cyber.hendryadrian.com
Security News · securityweek.com

Microsoft Patches 974 Vulnerabilities, Including Two Exploited Zero-Days

· Original article ↗

Summary

Microsoft's September 2026 Patch Tuesday fixes 974 CVEs across its products, including two zero-days exploited for local privilege escalation. Experts say organizations should prioritize vulnerabilities based on their exposure and risk.

Key points

  • Microsoft patched 974 CVEs across its products in its September 2026 Patch Tuesday release.
  • CVE-2026-85880 is a heap buffer overflow in Windows ALPC that can let a local attacker escape an AppContainer sandbox and gain System privileges.
  • CVE-2026-81963 affects Windows Update Stack and can allow local privilege escalation to System through a link-following flaw.
  • The updates address 723 Windows flaws and 222 Office bugs, alongside fixes in SQL, Developer Tools, SharePoint Server, Azure, Skype for Business, and Exchange Server.
  • Microsoft also released critical Servicing Stack Updates for Windows Server 2012, Windows Server 2012 R2, and Windows 10 Version 1607/Server 2016.
  • ZDI's Dustin Childs says 20 patched vulnerabilities could be wormable because they allow unauthenticated remote code execution without user interaction.
  • Experts quoted in the article recommend prioritizing patches according to which vulnerabilities apply to an organization and are reachable and exploitable.

Article Details

Event Type
Microsoft released September 2026 Patch Tuesday updates fixing 974 vulnerabilities across its products, including two zero-days reported as exploited in the wild.
Impact
CVE-2026-85880 affects Windows ALPC and could let a local attacker escape an AppContainer sandbox and elevate privileges to System. CVE-2026-81963 affects the Windows Update Stack and could let a local attacker elevate privileges to System. Microsoft also patched vulnerabilities across Windows, Office, SQL, Developer Tools, SharePoint Server, Azure, Skype for Business, and Exchange Server; 20 vulnerabilities were described as potentially wormable because they allow unauthenticated remote code execution without user interaction.

CVE

CVE-2026-55007Some of the issues that deserve special attention include CVE-2026-55007 (remote code execution (RCE) in Exchange Server), CVE-2026-80097 (elevation of privilege (EoP) in Authenticator), CVE-2026-69465 (RCE inCVE-2026-65669CVE-2026-80097 (elevation of privilege (EoP) in Authenticator), CVE-2026-69465 (RCE in SharePoint, CVE-2026-65669 (EoP in SQL Server), and CVE-2026-69525 (RCE in Remote Desktop Services), ZDI’s Dustin Childs says.CVE-2026-69465execution (RCE) in Exchange Server), CVE-2026-80097 (elevation of privilege (EoP) in Authenticator), CVE-2026-69465 (RCE in SharePoint, CVE-2026-65669 (EoP in SQL Server), and CVE-2026-69525 (RCE in Remote DesktopCVE-2026-69525(EoP) in Authenticator), CVE-2026-69465 (RCE in SharePoint, CVE-2026-65669 (EoP in SQL Server), and CVE-2026-69525 (RCE in Remote Desktop Services), ZDI’s Dustin Childs says.CVE-2026-80097deserve special attention include CVE-2026-55007 (remote code execution (RCE) in Exchange Server), CVE-2026-80097 (elevation of privilege (EoP) in Authenticator), CVE-2026-69465 (RCE in SharePoint, CVE-2026-65669CVE-2026-81963The second zero-day, CVE-2026-81963, is an improper link resolution before file access (‘link following’) defect in Windows Update Stack, the components used for Windows update installation.CVE-2026-85880The first exploited zero-day, CVE-2026-85880, is a heap buffer overflow issue in the Windows Advanced Local Procedure Call (ALPC) that could allow a local attacker to gain System privileges.

People

Dustin ChildsZDI representative who highlighted vulnerabilities receiving special attention and said 20 newly resolved flaws could be considered wormable.Satnam NarangTenable senior staff research engineer who commented on the ALPC and Update Stack zero-days and vulnerability prioritization.Tyler RegulyFortra associate director who commented on the large number of released patches.

Vendors

MicrosoftMicrosoft on Tuesday rolled out a record number of patches, fixing 974 CVEs across its products, including two vulnerabilities exploited in the wild as zero-days.

Products

Authenticator(remote code execution (RCE) in Exchange Server), CVE-2026-80097 (elevation of privilege (EoP) in Authenticator), CVE-2026-69465 (RCE in SharePoint, CVE-2026-65669 (EoP in SQL Server), and CVE-2026-69525 (RCE inAzureMultiple security issues were also addressed in SQL (62), Developer Tools (22), SharePoint Server (16), Azure (12), Skype for Business (10), and Exchange Server (9).Developer ToolsMultiple security issues were also addressed in SQL (62), Developer Tools (22), SharePoint Server (16), Azure (12), Skype for Business (10), and Exchange Server (9).Microsoft Exchange ServerMultiple security issues were also addressed in SQL (62), Developer Tools (22), SharePoint Server (16), Azure (12), Skype for Business (10), and Exchange Server (9).Microsoft WindowsThe first exploited zero-day, CVE-2026-85880, is a heap buffer overflow issue in the Windows Advanced Local Procedure Call (ALPC) that could allow a local attacker to gain System privileges.OfficeOverall, Microsoft rolled out patches for 723 flaws in Windows and fixed 222 security bugs in its Office suite, including 111 in Office 2016 for this month’s Patch Tuesday.Remote Desktop Services(RCE in SharePoint, CVE-2026-65669 (EoP in SQL Server), and CVE-2026-69525 (RCE in Remote Desktop Services), ZDI’s Dustin Childs says.SharePoint ServerMultiple security issues were also addressed in SQL (62), Developer Tools (22), SharePoint Server (16), Azure (12), Skype for Business (10), and Exchange Server (9).Skype for BusinessMultiple security issues were also addressed in SQL (62), Developer Tools (22), SharePoint Server (16), Azure (12), Skype for Business (10), and Exchange Server (9).SQLMultiple security issues were also addressed in SQL (62), Developer Tools (22), SharePoint Server (16), Azure (12), Skype for Business (10), and Exchange Server (9).Windows 10 Version 1607/Server 2016They apply to Windows Server 2012, Windows Server 2012 R2, and Windows 10 Version 1607/Server 2016.Windows Server 2012They apply to Windows Server 2012, Windows Server 2012 R2, and Windows 10 Version 1607/Server 2016.Windows Server 2012 R2They apply to Windows Server 2012, Windows Server 2012 R2, and Windows 10 Version 1607/Server 2016.

Related Articles