# Microsoft September 2026 Patch Tuesday — 999 CVEs, 3 actively exploited zero-days (CVE-2026-85880, CVE-2026-81963, CVE-2026-85046)

> Microsoft's September 2026 Patch Tuesday addresses 999 CVEs (974 Microsoft, 25 non-Microsoft) — the largest security update in company history. Three zero-days are actively exploited: CVE-2026-85880 (Windows ALPC heap-based buffer overflow EoP), CVE-2026-81963 (Windows Update Stack improper link resolution EoP), and CVE-2026-85046 (Chromium V8 type confusion RCE patched by Edge/Chrome). Two CVSS 10.0 vulnerabilities affect Azure AI Language (missing authentication) and Azure AD B2C (authorization bypass). Critical RCEs (CVSS 9.8) span DNS Server, Remote Desktop Services, RPC Runtime, DHCP Server, ICS, Media Foundation, Windows PDF, and multiple Office applications. The record-breaking volume is attributed to Microsoft's AI-powered vulnerability discovery systems.

- **Published:** 2026-09-08T00:00:00Z
- **Last reviewed:** 2026-09-09T11:27:22.270Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2407
- **ID:** TL-2026-2407
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-85880, CVE-2026-81963, CVE-2026-85046, CVE-2026-70352, CVE-2026-83711, CVE-2026-69730, CVE-2026-69525, CVE-2026-69819, CVE-2026-69845, CVE-2026-72979, CVE-2026-72983, CVE-2026-69408, CVE-2026-69586, CVE-2026-69496, CVE-2026-69276, CVE-2026-69715, CVE-2026-77493, CVE-2026-69769, CVE-2026-69431, CVE-2026-69493, CVE-2026-69824, CVE-2026-69676, CVE-2026-69854, CVE-2026-69857, CVE-2026-69829, CVE-2026-80098, CVE-2026-83941, CVE-2026-62916, CVE-2026-78509, CVE-2026-78510, CVE-2026-81948, CVE-2026-81949, CVE-2026-81950, CVE-2026-81951, CVE-2026-81953, CVE-2026-81959, CVE-2026-78505, CVE-2026-69285, CVE-2026-77898, CVE-2026-69632, CVE-2026-69678, CVE-2026-69767, CVE-2026-69797, CVE-2026-77504, CVE-2026-81952, CVE-2026-65772, CVE-2026-81376, CVE-2026-78462, CVE-2026-73009, CVE-2026-73010, CVE-2026-72936, CVE-2026-72940, CVE-2026-71343, CVE-2026-69590, CVE-2026-69623, CVE-2026-72957, CVE-2026-69852, CVE-2026-70585, CVE-2026-69595, CVE-2026-78445, CVE-2026-83501, CVE-2026-70296, CVE-2026-66302, CVE-2026-65669, CVE-2026-72982, CVE-2026-69579, CVE-2026-72986, CVE-2026-73018, CVE-2026-72981, CVE-2026-78439, CVE-2026-81955, CVE-2026-73006, CVE-2026-70351, CVE-2026-81352, CVE-2026-58599, CVE-2026-69601, CVE-2026-70178, CVE-2026-65818, CVE-2026-62906, CVE-2026-85504, CVE-2026-85506, CVE-2026-85507, CVE-2026-85508, CVE-2026-85509, CVE-2026-34182, CVE-2026-84323, CVE-2026-84324, CVE-2026-84325, CVE-2026-84326, CVE-2026-84327, CVE-2026-84328, CVE-2026-84329, CVE-2026-84331, CVE-2026-84332, CVE-2026-84334, CVE-2026-84335, CVE-2026-84347, CVE-2026-84348, CVE-2026-84349, CVE-2026-84350, CVE-2026-84351, CVE-2026-84353, CVE-2026-84354, CVE-2026-84355, CVE-2026-84356, CVE-2026-84357, CVE-2026-84358, CVE-2026-84359, CVE-2026-69518, CVE-2026-69603, CVE-2026-80083, CVE-2026-72961, CVE-2026-67631, CVE-2026-67643, CVE-2026-78519, CVE-2026-78525, CVE-2026-78520, CVE-2026-69414

## Description

Microsoft's September 2026 Patch Tuesday (KB5124008 for Windows 11, KB5122878 for Windows 10) fixes 999 CVEs — 974 in Microsoft's own products and 25 in non-Microsoft components — making it the single largest security update in the company's history, shattering the previous record of 570 flaws in July 2026. The year-to-date total exceeds 2,600 CVEs, more than double the prior annual record of 1,245 in 2020, with three months remaining. The surge is attributed to Microsoft's adoption of AI-powered vulnerability discovery systems, a trend shared by Adobe, Cisco, Google, Mozilla, and Oracle.

Three zero-days are actively exploited in the wild. CVE-2026-85880 is a heap-based buffer overflow (CWE-122) in the Windows Advanced Local Procedure Call (ALPC) component, allowing an authenticated attacker to elevate privileges to SYSTEM. Discovered by Volexity and researchers at Proofpoint (Mark Kelly, David Galazin, Jeremy Hedges), it does not affect Windows 11 or Server 2025, suggesting Microsoft's Rust-based memory safety rewrites in those versions are effective. CVE-2026-81963 is an improper link resolution vulnerability (CWE-59) in the Windows Update Stack, also enabling local SYSTEM privilege escalation. Credited to Romain Deperne and the Microsoft Threat Intelligence Centre (MSTIC), it affects all supported Windows versions. CVE-2026-85046 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine affecting Chromium-based browsers. Patched by Edge on September 2 and Chrome 152.0.7977.82 on September 3, 2026, it allows remote code execution inside the browser sandbox via a crafted HTML page. The root cause is a Maglev/TurboFan compiler bug in Array.prototype.sort inlining that fails to handle mixed elements-kind feedback, enabling a type confusion attack documented in the public writeup 'When Sorting Leads to Confusion' by researcher serotav. All three zero-days were added to CISA's Known Exploited Vulnerabilities (KEV) catalog requiring remediation per BOD 26-04 guidance.

Two CVSS 10.0 vulnerabilities were addressed in Azure services. CVE-2026-70352 is a missing authentication for critical function (CWE-306) in Azure AI Language Authoring, allowing an unauthenticated remote attacker to elevate privileges with changed scope. CVE-2026-83711 is an authorization bypass through user-controlled key (CWE-639) in Azure AD B2C, enabling unauthenticated remote privilege escalation with high confidentiality and integrity impact. Both are rated CVSS 10.0 Critical with network attack vectors, low complexity, and no user interaction required.

Multiple components received 'Exploitation More Likely' designation from Microsoft. CVE-2026-69730 is a use-after-free (CWE-416) in Windows DNS Server allowing unauthenticated remote code execution via specially crafted DNS packets — rated CVSS 9.8 and marked 'Exploitation More Likely.' CVE-2026-69525 is a use-after-free in Remote Desktop Services (CVSS 9.8, pre-auth RCE) also marked 'Exploitation More Likely.' Additional critical RCEs (CVSS 9.8) include the RPC Runtime Library (CWE-787 out-of-bounds write), DHCP Server (heap-based buffer overflow and use-after-free, two CVEs), Internet Connection Sharing (use-after-free), Windows Media Foundation, Windows PDF, Windows Compressed Folder, uxtheme.dll, DirectShow, the Graphics Component, and the HTTP Print Provider. Kerberos authentication bypass by capture-replay (CVE-2026-69676, CVSS 8.8) and Azure Cosmos DB authorization bypass (CVE-2026-69857, CVSS 8.5) were also marked 'Exploitation More Likely.'

Office and developer tools received significant patches. Six Excel RCEs, three Outlook RCEs, three Word RCEs, three PowerPoint RCEs, and multiple SharePoint, Access, and Publisher vulnerabilities were fixed. The .NET and Visual Studio ecosystem received 24 CVEs including RCEs and EoP. Visual Studio Code and GitHub Copilot received multiple security feature bypass and information disclosure fixes. Copilot Studio received a critical cryptographic signature verification bypass (CVE-2026-80098, CVSS 9.3-10.0) enabling unauthenticated remote privilege escalation.

No specific IOCs, file hashes, IP addresses, domains, or threat actor attribution were published for any of the zero-day attacks. The exploitation mechanisms are characterized at the vulnerability level (ALPC buffer overflow, Update Stack link following, V8 type confusion) but no forensic indicators, C2 infrastructure, or attack chains were disclosed. The Snort ruleset (SIDs 67011-67084) provides coverage for network-level detection of exploitation attempts against the most critical RCEs.

Microsoft lifecycle changes effective October 14, 2026 include: Windows 11 24H2 Home & Pro end of servicing, Windows Server 2022 entering extended support only, Windows Server 2012/2012 R2 final ESU year expiration, Office 2021/LTSC 2021 end of support (no ESU), and Exchange Server 2016/2019 with no further ESU extensions. These changes compound the urgency of upgrading systems before the October deadline.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1574 Hijack Execution Flow
- T1550 Use Alternate Authentication Material
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1040 Network Sniffing
- T1021 Remote Services
- T1572 Protocol Tunneling
- T1595.001 Active Scanning
- T1133 External Remote Services
- T1566.001 Phishing: Spearphishing Attachment
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Defense Evasion
- T1558 Steal or Forge Kerberos Tickets
- T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket
- T1003.003 OS Credential Dumping: NTDS
- T1210 Exploitation of Remote Services
- T1021.001 Remote Services: Remote Desktop Protocol

## Sources

- [Rapid7 Patch Tuesday — September 2026](https://www.rapid7.com/blog/post/em-patch-tuesday-september-2026)
- [BleepingComputer — Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/)
- [Cisco Talos — Microsoft Patch Tuesday for September 2026](https://blog.talosintelligence.com/microsoft-patch-tuesday-for-september-2026/)
- [Krebs on Security — Microsoft Plugs Nearly 1000 Security Holes](https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/)
- [CISA KEV — CVE-2026-85880](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NVD — CVE-2026-85880 (Windows ALPC EoP)](https://nvd.nist.gov/vuln/detail/CVE-2026-85880)
- [NVD — CVE-2026-81963 (Windows Update Stack EoP)](https://nvd.nist.gov/vuln/detail/CVE-2026-81963)
- [NVD — CVE-2026-85046 (Chromium V8 Type Confusion)](https://nvd.nist.gov/vuln/detail/CVE-2026-85046)
- [NVD — CVE-2026-70352 (Azure AI Language CVSS 10.0)](https://nvd.nist.gov/vuln/detail/CVE-2026-70352)
- [NVD — CVE-2026-83711 (Azure AD B2C CVSS 10.0)](https://nvd.nist.gov/vuln/detail/CVE-2026-83711)
- [NVD — CVE-2026-69730 (DNS Server RCE, Exploitation More Likely)](https://nvd.nist.gov/vuln/detail/CVE-2026-69730)
- [NVD — CVE-2026-69525 (Remote Desktop Services RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-69525)
- [NVD — CVE-2026-80098 (Copilot Studio EoP)](https://nvd.nist.gov/vuln/detail/CVE-2026-80098)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2407