Microsoft September 2026 Patch Tuesday — 999 CVEs, 3 actively exploited zero-days (CVE-2026-85880, CVE-2026-81963, CVE-2026-85046)
Microsoft September 2026 Patch Tuesday (TL-2026-2407), also tracked as September 2026 Patch Tuesday, is a critical-severity software vulnerability scored CVSS 10, first published 2026-09-08 and last reviewed 2026-09-09. It has no confirmed attribution, affects Microsoft Windows 10, references 118 CVEs (CVE-2026-85880, CVE-2026-81963, CVE-2026-85046), maps to 21 MITRE ATT&CK techniques (T1003, T1003.003, T1021), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-2407
- Threat ID
- TL-2026-2407
- Also known as
- September 2026 Patch Tuesday, KB5124008, KB5122880, KB5122878
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-09-08
- Last reviewed
- 2026-09-09
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, education, technology, critical-infrastructure, energy, manufacturing, defense
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
- Updates
- 2026-09-09 · revalidated 1× · latest source
Microsoft's September 2026 Patch Tuesday addresses 999 CVEs (974 Microsoft, 25 non-Microsoft) — the largest security update in company history. Three zero-days are actively exploited: CVE-2026-85880 (Windows ALPC heap-based buffer overflow EoP), CVE-2026-81963 (Windows Update Stack improper link resolution EoP), and CVE-2026-85046 (Chromium V8 type confusion RCE patched by Edge/Chrome). Two CVSS 10.0 vulnerabilities affect Azure AI Language (missing authentication) and Azure AD B2C (authorization bypass). Critical RCEs (CVSS 9.8) span DNS Server, Remote Desktop Services, RPC Runtime, DHCP Server, ICS, Media Foundation, Windows PDF, and multiple Office applications. The record-breaking volume is attributed to Microsoft's AI-powered vulnerability discovery systems.
How Microsoft September 2026 Patch Tuesday works
Microsoft's September 2026 Patch Tuesday (KB5124008 for Windows 11, KB5122878 for Windows 10) fixes 999 CVEs — 974 in Microsoft's own products and 25 in non-Microsoft components — making it the single largest security update in the company's history, shattering the previous record of 570 flaws in July 2026. The year-to-date total exceeds 2,600 CVEs, more than double the prior annual record of 1,245 in 2020, with three months remaining. The surge is attributed to Microsoft's adoption of AI-powered vulnerability discovery systems, a trend shared by Adobe, Cisco, Google, Mozilla, and Oracle.
Three zero-days are actively exploited in the wild. CVE-2026-85880 is a heap-based buffer overflow (CWE-122) in the Windows Advanced Local Procedure Call (ALPC) component, allowing an authenticated attacker to elevate privileges to SYSTEM. Discovered by Volexity and researchers at Proofpoint (Mark Kelly, David Galazin, Jeremy Hedges), it does not affect Windows 11 or Server 2025, suggesting Microsoft's Rust-based memory safety rewrites in those versions are effective. CVE-2026-81963 is an improper link resolution vulnerability (CWE-59) in the Windows Update Stack, also enabling local SYSTEM privilege escalation. Credited to Romain Deperne and the Microsoft Threat Intelligence Centre (MSTIC), it affects all supported Windows versions. CVE-2026-85046 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine affecting Chromium-based browsers. Patched by Edge on September 2 and Chrome 152.0.7977.82 on September 3, 2026, it allows remote code execution inside the browser sandbox via a crafted HTML page. The root cause is a Maglev/TurboFan compiler bug in Array.prototype.sort inlining that fails to handle mixed elements-kind feedback, enabling a type confusion attack documented in the public writeup 'When Sorting Leads to Confusion' by researcher serotav. All three zero-days were added to CISA's Known Exploited Vulnerabilities (KEV) catalog requiring remediation per BOD 26-04 guidance.
Two CVSS 10.0 vulnerabilities were addressed in Azure services. CVE-2026-70352 is a missing authentication for critical function (CWE-306) in Azure AI Language Authoring, allowing an unauthenticated remote attacker to elevate privileges with changed scope. CVE-2026-83711 is an authorization bypass through user-controlled key (CWE-639) in Azure AD B2C, enabling unauthenticated remote privilege escalation with high confidentiality and integrity impact. Both are rated CVSS 10.0 Critical with network attack vectors, low complexity, and no user interaction required.
Multiple components received 'Exploitation More Likely' designation from Microsoft. CVE-2026-69730 is a use-after-free (CWE-416) in Windows DNS Server allowing unauthenticated remote code execution via specially crafted DNS packets — rated CVSS 9.8 and marked 'Exploitation More Likely.' CVE-2026-69525 is a use-after-free in Remote Desktop Services (CVSS 9.8, pre-auth RCE) also marked 'Exploitation More Likely.' Additional critical RCEs (CVSS 9.8) include the RPC Runtime Library (CWE-787 out-of-bounds write), DHCP Server (heap-based buffer overflow and use-after-free, two CVEs), Internet Connection Sharing (use-after-free), Windows Media Foundation, Windows PDF, Windows Compressed Folder, uxtheme.dll, DirectShow, the Graphics Component, and the HTTP Print Provider. Kerberos authentication bypass by capture-replay (CVE-2026-69676, CVSS 8.8) and Azure Cosmos DB authorization bypass (CVE-2026-69857, CVSS 8.5) were also marked 'Exploitation More Likely.'
Office and developer tools received significant patches. Six Excel RCEs, three Outlook RCEs, three Word RCEs, three PowerPoint RCEs, and multiple SharePoint, Access, and Publisher vulnerabilities were fixed. The .NET and Visual Studio ecosystem received 24 CVEs including RCEs and EoP. Visual Studio Code and GitHub Copilot received multiple security feature bypass and information disclosure fixes. Copilot Studio received a critical cryptographic signature verification bypass (CVE-2026-80098, CVSS 9.3-10.0) enabling unauthenticated remote privilege escalation.
No specific IOCs, file hashes, IP addresses, domains, or threat actor attribution were published for any of the zero-day attacks. The exploitation mechanisms are characterized at the vulnerability level (ALPC buffer overflow, Update Stack link following, V8 type confusion) but no forensic indicators, C2 infrastructure, or attack chains were disclosed. The Snort ruleset (SIDs 67011-67084) provides coverage for network-level detection of exploitation attempts against the most critical RCEs.
Microsoft lifecycle changes effective October 14, 2026 include: Windows 11 24H2 Home & Pro end of servicing, Windows Server 2022 entering extended support only, Windows Server 2012/2012 R2 final ESU year expiration, Office 2021/LTSC 2021 end of support (no ESU), and Exchange Server 2016/2019 with no further ESU extensions. These changes compound the urgency of upgrading systems before the October deadline.
MITRE ATT&CK techniques used in TL-2026-2407
Credential Access
T1003 OS Credential Dumping; T1003.003 OS Credential Dumping: NTDS; T1555 Credentials from Password Stores; T1558 Steal or Forge Kerberos Tickets; T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket
Lateral Movement
T1021 Remote Services; T1021.001 Remote Services: Remote Desktop Protocol; T1210 Exploitation of Remote Services
Discovery
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment
Execution
T1203 Exploitation for Client Execution
Defense Evasion
T1211 Exploitation for Defense Evasion; T1574 Hijack Execution Flow
Persistence
T1505 Server Software Component
lateral-movement
T1550 Use Alternate Authentication Material
Command and Control
Reconnaissance
Affected products and versions in Microsoft September 2026 Patch Tuesday
- Microsoft — Windows 10
Vulnerable versions: 1607; 1809; 21H2; 22H2
Fixed in: 14393.9512; 17763.9245; 19044.7725; 19045.7725 - Microsoft — Windows 11
Vulnerable versions: 23H2; 24H2; 25H2; 26H1
Fixed in: 22631.7582; 26100.9445; 26200.9445; 28000.2954 - Microsoft — Windows Server
Vulnerable versions: 2012; 2012 R2; 2016; 2019; 2022; 2025
Fixed in: 6.2.9200.26349; 6.3.9600.23397; 14393.9512; 17763.9245; 20348.5622; 26100.33438 - Microsoft — Azure AI Language
Vulnerable versions: all
Fixed in: service-side remediation - Microsoft — Azure AD B2C / Entra ID
Vulnerable versions: all
Fixed in: service-side remediation - Microsoft — Office
Vulnerable versions: 2019; 2021; LTSC 2021; Microsoft 365
Fixed in: September 2026 updates - Microsoft — Exchange Server
Vulnerable versions: 2016; 2019
Fixed in: September 2026 updates - Microsoft — Copilot Studio
Vulnerable versions: all
Fixed in: service-side remediation - Google — Chrome
Vulnerable versions: < 152.0.7977.82
Fixed in: 152.0.7977.82 - Microsoft — Edge (Chromium)
Vulnerable versions: before Sept 2, 2026
Fixed in: latest stable channel
Remediation for Microsoft September 2026 Patch Tuesday
Patches
- Windows 11 23H2: build 22631.7582
- Windows 11 24H2: build 26100.9445
- Windows 11 25H2: build 26200.9445
- Windows 11 26H1: build 28000.2954
- Windows 10 1607: build 14393.9512
- Windows 10 1809: build 17763.9245
- Windows 10 22H2: build 19045.7725
- Windows Server 2022: build 20348.5622
- Windows Server 2025: build 26100.33438
- Chrome: 152.0.7977.82
Immediate actions
- Apply Windows 11 KB5124008/KB5122880 and Windows 10 KB5122878 cumulative updates immediately
- Prioritize patching the three actively exploited zero-days: CVE-2026-85880, CVE-2026-81963, CVE-2026-85046
- Patch internet-facing Windows DNS Servers for CVE-2026-69730 (CVSS 9.8, Exploitation More Likely)
- Apply Remote Desktop Services patch for CVE-2026-69525 (CVSS 9.8, pre-auth RCE, Exploitation More Likely)
- Update Microsoft Edge to latest stable channel (CVE-2026-85046 and 22 other Chromium CVEs)
- Update Google Chrome to 152.0.7977.82 or later
- Review Azure AI Language, Azure AD B2C, Entra ID, and Copilot Studio for service-side remediation
- Patch DHCP Server, RPC Runtime, and ICS components on server infrastructure
- Apply Office updates for Outlook, Word, Excel, and PowerPoint RCEs
Workarounds
- Restrict outbound RDP access from internal networks
- Segment DNS servers and apply strict firewall rules
- Disable Internet Connection Sharing (ICS) if not required
- Restrict Telnet Client installation to administrative systems only
- Limit Windows Update Stack access to authorized users only
Longer-term hardening
- Adopt AI-powered vulnerability discovery and patch management workflows
- Implement vulnerability prioritization using CISA KEV and Microsoft Exploitation Likelihood ratings
- Plan migration from Windows Server 2012/2012 R2 before final ESU expiration (October 2026)
- Plan migration from Windows 11 24H2 Home/Pro before end of servicing (October 2026)
- Evaluate Microsoft's Rust-based memory safety investments for critical kernel components
- Upgrade Office 2021/LTSC 2021 before end of support (October 2026)
- Transition from Exchange Server 2016/2019 to Exchange Online
CVEs associated with Microsoft September 2026 Patch Tuesday
Showing the first 60 of 118.
- CVE-2026-85880
- CVE-2026-81963
- CVE-2026-85046
CVE-2026-70352CVE-2026-83711CVE-2026-69730CVE-2026-69525CVE-2026-69819CVE-2026-69845CVE-2026-72979CVE-2026-72983CVE-2026-69408CVE-2026-69586CVE-2026-69496CVE-2026-69276CVE-2026-69715CVE-2026-77493CVE-2026-69769CVE-2026-69431CVE-2026-69493CVE-2026-69824CVE-2026-69676CVE-2026-69854CVE-2026-69857CVE-2026-69829CVE-2026-80098CVE-2026-83941CVE-2026-62916CVE-2026-78509- CVE-2026-78510
CVE-2026-81948CVE-2026-81949CVE-2026-81950CVE-2026-81951CVE-2026-81953CVE-2026-81959- CVE-2026-78505
CVE-2026-69285CVE-2026-77898CVE-2026-69632CVE-2026-69678CVE-2026-69767CVE-2026-69797CVE-2026-77504CVE-2026-81952CVE-2026-65772CVE-2026-81376CVE-2026-78462CVE-2026-73009CVE-2026-73010CVE-2026-72936CVE-2026-72940CVE-2026-71343CVE-2026-69590CVE-2026-69623CVE-2026-72957CVE-2026-69852CVE-2026-70585CVE-2026-69595CVE-2026-78445
Weaknesses (CWE) in Microsoft September 2026 Patch Tuesday
CWE-122, CWE-416, CWE-787, CWE-843, CWE-59, CWE-306, CWE-639, CWE-862, CWE-347, CWE-908
Timeline of Microsoft September 2026 Patch Tuesday
- Microsoft ships an incomplete fix for Defender flaw 'RoguePlanet' (CVE-2026-50656) that blocks only one attack path, leaving the engine bypassable and setting up the ShieldBreak/ShieldCrash bypass chain.
- V8 Array.prototype.sort type confusion vulnerability (CVE-2026-85046) discovered and reported to Chromium by researcher serotav; root cause identified in maglev-graph-builder.cc TryReduceArrayPrototypeSort
- Researcher MSNightmare (Nightmare-Eclipse) discloses 'ShieldBreak' (CVE-2026-69414), a patch-bypass of RoguePlanet in the Malware Protection Engine (<1.1.26080.3), with a reported 100% PoC success rate on Windows 11 25H2 and Server 2025.
- Microsoft Edge stable ships build 152.0.4191.62 patching the V8 zero-day but, per Rapid7, publishes no security advisory naming CVE-2026-85046 — a visibility gap for defenders relying on CVE-based tracking.
- Microsoft Edge stable channel updated, patching CVE-2026-85046 and 22 other Chromium CVEs — one day before Chrome's patch release
- Google Chrome 152.0.7977.82 released, fixing CVE-2026-85046 (V8 type confusion). NVD publishes CVE-2026-85046, CVE-2026-70352, and CVE-2026-83711. Public exploit writeup 'When Sorting Leads to Confusion' published
- CISA adds CVE-2026-85046 (Chromium V8 Type Confusion) to Known Exploited Vulnerabilities catalog; remediation due September 18, 2026 per BOD 26-04
- ~2 hours after Patch Tuesday, MSNightmare publicly discloses 'ShieldCrash', an unpatched bypass of the incomplete ShieldBreak fix granting SYSTEM-level arbitrary file reads (potential full SYSTEM LPE) on all supported Windows 10/11/Server builds even after the September updates; no patch or mitigation available at publication.
- Canadian Cyber Centre confirms both Windows zero-days added to CISA KEV. Snort rules released (SIDs 67011-67084) for network-level detection of exploitation attempts
- Rapid7, BleepingComputer, Cisco Talos, and KrebsOnSecurity publish Patch Tuesday analysis. Security researchers at Fortra (Tyler Reguly) and Tenable (Satnam Narang) provide expert commentary on the record-breaking volume and AI-assisted vulnerability discovery
- CISA adds CVE-2026-85880 (Windows ALPC Heap-Based Buffer Overflow) and CVE-2026-81963 (Windows Update Stack Link Following) to KEV catalog; both due September 22, 2026 per BOD 26-04
- Microsoft releases September 2026 Patch Tuesday (KB5124008/KB5122880 for Windows 11, KB5122878 for Windows 10) — 999 CVEs including 974 Microsoft and 25 non-Microsoft, the largest security update in company history
- CISA BOD 26-04 remediation deadline for CVE-2026-85046 (Chromium V8) — all federal agencies must patch Chrome/Edge or discontinue use
- CISA BOD 26-04 remediation deadline for CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack) — all federal agencies must patch or discontinue affected systems
- Microsoft lifecycle changes take effect: Windows 11 24H2 Home/Pro end of servicing, Windows Server 2022 extended support only, Windows Server 2012/2012 R2 final ESU year expires, Office 2021/LTSC 2021 end of support (no ESU), Exchange Server 2016/2019 no further ESU extensions
Update history for TL-2026-2407
- 2026-09-09 — Microsoft September 2026 Patch Tuesday — record 972+ CVEs, 2 exploited EoP zero-days, 113 Critical and 17+ unauthenticated network-reachable RCEs; unpatched Defender 'ShieldCrash' disclosed post-release: What changed No field-level escalation (severity/exploitability/status/attribution were already at their maximum in the existing record); the update is additive: new CVEs (Hyper-V guest-to-host escapes, an RDP clipboard RCE, and several Off
Sources cited for Microsoft September 2026 Patch Tuesday
- Rapid7 Patch Tuesday — September 2026
- BleepingComputer — Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
- Cisco Talos — Microsoft Patch Tuesday for September 2026
- Krebs on Security — Microsoft Plugs Nearly 1000 Security Holes
- CISA KEV — CVE-2026-85880
- CISA KEV — CVE-2026-81963
- CISA KEV — CVE-2026-85046
- NVD — CVE-2026-85880 (Windows ALPC EoP)
- NVD — CVE-2026-81963 (Windows Update Stack EoP)
- NVD — CVE-2026-85046 (Chromium V8 Type Confusion)
- NVD — CVE-2026-70352 (Azure AI Language CVSS 10.0)
- NVD — CVE-2026-83711 (Azure AD B2C CVSS 10.0)
- NVD — CVE-2026-69730 (DNS Server RCE, Exploitation More Likely)
- NVD — CVE-2026-69525 (Remote Desktop Services RCE)
- NVD — CVE-2026-80098 (Copilot Studio EoP)
More in vulnerability
- CVE-2025-59201: Windows Network Connection Status Indicator (NCSI) Elevation of Privilege via Registry Symbolic Link Abuse
- CVE-2026-20817: Windows Error Reporting Service (WerSvc.dll) Local Privilege Escalation via ALPC Argument Injection
- Sudo iptables NOPASSWD Misconfiguration Enables Local Privilege Escalation via Comment Injection
- CVE-2025-37947: Out-of-Bounds Write in Linux ksmbd Kernel SMB Server Enables Local Privilege Escalation
- Dell ObjectScale Critical Deserialization Flaw (CVE-2026-70416, CVSS 10.0) Enables Unauthenticated RCE
Detection coverage for TL-2026-2407
As of 2026-09-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2407 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.