September 2026 Microsoft Patch Tuesday — Record 966+ Vulnerabilities with Two Actively Exploited Zero-Days (CVE-2026-81963, CVE-2026-85880) and Multiple Critical Wormable RCEs

September 2026 Microsoft Patch Tuesday (TL-2026-2398), also tracked as September 2026 Patch Tuesday, is a critical-severity software vulnerability scored CVSS 10, first published 2026-09-08. It has no confirmed attribution, affects Microsoft Windows 11, references 49 CVEs (CVE-2026-81963, CVE-2026-85880, CVE-2026-66302), maps to 34 MITRE ATT&CK techniques (T1003, T1005, T1018), and is covered by 9 detection rules and 48 indicators of compromise.

Key facts for TL-2026-2398

Threat ID
TL-2026-2398
Also known as
September 2026 Patch Tuesday, Patch Apocalypse September 2026, Windows Patch Tuesday September 2026
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-08
Last reviewed
2026-09-08
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, education, critical-infrastructure
Target regions
North America, Europe, Asia-Pacific, Middle East, Latin America
Detection rules
9
Indicators of compromise
48
Updates
2026-09-08 · 4 updates · revalidated 4× · latest source

Microsoft released its largest security update ever on September 8, 2026, addressing a record 966+ CVEs (105 Critical) across Windows, Office, SQL Server, Exchange, SharePoint, Azure, and other products. Two elevation-of-privilege zero-days are under active exploitation: CVE-2026-81963 (Windows Update Stack link-following EoP, CVSS 7.8) and CVE-2026-85880 (Windows ALPC heap-based buffer overflow, CVSS 7.8, enabling AppContainer sandbox escape to SYSTEM). Twenty wormable remote-code-execution vulnerabilities were also disclosed, including CVE-2026-69579 (MSMQ use-after-free via TCP 1801, CVSS 9.8), CVE-2026-69590 (RRAS heap overflow, CVSS 9.8), and CVE-2026-66302 (Skype for Business Server path traversal, CVSS 9.8). The record-breaking volume is attributed to Microsoft's MDASH AI-powered vulnerability discovery system.

How September 2026 Microsoft Patch Tuesday works

Microsoft's September 2026 Patch Tuesday (released September 8, 2026) shattered all previous records with approximately 966-974 unique CVEs (depending on counting methodology), surpassing the July 2026 record of 1,150 CVEs and the pre-2026 monthly average of ~383 CVEs. Of these, 105 were rated Critical (81 Remote Code Execution, 20 Elevation of Privilege, 2 Information Disclosure, 1 Security Feature Bypass), with the remainder rated Important. The total vulnerability breakdown by impact type was: 438 Elevation of Privilege, 258 Remote Code Execution, 173 Information Disclosure, 56 Denial of Service, 19 Security Feature Bypass, and 16 Spoofing.

Two zero-day vulnerabilities were confirmed under active exploitation at the time of patching. CVE-2026-81963 is a 'link following' vulnerability (CWE-59, CWE-284) in the Windows Update Stack that allows a local authenticated attacker to elevate privileges to SYSTEM. The flaw affects Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025. It was discovered and reported by Romain Deperne in collaboration with the Microsoft Threat Intelligence Centre (MSTIC). Per the Zero Day Initiative, the bug is likely being combined with a separate code-execution vulnerability to propagate malware or ransomware, though Microsoft has not shared specific exploitation details. CVE-2026-85880 is a heap-based buffer overflow (CWE-122, CWE-908) in the Windows Advanced Local Procedure Call (ALPC) component, enabling an attacker with low-privilege AppContainer access to escape the sandbox and achieve SYSTEM-level code execution with no user interaction required. This flaw affects Windows 10 (1607 through 22H2) and Windows Server 2012 through 2022. It was discovered and reported by Volexity and by Mark Kelly, David Galazin, and Jeremy Hedges of Proofpoint. This is the first ALPC zero-day patched since CVE-2023-21674 in January 2023, and the first ALPC patch of any kind since April 2023. Both CVEs were added to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 8, 2026, with a remediation deadline of September 22, 2026 per BOD 26-04.

Three additional critical unauthenticated RCE vulnerabilities were highlighted due to their wormable characteristics and CVSS 9.8 scores. CVE-2026-69579 is a use-after-free (CWE-416) in the Windows Message Queuing (MSMQ) Queue Manager service (mqsvc.exe), reachable over TCP port 1801 by an unauthenticated network attacker with no user interaction required. CVE-2026-69590 is a heap-based buffer overflow (CWE-122) in the Windows Routing and Remote Access Service (RRAS) with the same remote, unauthenticated, no-interaction profile. Both affect Windows 10/11 across all versions and Windows Server 2012 through 2025. CVE-2026-66302 is an external control of file name or path vulnerability (CWE-73) in Skype for Business Server (2015 CU13, 2019 CU8, Subscription Edition CU1) that allows an unauthenticated attacker to execute code over the network. None of these three were publicly disclosed or exploited at the time of release.

In total, the ZDI identified 20 wormable patches in this release — remote, unauthenticated RCE vulnerabilities requiring no user interaction — spanning Windows DNS Server (CVE-2026-69730, described as 'SigRed's spiritual successor'), DHCP Server (CVE-2026-69510, CVE-2026-72979), Active Directory Domain Services (CVE-2026-69524), Windows Netlogon (CVE-2026-72982), SSTP (CVE-2026-73009), Internet Connection Sharing (CVE-2026-72983), Services for NFS ONCRPC XDR Driver (CVE-2026-69595, CVE-2026-78445), IP Helper (CVE-2026-72981), RMCAST (CVE-2026-69530, CVE-2026-78449, CVE-2026-78450), SMB Client (CVE-2026-72936), Failover Cluster (CVE-2026-73010, CVE-2026-78444), and additional DNS (CVE-2026-72987, CVE-2026-69858) and MSMQ (CVE-2026-83997) flaws.

The record-breaking volume is directly attributed to Microsoft's MDASH (Multi-Model Agentic Scanning Harness) system, announced May 12, 2026, which orchestrates over 100 specialized AI agents across frontier and distilled models using a Prepare→Scan→Validate (multi-model debate)→Dedupe→Prove pipeline. MDASH achieved 96% recall against 5 years of MSRC cases in clfs.sys and 100% in tcpip.sys, scoring 88.45% on the public CyberGym benchmark. Microsoft warned customers on July 9, 2026, that AI-powered discovery would drive higher patch volumes going forward. The product breakdown demonstrates the breadth of the release: Windows (723 CVEs), Office/Office 2016 (222/111 CVEs), SQL Server (62 CVEs), Developer Tools (22 CVEs), SharePoint Server (16 CVEs), Azure (12 CVEs), Skype for Business (10 CVEs), and Exchange Server (9 CVEs). Critical patches also impacted Hyper-V, Credential Guard, Secure Kernel Mode, Windows Hello, BitLocker, and other security subsystems.

The implications for defenders are severe. The two actively exploited zero-days require immediate patching — particularly CVE-2026-85880 which enables AppContainer sandbox escape, bypassing a fundamental isolation boundary in modern Windows security architecture. The 20 wormable RCE vulnerabilities mean that unpatched systems on internal networks face cascading compromise risk. Security commentators including Satnam Narang (Tenable) observed that 'AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn't finding more needles,' while Tyler Reguly (Fortra) characterized the high volume as proactive attack-surface reduction. Regardless of the long-term outlook, this Patch Tuesday represents an urgent, broad-surface remediation priority that stretches organizational patch capacity to its limits.

MITRE ATT&CK techniques used in TL-2026-2398

Credential Access

T1003 OS Credential Dumping; T1040 Network Sniffing; T1558 Steal or Forge Kerberos Tickets

Collection

T1005 Data from Local System; T1114 Email Collection

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1082 System Information Discovery

Lateral Movement

T1021 Remote Services; T1210 Exploitation of Remote Services; T1550 Use Alternate Authentication Material

Exfiltration

T1041 Exfiltration Over C2 Channel

Defense Evasion

T1055 Process Injection; T1556 Modify Authentication Process; T1562 Impair Defenses; T1574 Hijack Execution Flow

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution; T1204 User Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing; T1566 Phishing: Spearphishing Link

Impact

T1485 Data Destruction; T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery

Persistence

T1505 Server Software Component; T1547 Boot or Logon Autostart Execution

stealth

T1574 Hijack Execution Flow

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in September 2026 Microsoft Patch Tuesday

  • Microsoft — Windows 11
    Vulnerable versions: 23H2 (<10.0.22631.7582); 24H2 (<10.0.26100.9445); 25H2 (<10.0.26200.9445); 26H1 (<10.0.28000.2954)
    Fixed in: 23H2 (≥10.0.22631.7582); 24H2 (≥10.0.26100.9445); 25H2 (≥10.0.26200.9445); 26H1 (≥10.0.28000.2954)
  • Microsoft — Windows 10
    Vulnerable versions: 1607 (<10.0.14393.9512); 1809 (<10.0.17763.9245); 21H2 (<10.0.19044.7725); 22H2 (<10.0.19045.7725)
    Fixed in: 1607 (≥10.0.14393.9512); 1809 (≥10.0.17763.9245); 21H2 (≥10.0.19044.7725); 22H2 (≥10.0.19045.7725)
  • Microsoft — Windows Server
    Vulnerable versions: 2012 (<6.2.9200.26349); 2012 R2 (<6.3.9600.23397); 2016 (<10.0.14393.9512); 2019 (<10.0.17763.9245); 2022 (<10.0.20348.5622); 2025 (<10.0.26100.33438)
    Fixed in: 2012 (≥6.2.9200.26349); 2012 R2 (≥6.3.9600.23397); 2016 (≥10.0.14393.9512); 2019 (≥10.0.17763.9245); 2022 (≥10.0.20348.5622); 2025 (≥10.0.26100.33438)
  • Microsoft — Skype for Business Server
    Vulnerable versions: 2015 CU13 (<6.0.9319.885); 2019 CU8 (<7.0.2046.569); Subscription Edition CU1 (<7.0.2046.879)
    Fixed in: 2015 CU13 (≥6.0.9319.885); 2019 CU8 (≥7.0.2046.569); Subscription Edition CU1 (≥7.0.2046.879)
  • Microsoft — Microsoft Office
    Vulnerable versions: Office 2016; Office 2019; Office 2021; Office 2024; Microsoft 365 Apps
    Fixed in: Apply September 2026 Office updates
  • Microsoft — Microsoft Exchange Server
    Vulnerable versions: Exchange Server 2016; Exchange Server 2019
    Fixed in: Exchange Server September 2026 Security Update (CVE-2026-55007 and 8 others)
  • Microsoft — SQL Server
    Vulnerable versions: SQL Server 2016; SQL Server 2017; SQL Server 2019; SQL Server 2022
    Fixed in: September 2026 SQL Server Security Updates (62 CVEs)
  • Microsoft — SharePoint Server
    Vulnerable versions: SharePoint Server 2016; SharePoint Server 2019; SharePoint Server Subscription Edition
    Fixed in: September 2026 SharePoint Security Updates (16 CVEs including CVE-2026-69465)

Remediation for September 2026 Microsoft Patch Tuesday

Patches

  • September 2026 Cumulative Update for Windows 11 (23H2: ≥10.0.22631.7582, 24H2: ≥10.0.26100.9445, 25H2: ≥10.0.26200.9445, 26H1: ≥10.0.28000.2954)
  • September 2026 Cumulative Update for Windows 10 (1607: ≥10.0.14393.9512, 1809: ≥10.0.17763.9245, 21H2: ≥10.0.19044.7725, 22H2: ≥10.0.19045.7725)
  • September 2026 Cumulative Update for Windows Server (2012: ≥6.2.9200.26349, 2012 R2: ≥6.3.9600.23397, 2016: ≥10.0.14393.9512, 2019: ≥10.0.17763.9245, 2022: ≥10.0.20348.5622, 2025: ≥10.0.26100.33438)
  • Skype for Business Server 2015 CU13 (≥6.0.9319.885), 2019 CU8 (≥7.0.2046.569), Subscription Edition CU1 (≥7.0.2046.879)
  • Exchange Server security updates addressing CVE-2026-55007 and 8 additional CVEs

Immediate actions

  • Apply September 2026 Cumulative Updates across all Windows, Server, and Office products immediately
  • Prioritize CVE-2026-81963 and CVE-2026-85880 — both are actively exploited zero-days with CISA KEV remediation deadline of 2026-09-22
  • Block inbound TCP 1801 at perimeter and internal firewalls if MSMQ is not business-critical (mitigates CVE-2026-69579)
  • Restrict inbound access to RRAS services on Server SKUs (mitigates CVE-2026-69590 and related CVEs)

Workarounds

  • Disable MSMQ service (Message Queuing) via Windows Features if not required by applications
  • Block inbound TCP 1801, UDP 1801, TCP 135, and TCP 445 at perimeter firewalls where possible
  • Restrict RRAS service to only authorized administrative networks
  • Disable Skype for Business Server if not in active use, or restrict network access to trusted IP ranges

Longer-term hardening

  • Implement risk-based patch prioritization to handle AI-scale vulnerability disclosure volumes (now the 'new normal')
  • Deploy network segmentation and micro-segmentation to limit wormable RCE blast radius
  • Enable AppContainer-aware EDR and behavioral detection rules for sandbox-escape monitoring
  • Adopt Zero Trust Network Access (ZTNA) to reduce exposure of internal services like DNS, DHCP, MSMQ, and RRAS
  • Maintain asset inventory with Windows build-version precision to rapidly identify vulnerable systems

CVEs associated with September 2026 Microsoft Patch Tuesday

  • CVE-2026-81963
  • CVE-2026-85880
  • CVE-2026-66302
  • CVE-2026-69579
  • CVE-2026-69590
  • CVE-2026-55007
  • CVE-2026-80097
  • CVE-2026-69465
  • CVE-2026-65669
  • CVE-2026-69525
  • CVE-2026-69730
  • CVE-2026-72986
  • CVE-2026-72981
  • CVE-2026-69601
  • CVE-2026-69857
  • CVE-2026-70352
  • CVE-2026-78509
  • CVE-2026-81949
  • CVE-2026-83711
  • CVE-2026-69854
  • CVE-2026-69676
  • CVE-2026-69852
  • CVE-2026-72957
  • CVE-2026-69845
  • CVE-2026-72979
  • CVE-2026-70296
  • CVE-2026-73009
  • CVE-2026-73010
  • CVE-2026-77493
  • CVE-2026-78510
  • CVE-2026-69769
  • CVE-2026-69829
  • CVE-2026-72982
  • CVE-2026-72983
  • CVE-2026-62916
  • CVE-2026-83941
  • CVE-2026-80098
  • CVE-2026-70178
  • CVE-2026-70585
  • CVE-2026-83501
  • CVE-2026-69510
  • CVE-2026-69524
  • CVE-2026-83997
  • CVE-2026-69595
  • CVE-2026-69858
  • CVE-2026-72936
  • CVE-2026-72987
  • CVE-2026-78444
  • CVE-2026-78330

Weaknesses (CWE) in September 2026 Microsoft Patch Tuesday

CWE-59, CWE-284, CWE-122, CWE-908, CWE-73, CWE-416, CWE-415, CWE-74, CWE-862, CWE-287

Timeline of September 2026 Microsoft Patch Tuesday

Showing the 20 most recent tracked events.

  • Microsoft announces MDASH (Multi-Model Agentic Scanning Harness), an AI-powered vulnerability discovery system using 100+ specialized agents, achieving 96% recall on historical vulnerabilities
  • Microsoft publicly warns customers that AI-powered vulnerability discovery will drive significantly higher patch volumes in upcoming security releases
  • July 2026 Patch Tuesday sets previous record of 1,150 CVEs, validating Microsoft's warning about AI-driven discovery volumes
  • CVE-2026-69465 (SharePoint Server RCE) reserved by Microsoft.
  • Microsoft's August 2026 Patch Tuesday fixed 457 CVEs, a then-record signaling the accelerating pace of AI-assisted vulnerability discovery.
  • CVE-2026-80097 (Microsoft Authenticator EoP) reserved by Microsoft.
  • Microsoft publishes advance notification disclosing two maximum-severity CVSS 10.0 Azure flaws: CVE-2026-83711 (Azure AD B2C authorization bypass) and a reassessed CVE-2026-70352 (Azure AI Language missing authentication); both mitigated server-side with no customer action required.
  • CVE-2026-85880 (Windows ALPC EoP) reserved by Microsoft, later confirmed exploited in the wild by Volexity and Proofpoint researchers.
  • Adobe releases out-of-band patch for Commerce CVE-2026-75650 (CVSS 10.0, template-engine injection exploited in the wild) — APSB26-146
  • September's disclosure brings the 2026 year-to-date vulnerability total past 2,600 — more than double the previous record year, 2020 — with multiple security vendors attributing the surge to AI-assisted vulnerability discovery.
  • Researchers characterize CVE-2026-81963 (Windows Update Stack EoP) as the typical first step in a ransomware chain: phishing delivers initial access, then the EoP escalates to SYSTEM, enabling lateral movement and ransomware deployment. Automox's Serena DiPenti warns that compromising the Update Stack lets an attacker subvert the very mechanism defenders would use to patch or evict them.
  • Talos releases Snort 2 (SIDs 67011-67032, 67036-67084) and Snort 3 (SIDs 301619-301629, 301632-301655) detection rules covering exploitation attempts against this Patch Tuesday's disclosed vulnerabilities.
  • Microsoft Office Outlook (CVE-2026-78509) and Word (CVE-2026-78510) heap-based buffer overflow RCEs disclosed, both exploitable without authentication or user interaction over the network.
  • Additional cloud service vulnerabilities disclosed: Microsoft Entra ID EoP (CVE-2026-62916, CVE-2026-83941), Copilot Studio cryptographic signature bypass (CVE-2026-80098), Power Automate SSRF (CVE-2026-65818), and Microsoft Fabric missing authorization (CVE-2026-70178).
  • Talos Intelligence publishes its own September 2026 Patch Tuesday analysis, independently confirming the two actively-exploited zero-days and flagging CVE-2026-69730, CVE-2026-69854, and CVE-2026-69676 as 'more likely' to be exploited per CISA SSVC.
  • Service-side updates released for Azure AI Language (CVE-2026-70352) and Azure Cosmos DB (CVE-2026-69857); no customer action required.
  • Zero Day Initiative publishes September 2026 Security Update Review identifying 20 wormable patches and providing deployment priority guidance
  • CISA adds CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (Windows ALPC EoP) to Known Exploited Vulnerabilities catalog
  • Microsoft releases September 2026 Patch Tuesday addressing a record 966+ CVEs (105 Critical, 2 actively exploited zero-days, 20 wormable RCEs)
  • CISA BOD 26-04 remediation deadline for CVE-2026-81963 and CVE-2026-85880 — federal agencies must patch by this date

Update history for TL-2026-2398

Sources cited for September 2026 Microsoft Patch Tuesday

More in vulnerability

Detection coverage for TL-2026-2398

As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2398 across Splunk SPL, Microsoft KQL and Sigma, covering 48 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats