Patch Tuesday September 2026: 2 Zero-Days, 119 Critical Fixes Among 1186 CVEs

Ian Bishop — Wed, 09 Sep 2026 19:48:35 +0000

Microsoft's September 2026 security update addresses 1186 vulnerabilities: 119 rated Critical, 913 Important. 2 are already exploited in the wild and 0 were publicly disclosed before today.

This is a big patch batch — 1,186 CVEs total — but the real story is three vulnerabilities already in CISA's KEV catalog, two of them zero-days actively exploited before today's release. Neither of the exploited Windows bugs was publicly disclosed ahead of the patch, so there's no advance warning you missed, but that also means attackers had a head start you didn't.

Prioritize the KEV-listed items below over the raw volume of Important-rated EoP and RCE bugs padding out the rest of this month's release.

Patch these first

CVE-2026-81963 (Important, CVSS 7.8) — Windows Update Stack: Elevation of Privilege — exploited in the wild, CISA KEV
CVE-2026-85880 (Important, CVSS 7.8) — Windows ALPC: Elevation of Privilege — exploited in the wild, CISA KEV
CVE-2026-85046 (CVSS 0.0) — Microsoft Edge (Chromium-based): see advisory — CISA KEV

CVE-2026-81963 (Windows Update Stack, EoP, CVSS 7.8): improper link resolution — a classic link-following flaw — lets an authorized local attacker escalate privileges. It's exploited in the wild and KEV-listed, so treat any endpoint running the Windows Update Stack as exposed and patch it today.

CVE-2026-85880 (Windows ALPC, EoP, CVSS 7.8): a heap-based buffer overflow in ALPC that also allows local privilege escalation by an authorized attacker. Also exploited and KEV-listed — ALPC is a core Windows IPC mechanism, so this affects essentially every supported Windows version and should be patched alongside the Update Stack bug.

CVE-2026-85046 (Microsoft Edge, Chromium-based): this one comes from the Chromium side — Microsoft Edge ingests a Chrome fix for a vulnerability Google says has an exploit in the wild. Make sure Edge is set to auto-update or push the update manually; don't assume your Windows patching cadence covers browser components.

Also notable

CVE-2026-69525 (Important, CVSS 9.8) — Windows Remote Desktop Services: Remote Code Execution
CVE-2026-69730 (Critical, CVSS 9.8) — Windows DNS: Remote Code Execution
CVE-2026-69854 (Critical, CVSS 9.0) — Spring Cloud Azure: Elevation of Privilege
CVE-2026-69676 (Critical, CVSS 8.8) — Windows Kerberos: Remote Code Execution
CVE-2026-69857 (Critical, CVSS 8.5) — Azure Cosmos DB: Spoofing
CVE-2026-68880 (Important, CVSS 8.0) — Windows Win32K: Elevation of Privilege
CVE-2026-69301 (Important, CVSS 8.0) — Windows Win32K: Elevation of Privilege
CVE-2026-72940 (Important, CVSS 8.8) — Windows Schannel: Remote Code Execution

By the numbers

Elevation of Privilege: 438
Remote Code Execution: 258
Unspecified: 213
Information Disclosure: 173
Denial of Service: 56
Security Feature Bypass: 19
Spoofing: 16
Tampering: 13

Source: Microsoft Security Update Guide and the CISA KEV catalog.

Subscribe free → I write a curated cybersecurity news roundup, including this breakdown each Patch Tuesday. Get it in your inbox.

Patch Tuesday August 2026: 1 Zero-Day, 109 Critical Fixes Among 790 CVEs

Ian Bishop — Thu, 13 Aug 2026 19:04:33 +0000

Microsoft's August 2026 security update addresses 790 vulnerabilities: 109 rated Critical, 396 Important. 1 is already exploited in the wild and 2 were publicly disclosed before today.

This month's headline is a single actively exploited zero-day: CVE-2026-68820, a use-after-free EoP in the Windows Ancillary Function Driver for WinSock, already confirmed in KEV. It's the one CVE in this 790-fix batch you cannot leave for next week. Beyond that, the release is heavy on volume — 109 critical and 111 RCE fixes — but light on other confirmed exploitation, with two publicly disclosed EoP/tampering bugs in User Profile Service and the Container Isolation FS Filter Driver rounding out the disclosed-but-not-yet-exploited list.

Patch these first

CVE-2026-68820 (Important, CVSS 7.0) — Windows Ancillary Function Driver for WinSock: Elevation of Privilege — exploited in the wild, CISA KEV

CVE-2026-68820 (Windows Ancillary Function Driver for WinSock, CVSS 7.0): a use-after-free that lets an already-authenticated local attacker elevate privileges to SYSTEM. It's marked exploited in the wild and is in KEV, so treat it as your top priority patch this cycle regardless of platform — AFD.sys underpins core networking on every supported Windows version, meaning any endpoint or server where a low-priv user or process can execute code is a viable target for local privilege escalation chains. Patch this today.

Publicly disclosed

CVE-2026-62832 (Important, CVSS 7.8) — Windows User Profile Service: Elevation of Privilege — publicly disclosed
CVE-2026-72971 (Important, CVSS 5.5) — Windows Container Isolation FS Filter Driver (unionfs.sys): Tampering — publicly disclosed

Also notable

CVE-2026-65665 (Critical, CVSS 8.8) — Microsoft Office SharePoint: Remote Code Execution
CVE-2026-63520 (Important, CVSS 8.1) — Microsoft Office SharePoint: Remote Code Execution
CVE-2026-59124 (Important, CVSS 9.8) — Microsoft High Performance Computing (HPC) Pack: Remote Code Execution
CVE-2026-62893 (Critical, CVSS 9.8) — Windows Deployment Services: Remote Code Execution
CVE-2026-59133 (Important, CVSS 8.8) — Microsoft High Performance Computing (HPC) Pack: Elevation of Privilege
CVE-2026-62823 (Critical, CVSS 8.8) — Windows DHCP Server: Remote Code Execution
CVE-2026-56162 (Critical, CVSS 10.0) — Azure SQL Database: Elevation of Privilege
CVE-2026-50481 (Critical, CVSS 9.9) — Azure Active Directory: Elevation of Privilege

By the numbers

Unspecified: 369
Elevation of Privilege: 176
Remote Code Execution: 111
Information Disclosure: 86
Spoofing: 21
Denial of Service: 12
Security Feature Bypass: 11
Tampering: 4

Source: Microsoft Security Update Guide and the CISA KEV catalog.

Subscribe free → I write a curated cybersecurity news roundup, including this breakdown each Patch Tuesday. Get it in your inbox.

DEV Community: Ian Bishop

Patch Tuesday September 2026: 2 Zero-Days, 119 Critical Fixes Among 1186 CVEs

Patch these first

Also notable

By the numbers

Patch Tuesday August 2026: 1 Zero-Day, 109 Critical Fixes Among 790 CVEs

Patch these first

Publicly disclosed

Also notable

By the numbers