The Services Behind the September Patch Wave: Measuring Which Windows Interfaces Are Actually Reachable

Microsoft's September 2026 release fixed 974 CVEs, including a large group of CVSS 9.8 remote code execution flaws in Windows network services. The list is long enough that triage by score alone stops being useful: DNS Server, Remote Desktop Services, the NFS ONCRPC XDR driver, Netlogon, the DHCP Server, the Routing and Remote Access Service, SSTP, the print spooler path, and Message Queuing all appear with pre-authentication or low-privilege RCE ratings.

Not all of those services are equally reachable. That distinction is the one that determines whether a patch is urgent or routine, and it is measurable.

Turning a CVE list into a reachability list

The useful question for each affected service is: how often is it exposed to a network where an attacker can reach it?

Some of these services are designed to be reachable. A DNS server answers queries from anywhere that can route to it. A DHCP server responds to broadcast traffic on its local segment. A Remote Desktop endpoint is reachable by design, subject to authentication.

Others are usually internal. The NFS ONCRPC XDR driver and Message Queuing are typically deployed inside a network boundary rather than on the internet edge. Their CVSS score does not change that, but it does change the priority order.

Internet measurement helps separate the two groups. A query for a specific service port or banner returns the population of hosts that present that service to the open internet. That population is the set of systems where an unauthenticated remote flaw is immediately exploitable by anyone with a scanner.

Reading the results correctly

Exposure counts for Windows services need the same caveats that apply to any measurement.

Port reachability is not service confirmation. A host with port 3389 open is running something on the Remote Desktop port. It may be a Windows RDP endpoint, or it may be a different service that happens to listen there. Confirming the service requires a banner, a certificate or a protocol handshake.

Reachability is not vulnerability. A reachable RDP endpoint may be fully patched and require multi-factor authentication. The measurement establishes that the service is exposed, which is the precondition for exploitation, not evidence that exploitation is possible.

The exposed population is a subset. Most enterprise Windows servers are behind a firewall and never appear in an external scan. A count of reachable endpoints is a lower bound on the deployed population, and it is the subset that matters most for unauthenticated flaws.

Geography follows hosting. Cloud and hosting networks concentrate large numbers of exposed services in a small number of countries. A country-level breakdown of reachable RDP or DNS endpoints says more about where hosting providers operate than about where the affected organisations are.

A practical order of work

Given the September release, a reachability-informed triage looks like this.

First, the two exploited privilege escalations. CVE-2026-81963 and CVE-2026-85880 were being exploited before the patch shipped. They are local escalation flaws, so they are not gated by internet exposure, and every unpatched host is a candidate. This is the highest-priority group regardless of what the exposure data shows.

Second, exposed pre-authentication RCE. For each affected service, check whether it is reachable from outside the network boundary. A DNS server that answers queries from the internet, an RDP endpoint that accepts connections from anywhere, or an RRAS or SSTP service on a public interface are all directly exploitable by an unauthenticated attacker. Those systems should be patched first and, where possible, have their exposure reduced.

Third, internal-only services. The NFS ONCRPC XDR driver, Message Queuing and the print spooler path are typically reachable only from inside the network. They still matter, because an attacker who already has a foothold can use them to move laterally, but they do not carry the same immediate risk as an internet-facing DNS server.

Fourth, verify the exposure change. Where a service was reachable and has been restricted, re-running the same query confirms the change from outside. A firewall rule that was intended to block a port is not the same as a port that no longer responds.

Why this matters more than the CVE count

A release with hundreds of CVEs creates pressure to patch everything at once, which in practice means patching nothing on schedule. The reachability question cuts the list down to the systems where an unauthenticated attacker can act without any prior access.

That is a smaller list, and it is defensible. It is also the list that a measurement programme can produce quickly: for each affected service, one query establishes whether the service is exposed, and the answer determines whether the patch belongs in this week's window or the next one.

For a month where the two exploited flaws were local escalations rather than remote bugs, the exposure data is most useful for the opposite reason. It shows which of the many remote flaws are actually reachable, so that attention can stay on the two that were already being used.

References

• Microsoft Security Response Center advisories for the September 2026 release, including CVE-2026-81963 and CVE-2026-85880.
• CISA Known Exploited Vulnerabilities catalog entries added 8 September 2026.
• ZoomEye cyberspace search engine documentation for service and port queries.