Microsoft’s September 2026 Patch Tuesday Fixes 974 Vulnerabilities, Including Two Exploited Zero-Days
Summary
Microsoft’s September 8, 2026 update addresses 974 Microsoft vulnerabilities and 25 non-Microsoft CVEs, including two actively exploited Windows privilege-escalation zero-days. The article prioritizes patches and mitigations for critical remote-code-execution flaws.
Key points
- The September 8 release covers 974 Microsoft vulnerabilities and 25 non-Microsoft CVEs; more than 110 flaws are rated Critical.
- Microsoft, CISA, and industry reporting say CVE-2026-85880 in Windows ALPC and CVE-2026-81963 in the Windows Update Stack are actively exploited zero-days that enable local privilege escalation.
- The article identifies multiple CVSS 9.8 remote-code-execution flaws affecting Windows DNS Server, Remote Desktop Services, Windows Services for NFS, DHCP Server, and Windows Shell.
- Both zero-days were added to CISA’s Known Exploited Vulnerabilities catalog; FCEB agencies are required to apply fixes by September 22, 2026.
- Recommended priorities are patching the exploited zero-days first, then critical network-facing flaws, with triage based on exploitation status, severity, and exposure.
- Where patching is delayed, the article recommends restricting access to affected services, segmenting networks, and monitoring for suspicious privilege escalation and system activity.
Article Details
- Event Type
- Microsoft September 2026 Patch Tuesday security update
- Impact
- Microsoft released fixes for 974 vulnerabilities across its products on September 8, 2026. Two elevation-of-privilege vulnerabilities, CVE-2026-85880 and CVE-2026-81963, were confirmed as actively exploited and can enable attackers with local access to gain SYSTEM privileges. The release also includes critical remote code execution vulnerabilities affecting network-facing services and other Microsoft products. The article reports that FCEB agencies must apply fixes by September 22, 2026, and warns that the scale of the release could strain remediation efforts.
CVE
CVE-2026-55007Microsoft · Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft · Microsoft Exchange Server 2019 Cumulative Update 15; +1 moreAdditional critical vulnerabilities include a double free in Microsoft Exchange Server (CVE-2026-55007, CVSS 8.1), an improper authentication flaw in Microsoft Authenticator on Android (CVE-2026-80097, CVSS 8.6), aCVE-2026-65669Microsoft · SQL Server Management Studio 22Microsoft Office SharePoint (CVE-2026-69465, CVSS 8.8), and an injection vulnerability in SQL Server (CVE-2026-65669, CVSS 9.6).CVE-2026-69465Microsoft · Microsoft SharePoint Server Subscription Edition(CVE-2026-80097, CVSS 8.6), a missing authorization vulnerability in Microsoft Office SharePoint (CVE-2026-69465, CVSS 8.8), and an injection vulnerability in SQL Server (CVE-2026-65669, CVSS 9.6).CVE-2026-69525Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +17 morerequire no user interaction, affecting Windows DNS Server (CVE-2026-69730), Remote Desktop Services (CVE-2026-69525), Windows Services for NFS ONCRPC XDR Driver (CVE-2026-69595), Windows DHCP Server (CVE-2026-72979),CVE-2026-69595Microsoft · Windows Server 2012; Microsoft · Windows Server 2012 (Server Core installation); +9 moreRemote Desktop Services (CVE-2026-69525), Windows Services for NFS ONCRPC XDR Driver (CVE-2026-69595), Windows DHCP Server (CVE-2026-72979), and Windows Shell (CVE-2026-69829).CVE-2026-69730Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +11 moreseveral of which are unauthenticated and require no user interaction, affecting Windows DNS Server (CVE-2026-69730), Remote Desktop Services (CVE-2026-69525), Windows Services for NFS ONCRPC XDR DriverCVE-2026-69829Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +17 morefor NFS ONCRPC XDR Driver (CVE-2026-69595), Windows DHCP Server (CVE-2026-72979), and Windows Shell (CVE-2026-69829).CVE-2026-72979Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +11 more(CVE-2026-69525), Windows Services for NFS ONCRPC XDR Driver (CVE-2026-69595), Windows DHCP Server (CVE-2026-72979), and Windows Shell (CVE-2026-69829).CVE-2026-80097Microsoft · Microsoft Authenticator for Android(CVE-2026-55007, CVSS 8.1), an improper authentication flaw in Microsoft Authenticator on Android (CVE-2026-80097, CVSS 8.6), a missing authorization vulnerability in Microsoft Office SharePoint (CVE-2026-69465,CVE-2026-81963Microsoft · Windows 11 Version 23H2; Microsoft · Windows 11 Version 24H2; +4 morezero-day vulnerabilities: CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC) and CVE-2026-81963 in the Windows Update Stack.CVE-2026-85880Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +11 more8, 2026 Patch Tuesday release, and prioritizes the two actively exploited zero-day vulnerabilities: CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC) and CVE-2026-81963 in the Windows Update Stack.
Vendors
Products
Microsoft Authenticatorfree in Microsoft Exchange Server (CVE-2026-55007, CVSS 8.1), an improper authentication flaw in Microsoft Authenticator on Android (CVE-2026-80097, CVSS 8.6), a missing authorization vulnerability in Microsoft OfficeMicrosoft Exchange Servervulnerabilities affecting Windows DNS Server, Remote Desktop Services, DHCP Server, Windows Shell, Exchange Server, SharePoint, and SQL Server, among other Microsoft products.Microsoft Office SharePointAuthenticator on Android (CVE-2026-80097, CVSS 8.6), a missing authorization vulnerability in Microsoft Office SharePoint (CVE-2026-69465, CVSS 8.8), and an injection vulnerability in SQL Server (CVE-2026-65669, CVSSMicrosoft WindowsTuesday release, and prioritizes the two actively exploited zero-day vulnerabilities: CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC) and CVE-2026-81963 in the Windows Update Stack.Remote Desktop Servicesalso includes high-impact remote code execution vulnerabilities affecting Windows DNS Server, Remote Desktop Services, DHCP Server, Windows Shell, Exchange Server, SharePoint, and SQL Server, among other MicrosoftSQL ServerDNS Server, Remote Desktop Services, DHCP Server, Windows Shell, Exchange Server, SharePoint, and SQL Server, among other Microsoft products.Windows DHCP ServerDesktop Services (CVE-2026-69525), Windows Services for NFS ONCRPC XDR Driver (CVE-2026-69595), Windows DHCP Server (CVE-2026-72979), and Windows Shell (CVE-2026-69829).Windows DNS Serverseverity, this release also includes high-impact remote code execution vulnerabilities affecting Windows DNS Server, Remote Desktop Services, DHCP Server, Windows Shell, Exchange Server, SharePoint, and SQL Server,Windows Services for NFSaffecting Windows DNS Server (CVE-2026-69730), Remote Desktop Services (CVE-2026-69525), Windows Services for NFS ONCRPC XDR Driver (CVE-2026-69595), Windows DHCP Server (CVE-2026-72979), and Windows ShellWindows Shellcode execution vulnerabilities affecting Windows DNS Server, Remote Desktop Services, DHCP Server, Windows Shell, Exchange Server, SharePoint, and SQL Server, among other Microsoft products.Windows Update StackCVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC) and CVE-2026-81963 in the Windows Update Stack.