Securify

Microsoft’s September 2026 Patch Tuesday shattered every previous record this week, delivering fixes for nearly 970 security vulnerabilities in a single release — including two zero-day flaws already being exploited in the wild. For defenders, this is a five-alarm event that demands immediate triage.

What Happened

On Tuesday, September 8, Microsoft published its monthly security update addressing between 964 and 973 CVEs (counts vary slightly by source as advisories were revised through the day). By any tally, it is the largest Patch Tuesday in Microsoft’s history, dwarfing July 2026’s previous record of 570 fixes and more than doubling August’s roughly 400.

Of the total, over 100 vulnerabilities carry a Critical severity rating, and two are confirmed zero-days — meaning attackers were already using them before patches became available.

Microsoft attributed the unprecedented volume to its recently deployed AI-powered vulnerability discovery system, which it says identified a wave of previously undetected flaws across the Windows ecosystem. The implication is significant: rather than simply catching up on a backlog, the company is now surfacing vulnerabilities faster than its human teams alone could manage.

The Two Zero-Days

Both actively exploited flaws are elevation-of-privilege (EoP) bugs that let an attacker who already has a foothold on a machine escalate to SYSTEM — the highest privilege level on Windows.

CVE-2026-81963 — Windows Update Stack EoP (CVSS 7.8)

This vulnerability exploits improper link resolution (“link following”) in the Windows Update Stack. A local attacker with low-level access can abuse it to gain full SYSTEM privileges without any user interaction. It is the first Windows Update Stack EoP to be exploited as a zero-day since 2022, and researchers warn that such flaws are quickly incorporated into post-exploitation toolkits. The bug was credited to Romain Deperne and Microsoft’s own Threat Intelligence Centre (MSTIC), suggesting Microsoft caught active exploitation during its own threat-hunting operations.

CVE-2026-85880 — Windows ALPC EoP (CVSS 7.8)

A heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) enables a sandbox escape — an attacker running inside a restricted AppContainer can break out and reach SYSTEM. The flaw affects all supported Windows versions and was discovered by researchers at Volexity and Proofpoint. ALPC EoP zero-days are particularly dangerous because they form the privilege-escalation link in multi-stage attack chains: pair one with a browser or document exploit for initial access, and the attacker owns the box. The last ALPC zero-day of this kind, CVE-2023-21674, was heavily exploited in early 2023.

Beyond the Zero-Days: Critical Flaws That Matter

The sheer volume makes it easy to miss individual critical bugs that deserve attention on their own merits.

DNS and network infrastructure RCEs. CVE-2026-69730, a use-after-free in Windows DNS Server, carries a CVSS of 9.8 and requires no authentication — a crafted packet is enough. Similar unauthenticated RCE flaws hit DHCP Server (CVE-2026-69845, CVE-2026-72979), Message Queuing (CVE-2026-69579), and Netlogon (CVE-2026-72982). For organizations running these services on-premises, any one of these could enable rapid lateral movement without credentials.

Office zero-click threats. Twenty-two Critical RCE vulnerabilities target Microsoft Office, and twelve of them are exploitable through the Outlook Reading Pane or Windows Explorer Preview Pane — meaning a user does not even need to open a malicious file. Three carry CVSS 9.8 scores (CVE-2026-77493, CVE-2026-78510, CVE-2026-78509). These are tailor-made for phishing campaigns.

Hyper-V guest-to-host escapes. Three Critical flaws (CVE-2026-69603, CVE-2026-80083, CVE-2026-72961) allow an attacker inside a virtual machine to break out and compromise the host, potentially gaining the ability to inspect or manipulate memory across all co-resident VMs. For cloud and multi-tenant environments, this is a nightmare scenario.

Kerberos authentication bypass. CVE-2026-69676 (CVSS 8.8) allows a capture-replay attack against Windows Kerberos, enabling ticket-granting manipulation. Kerberos attacks are a known favorite of ransomware operators and advanced persistent threat groups.

A Complication: The ShieldCrash PoC

Adding pressure, a security researcher known as MSNightmare released a proof-of-concept exploit dubbed “ShieldCrash” targeting CVE-2026-69414, a Microsoft Defender vulnerability the researcher claims was incompletely patched. The PoC reportedly enables SYSTEM-level file reads and potential privilege escalation. No official mitigation was available at the time of publication, leaving defenders in the uncomfortable position of patching nearly a thousand flaws while also monitoring for exploitation of one that remains open.

Who Is Affected

Virtually every organization running Windows. The patches span more than 150 components, including Windows kernel, Active Directory, Exchange Server, Remote Desktop Services, Azure services, SQL Server, and the full Office suite. CrowdStrike’s analysis noted 726 of the patches target Microsoft Windows directly, with 650 also relevant to systems under Extended Security Updates.

What You Should Do Now

Prioritize the two zero-days. CVE-2026-81963 and CVE-2026-85880 are actively exploited. Patch them first on all Windows endpoints and servers.

Address the network-facing CVSS 9.8 bugs next. DNS, DHCP, MSMQ, and Netlogon RCE flaws are unauthenticated and remotely exploitable — they are prime candidates for wormable or mass-exploitation scenarios.

Review Office and Outlook configurations. If you cannot patch immediately, consider disabling the Preview Pane as a temporary mitigation for the zero-click Office RCEs.

Audit Hyper-V deployments. The guest-to-host escapes are Critical for any organization using on-premises virtualization or hosting multi-tenant workloads.

Monitor for ShieldCrash exploitation. Watch Microsoft’s advisory channels for an updated fix to CVE-2026-69414. In the meantime, endpoint detection rules targeting anomalous Defender behavior may offer partial coverage.

Don’t stop at patching. As CrowdStrike emphasized in its analysis, organizations should develop response plans for scenarios where no patch exists. The ShieldCrash situation is a live example of exactly that. Holistic security posture — network segmentation, least privilege, detection-in-depth — remains essential.

---

This Patch Tuesday is not business as usual. The combination of record volume, active exploitation, zero-click Office vectors, and an unpatched Defender PoC makes September 2026 one of the most consequential patch cycles in recent memory. Treat it accordingly.

Sources: BleepingComputer, Tenable, CrowdStrike, GBHackers