domain controllers are patched first: DNS Server (CVE-2026-69730), Kerberos (CVE-2026-69676), Netlogon (CVE-2026-72982)
- Patch both confirmed zero-days (CVE-2026-81963, CVE-2026-85880) across all Windows endpoints, prioritizing admin workstations
- Check RDP-reachable systems for CVE-2026-69525 exposure and patch or restrict access immediately
- Apply Exchange Server updates for CVE-2026-55007 and CVE-2026-69380 if running on-premises Exchange
- Patch SharePoint Server for CVE-2026-69282 if applicable
- Review DHCP, DNS, RRAS, and NFS role exposure against the wormable-CVE list
- If running Adobe Commerce/Magento, patch CVE-2026-75650 with the same urgency as the Windows zero-days
- Cross-reference your asset inventory against CISA’s KEV Catalog entries for this release
- Document remediation timelines against BOD 26-04 if your organization has any federal contracting obligations
- Re-verify patch deployment via endpoint management tooling rather than assuming push success
FAQ
What is Patch Tuesday and why does it matter?
Patch Tuesday is Microsoft’s monthly, scheduled release of security updates, delivered on the second Tuesday of each month. It matters because it’s the primary channel through which known Windows and Microsoft-product vulnerabilities get fixed. Delaying these updates leaves systems open to publicly known attack methods.
How many vulnerabilities did Microsoft Patch Tuesday September 2026 fix?
Reported totals range from 964 to 999 depending on the tracker, because sources differ on whether they count already-patched cloud-service CVEs and republished third-party CVEs alongside Microsoft’s own release-day total.
Which Microsoft vulnerabilities are being actively exploited right now?
Two: CVE-2026-81963 (Windows Update Stack elevation of privilege) and CVE-2026-85880 (Windows ALPC elevation of privilege). Both are confirmed exploited and listed on CISA’s KEV Catalog.
Are the September 2026 zero-days rated Critical?
No. Both carry a CVSS score of 7.8 and are rated “Important.” Their urgency comes from confirmed active exploitation, not their severity score.
What is CVE-2026-81963?
An elevation-of-privilege vulnerability in the Windows Update Stack caused by improper link resolution before file access, allowing an attacker with existing local access to reach SYSTEM privileges.
What is CVE-2026-85880?
A heap-based buffer overflow in Windows ALPC that lets an attacker already running low-privilege code escape an AppContainer sandbox and elevate to SYSTEM privileges.
Which Patch Tuesday CVEs are wormable?
Researchers identified roughly 20 vulnerabilities across DNS Server, DHCP Server, RRAS, Message Queuing, Failover Cluster, Netlogon, Active Directory Domain Services, SSTP, NFS, SMB Client, IP Helper, and Internet Connection Sharing as capable of unauthenticated, no-interaction remote code execution.
Should I patch domain controllers first?
Yes. Multiple high-severity vulnerabilities this month concentrate on domain-controller-adjacent services (DNS, Kerberos, Netlogon), and a compromised domain controller compromises the entire domain.
Is Exchange Server affected by the September 2026 update?
Yes. CVE-2026-55007 (RCE via a malicious email attachment) and CVE-2026-69380 (mailbox-impersonation elevation of privilege) both affect on-premises Exchange Server.
What does CISA’s KEV catalog addition mean for my organization?
It confirms real-world exploitation and, for U.S. federal agencies, triggers a mandatory remediation deadline under BOD 26-04. For other organizations, it’s a strong signal that a CVE deserves immediate, not routine, patching.
Why do different outlets report different CVE totals for the same release?
Trackers vary in whether they count previously patched cloud-service CVEs, republished non-Microsoft CVEs, and CVEs without complete severity data, producing different but individually accurate totals.
Is Adobe affected by a similar issue this month?
Yes. Adobe’s own coordinated Patch Tuesday release included CVE-2026-75650, a maximum-severity (CVSS 10.0) Adobe Commerce/Magento flaw already under active exploitation before the patch shipped.
When is the next Patch Tuesday?
Microsoft’s next scheduled release is October 13, 2026.
Final Thoughts
The scale of Microsoft Patch Tuesday September 2026 makes the headline number almost meaningless on its own. Whether the true count is 964 or 999 changes nothing about what you actually need to do this week. What matters is the short list underneath the total: two confirmed zero-days already on CISA’s KEV Catalog, a cluster of roughly 20 wormable flaws concentrated in network-facing Windows services, and a set of identity-infrastructure vulnerabilities that deserve to jump any CVSS-sorted queue.
Patch domain controllers first, close the two confirmed zero-days across endpoints next, and work outward from there. And if your stack includes Adobe Commerce or Magento, don’t let the Windows headlines crowd out an equally urgent fix on that side.
CyberInfos will track how this release evolves, including any updates to the disputed CVE count and Microsoft’s October follow-up, in our ongoing Patch Tuesday coverage. Subscribe to our newsletter for the next breakdown as soon as it lands.
