Login
Microsoft Patch Tuesday Hits Record 974 CVEs, Two Exploited
9 September 2026 at 02:51
Scale of Patch Tuesday September 2026Β
SQL Server products saw 62 CVEs resolved, Developer Tools had 22, SharePoint Server received 16 fixes, Azure had 12, Skype for Business had 10, and Exchange Server accounted for 9. More than 110 of the vulnerabilities patched carry a critical severity rating, and nearly 90% of the total fall into three categories: privilege escalation, remote code execution, and information disclosure. Β Factoring in fixes for 25 non-Microsoft CVEs, the combined total for this Patch Tuesday September 2026 cycle reaches 999 resolved vulnerabilities.Β This release continues a pattern of escalating patch volumes from Microsoft in recent months β 457 CVEs were addressed in August, 663 in July, 220 in June, and 161 in May, making September's numbers a significant jump even against that backdrop.ΒThe Two Exploited Zero-DaysΒ
Central to this month's Patch Tuesday September 2026 update are two CVEs that Microsoft confirmed had been exploited before patches were issued.Β The first, CVE-2026-85880 (CVSS 7.8), is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component. It allows an attacker with local access to escalate privileges and obtain SYSTEM-level control. Microsoft's advisory states that an attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system, with no additional user interaction required.Β The second actively exploited flaw, CVE-2026-81963 (CVSS 7.8), stems from improper link resolution within the Windows Update Stack. Like the ALPC bug, it enables a local, authorized attacker to escalate privileges and gain SYSTEM access.Β Both CVEs have since been added to the Known Exploited Vulnerabilities (KEV) catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Federal Civilian Executive Branch agencies now face a September 22, 2026 deadline to apply the relevant patches.ΒOther Notable CVEs Worth TrackingΒ
Beyond the zero-days, several other CVEs patched in this Patch Tuesday September 2026 batch carry high severity scores and warrant prompt attention from Microsoft administrators:Β- CVE-2026-55007 (CVSS 8.1) β a double-free flaw in Microsoft Exchange Server enabling remote code executionΒ
- CVE-2026-80097 (CVSS 8.6) β improper authentication in Microsoft Authenticator allowing local privilege escalationΒ
- CVE-2026-69465 (CVSS 8.8) β missing authorization in Microsoft Office SharePoint permitting remote code executionΒ
- CVE-2026-65669 (CVSS 9.6) β an injection flaw in SQL Server enabling remote privilege escalationΒ
- CVE-2026-69525 (CVSS 9.8) β use-after-free in Windows Remote Desktop Services allowing remote code executionΒ
- CVE-2026-69595 (CVSS 9.8) β use-after-free in the Windows Services for NFS ONCRPC XDR DriverΒ
- CVE-2026-69730 (CVSS 9.8) β use-after-free in the Windows DNS serverΒ
- CVE-2026-69829 (CVSS 9.8) β heap-based buffer overflow in Windows ShellΒ
- CVE-2026-72979 (CVSS 9.8) β use-after-free in the Windows DHCP ServerΒ
