# September 2026 Microsoft Patch Tuesday — Record 966+ Vulnerabilities with Two Actively Exploited Zero-Days (CVE-2026-81963, CVE-2026-85880) and Multiple Critical Wormable RCEs

> Microsoft released its largest security update ever on September 8, 2026, addressing a record 966+ CVEs (105 Critical) across Windows, Office, SQL Server, Exchange, SharePoint, Azure, and other products. Two elevation-of-privilege zero-days are under active exploitation: CVE-2026-81963 (Windows Update Stack link-following EoP, CVSS 7.8) and CVE-2026-85880 (Windows ALPC heap-based buffer overflow, CVSS 7.8, enabling AppContainer sandbox escape to SYSTEM). Twenty wormable remote-code-execution vulnerabilities were also disclosed, including CVE-2026-69579 (MSMQ use-after-free via TCP 1801, CVSS 9.8), CVE-2026-69590 (RRAS heap overflow, CVSS 9.8), and CVE-2026-66302 (Skype for Business Server path traversal, CVSS 9.8). The record-breaking volume is attributed to Microsoft's MDASH AI-powered vulnerability discovery system.

- **Published:** 2026-09-08T00:00:00Z
- **Last reviewed:** 2026-09-08T23:16:44.007Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2398
- **ID:** TL-2026-2398
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 48 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-81963, CVE-2026-85880, CVE-2026-66302, CVE-2026-69579, CVE-2026-69590, CVE-2026-55007, CVE-2026-80097, CVE-2026-69465, CVE-2026-65669, CVE-2026-69525, CVE-2026-69730, CVE-2026-72986, CVE-2026-72981, CVE-2026-69601, CVE-2026-69857, CVE-2026-70352, CVE-2026-78509, CVE-2026-81949, CVE-2026-83711, CVE-2026-69854, CVE-2026-69676, CVE-2026-69852, CVE-2026-72957, CVE-2026-69845, CVE-2026-72979, CVE-2026-70296, CVE-2026-73009, CVE-2026-73010, CVE-2026-77493, CVE-2026-78510, CVE-2026-69769, CVE-2026-69829, CVE-2026-72982, CVE-2026-72983, CVE-2026-62916, CVE-2026-83941, CVE-2026-80098, CVE-2026-70178, CVE-2026-70585, CVE-2026-83501, CVE-2026-69510, CVE-2026-69524, CVE-2026-83997, CVE-2026-69595, CVE-2026-69858, CVE-2026-72936, CVE-2026-72987, CVE-2026-78444, CVE-2026-78330

## Description

Microsoft's September 2026 Patch Tuesday (released September 8, 2026) shattered all previous records with approximately 966-974 unique CVEs (depending on counting methodology), surpassing the July 2026 record of 1,150 CVEs and the pre-2026 monthly average of ~383 CVEs. Of these, 105 were rated Critical (81 Remote Code Execution, 20 Elevation of Privilege, 2 Information Disclosure, 1 Security Feature Bypass), with the remainder rated Important. The total vulnerability breakdown by impact type was: 438 Elevation of Privilege, 258 Remote Code Execution, 173 Information Disclosure, 56 Denial of Service, 19 Security Feature Bypass, and 16 Spoofing.

Two zero-day vulnerabilities were confirmed under active exploitation at the time of patching. CVE-2026-81963 is a 'link following' vulnerability (CWE-59, CWE-284) in the Windows Update Stack that allows a local authenticated attacker to elevate privileges to SYSTEM. The flaw affects Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025. It was discovered and reported by Romain Deperne in collaboration with the Microsoft Threat Intelligence Centre (MSTIC). Per the Zero Day Initiative, the bug is likely being combined with a separate code-execution vulnerability to propagate malware or ransomware, though Microsoft has not shared specific exploitation details. CVE-2026-85880 is a heap-based buffer overflow (CWE-122, CWE-908) in the Windows Advanced Local Procedure Call (ALPC) component, enabling an attacker with low-privilege AppContainer access to escape the sandbox and achieve SYSTEM-level code execution with no user interaction required. This flaw affects Windows 10 (1607 through 22H2) and Windows Server 2012 through 2022. It was discovered and reported by Volexity and by Mark Kelly, David Galazin, and Jeremy Hedges of Proofpoint. This is the first ALPC zero-day patched since CVE-2023-21674 in January 2023, and the first ALPC patch of any kind since April 2023. Both CVEs were added to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 8, 2026, with a remediation deadline of September 22, 2026 per BOD 26-04.

Three additional critical unauthenticated RCE vulnerabilities were highlighted due to their wormable characteristics and CVSS 9.8 scores. CVE-2026-69579 is a use-after-free (CWE-416) in the Windows Message Queuing (MSMQ) Queue Manager service (mqsvc.exe), reachable over TCP port 1801 by an unauthenticated network attacker with no user interaction required. CVE-2026-69590 is a heap-based buffer overflow (CWE-122) in the Windows Routing and Remote Access Service (RRAS) with the same remote, unauthenticated, no-interaction profile. Both affect Windows 10/11 across all versions and Windows Server 2012 through 2025. CVE-2026-66302 is an external control of file name or path vulnerability (CWE-73) in Skype for Business Server (2015 CU13, 2019 CU8, Subscription Edition CU1) that allows an unauthenticated attacker to execute code over the network. None of these three were publicly disclosed or exploited at the time of release.

In total, the ZDI identified 20 wormable patches in this release — remote, unauthenticated RCE vulnerabilities requiring no user interaction — spanning Windows DNS Server (CVE-2026-69730, described as 'SigRed's spiritual successor'), DHCP Server (CVE-2026-69510, CVE-2026-72979), Active Directory Domain Services (CVE-2026-69524), Windows Netlogon (CVE-2026-72982), SSTP (CVE-2026-73009), Internet Connection Sharing (CVE-2026-72983), Services for NFS ONCRPC XDR Driver (CVE-2026-69595, CVE-2026-78445), IP Helper (CVE-2026-72981), RMCAST (CVE-2026-69530, CVE-2026-78449, CVE-2026-78450), SMB Client (CVE-2026-72936), Failover Cluster (CVE-2026-73010, CVE-2026-78444), and additional DNS (CVE-2026-72987, CVE-2026-69858) and MSMQ (CVE-2026-83997) flaws.

The record-breaking volume is directly attributed to Microsoft's MDASH (Multi-Model Agentic Scanning Harness) system, announced May 12, 2026, which orchestrates over 100 specialized AI agents across frontier and distilled models using a Prepare→Scan→Validate (multi-model debate)→Dedupe→Prove pipeline. MDASH achieved 96% recall against 5 years of MSRC cases in clfs.sys and 100% in tcpip.sys, scoring 88.45% on the public CyberGym benchmark. Microsoft warned customers on July 9, 2026, that AI-powered discovery would drive higher patch volumes going forward. The product breakdown demonstrates the breadth of the release: Windows (723 CVEs), Office/Office 2016 (222/111 CVEs), SQL Server (62 CVEs), Developer Tools (22 CVEs), SharePoint Server (16 CVEs), Azure (12 CVEs), Skype for Business (10 CVEs), and Exchange Server (9 CVEs). Critical patches also impacted Hyper-V, Credential Guard, Secure Kernel Mode, Windows Hello, BitLocker, and other security subsystems.

The implications for defenders are severe. The two actively exploited zero-days require immediate patching — particularly CVE-2026-85880 which enables AppContainer sandbox escape, bypassing a fundamental isolation boundary in modern Windows security architecture. The 20 wormable RCE vulnerabilities mean that unpatched systems on internal networks face cascading compromise risk. Security commentators including Satnam Narang (Tenable) observed that 'AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn't finding more needles,' while Tyler Reguly (Fortra) characterized the high volume as proactive attack-surface reduction. Regardless of the long-term outlook, this Patch Tuesday represents an urgent, broad-surface remediation priority that stretches organizational patch capacity to its limits.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1505 Server Software Component
- T1574 Hijack Execution Flow
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1489 Service Stop
- T1078 Valid Accounts
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1562 Impair Defenses
- T1018 Remote System Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1114 Email Collection
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1558 Steal or Forge Kerberos Tickets
- T1040 Network Sniffing
- T1550 Use Alternate Authentication Material
- T1485 Data Destruction
- T1566 Phishing: Spearphishing Link
- T1059 Command and Scripting Interpreter
- T1574 Hijack Execution Flow
- T1556 Modify Authentication Process
- T1021 Remote Services
- T1071 Application Layer Protocol

## Sources

- [September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/)
- [Microsoft Patches Record 974 Vulnerabilities Including Two Exploited Zero-Days](https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/)
- [The September 2026 Security Update Review (Zero Day Initiative)](https://www.zerodayinitiative.com/blog/2026/9/8/the-september-2026-security-update-review)
- [CISA Known Exploited Vulnerabilities — CVE-2026-81963](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963)
- [CISA Known Exploited Vulnerabilities — CVE-2026-85880](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85880)
- [MSRC Update Guide — CVE-2026-81963](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963)
- [MSRC Update Guide — CVE-2026-85880](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880)
- [NVD — CVE-2026-81963](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-81963)
- [NVD — CVE-2026-85880](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85880)
- [NVD — CVE-2026-66302 (Skype for Business Server RCE)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-66302)
- [NVD — CVE-2026-69579 (Windows Message Queuing RCE)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-69579)
- [NVD — CVE-2026-69590 (Windows RRAS RCE)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-69590)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2398