Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)
- 104Critical
- 860Important
- 0Moderate
- 0Low
Microsoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild.
Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 104 rated critical and 860 rated as important.
This month’s update includes patches for:
- .NET
- .NET and Visual Studio
- ASP.NET Core
- Active Directory Certificate Services (AD CS)
- Active Directory Domain Services
- Active Directory Federation Services (AD FS)
- Audio Video Control Transport Protocol
- Azure Arc
- Azure CycleCloud
- Azure HDInsights
- BranchCache
- Connected Devices Platform Service (Cdpsvc)
- Data Sharing Service Client
- GitHub Copilot and Visual Studio Code
- Graphic Fonts
- HID class driver
- IP Helper
- Internet Storage Name Service
- Kernel Streaming WOW Thunk Service Driver
- Microsoft Account
- Microsoft Authenticator
- Microsoft Azure Attestation service and Device Health Attestation Service
- Microsoft Azure CLI
- Microsoft COM for Windows
- Microsoft Dynamics 365
- Microsoft Exchange Server
- Microsoft Graphics Component
- Microsoft Install Service
- Microsoft JScript
- Microsoft Local Security Authority Server (lsasrv)
- Microsoft Office
- Microsoft Office Access
- Microsoft Office Excel
- Microsoft Office Outlook
- Microsoft Office PowerPoint
- Microsoft Office Publisher
- Microsoft Office SharePoint
- Microsoft Office Word
- Microsoft Standard XPS
- Microsoft Teams for Android
- Microsoft Trace Data Helper
- Microsoft UxTheme Library (uxtheme.dll)
- Microsoft WDAC OLE DB provider for SQL
- Microsoft WebP Image Extension
- Microsoft Windows Codecs Library
- Microsoft Windows Media Foundation
- Microsoft Windows PDF
- Microsoft Windows SCSI Class System File
- Microsoft Windows Search Component
- Microsoft Windows Speech
- OpenSSH for Windows
- Power Automate
- Push Message Routing Service
- RPC Runtime
- Reliable Multicast Transport Driver (RMCAST)
- Remote Desktop Client
- Remote Desktop Gateway Service
- Role: DNS Server
- Role: Windows Fax Service
- SQL Server
- Skype for Business
- Spring Cloud Azure
- Storage Port Driver
- Telnet Client
- Virtual Hard Disk (VHD) Miniport Driver
- Visual Studio
- Visual Studio Code
- Volume Manager Driver
- Windows AF_UNIX Socket Provider
- Windows ALPC
- Windows Accounts Control
- Windows Ancillary Function Driver for WinSock
- Windows Audio Service
- Windows Authentication Methods
- Windows Autopilot
- Windows Bind Filter Driver
- Windows Biometric Service
- Windows BitLocker
- Windows Bluetooth Port Driver
- Windows Bluetooth Service
- Windows Boot Manager
- Windows Broadcast DVR User Service
- Windows Broker Infrastructure Service
- Windows CD-ROM Driver
- Windows Camera Frame Server Monitor
- Windows Cloud Files Mini Filter Driver
- Windows Compressed Folder
- Windows Connected User Experiences and Telemetry
- Windows Container Manager Service
- Windows Core Messaging
- Windows Credential Guard
- Windows Credential Providers
- Windows DCOM Server
- Windows DHCP Client
- Windows DHCP Server
- Windows DNS
- Windows DWM Core Library
- Windows Defender Firewall Service
- Windows Deployment Services
- Windows Device Association Broker service
- Windows Device Association Service
- Windows Devices Human Interface
- Windows Direct Show
- Windows Display Enhancement Service
- Windows Distributed File System (DFS)
- Windows Embedded Mode Service
- Windows Encrypting File System (EFS)
- Windows Enterprise App Management
- Windows Error Reporting
- Windows Event Logging Service
- Windows Failover Cluster
- Windows Fast FAT Driver
- Windows File History Service
- Windows GDI
- Windows GDI+
- Windows Graphics Kernel
- Windows Group Policy
- Windows HTTP Print Provider
- Windows HTTP.sys
- Windows Hello
- Windows Host Guardian Service
- Windows Hyper-V
- Windows IKE Extension
- Windows IP Address Management (IPAM) Service
- Windows Image Acquisition
- Windows Imaging Component
- Windows Installer
- Windows Internet Connection Sharing (ICS)
- Windows Kerberos
- Windows Kernel
- Windows Kernel Mode Driver
- Windows Key Distribution Center
- Windows LDAP - Lightweight Directory Access Protocol
- Windows License Manager
- Windows Link Layer Topology Discovery Protocol
- Windows MIDI Service Module
- Windows Management Instrumentation
- Windows Management Services
- Windows Media
- Windows Media Player
- Windows Message Queuing
- Windows Message Queuing Queue Manager
- Windows Microsoft DirectMusic
- Windows Mobile Broadband
- Windows Modern Device Management (MDM)
- Windows Modern Execution Server
- Windows NDIS
- Windows NFS Portmapper
- Windows NTFS
- Windows Netlogon
- Windows Network Connection Broker
- Windows Network File System
- Windows Notification
- Windows OLE DB
- Windows Online Certificate Status Protocol (OCSP)
- Windows Overlay Filter
- Windows Paint
- Windows Partition Management Driver
- Windows Performance Monitor
- Windows Power Dependency Coordinator
- Windows PowerShell
- Windows Print Spooler Components
- Windows PrintWorkflowUserSvc
- Windows Program Compatibility Assistant Service
- Windows Push Notifications
- Windows RDP Client
- Windows RNDIS
- Windows Raw Image Extension
- Windows Registry
- Windows Remote Access Connection Manager
- Windows Remote Desktop
- Windows Remote Desktop Licensing Service
- Windows Remote Desktop Protocol
- Windows Remote Desktop Services
- Windows Resilient File System (ReFS)
- Windows Resilient File System (ReFS) Deduplication Service
- Windows Routing and Remote Access Service (RRAS)
- Windows SMB Client
- Windows SMB Server
- Windows SMB Server Network Transport Driver (srvnet.sys)
- Windows Schannel
- Windows Secure Boot
- Windows Secure Kernel Mode
- Windows Secure Socket Tunneling Protocol (SSTP)
- Windows Security Center
- Windows Security Health Service
- Windows Server
- Windows Services for NFS ONCRPC XDR Driver
- Windows Setup Files Cleanup
- Windows Shell
- Windows Smart Card
- Windows Spaceport.sys
- Windows Storage
- Windows Storage Management Provider
- Windows Storage Port Driver
- Windows Storage Spaces Controller
- Windows TCP/IP
- Windows Task Scheduler
- Windows Text Shaping
- Windows URL Moniker
- Windows USB Audio Class driver (usbaudio.sys)
- Windows USB Driver
- Windows USB Hub Driver
- Windows USB Mass Storage Class Driver
- Windows USB Video Driver
- Windows Universal Disk Format File System Driver (UDFS)
- Windows Universal Plug and Play (UPnP) Device Host
- Windows Update Stack
- Windows VHD miniport driver
- Windows VOLSNAP.SYS
- Windows Virtual Trusted Platform Module
- Windows Volume Manager Extension Driver
- Windows Volume Shadow Copy
- Windows Web Platform Storage
- Windows WebClient Service
- Windows Win32 Kernel Subsystem
- Windows Win32K
- Windows Wireless Networking
- Windows Wireless Wide Area Network Service
- Windows Work Folder Service
- Windows Work Folders
- Windows exFAT File System
- Windows iSCSI
- Windows iSCSI Target Service
- Winsock
- XBox Gaming Services
- Xbox
Elevation of privilege (EoP) vulnerabilities accounted for 44.7% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 26.8%.
CVE-2026-81963 | Windows Update Stack elevation of privilege vulnerability
CVE-2026-81963 is an EoP vulnerability affecting Windows Update Stack elevation of privilege vulnerability. It received a CVSSv3 score of 7.8 and was rated as important. According to Microsoft, this vulnerability was exploited in the wild as a zero-day.
Windows Update Stack contains a link following vulnerability. An attacker could exploit this vulnerability to elevate to SYSTEM privileges.
Since 2022, seven Windows Update Stack EoP vulnerabilities have been patched across Patch Tuesday releases, but CVE-2026-81963 is the first to have been exploited in the wild as a zero-day.
CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) elevation of privilege vulnerability
CVE-2026-85880 is a EoP vulnerability affecting Windows Advanced Local Procedure Call (ALPC). It received a CVSSv3 score of 7.8 and is rated as important. According to Microsoft, this vulnerability was exploited in the wild, making it one of two zero-days addressed in the September Patch Tuesday release. Successful exploitation would allow an attacker to gain SYSTEM level privileges.
There have been 16 vulnerabilities patched in ALPC since 2022, but this is the first to be included in Patch Tuesday in more than three years (April 2023) and the second to be exploited as a zero-day since CVE-2023-21674 as part of the January 2023 Patch Tuesday.
CVE-2026-69380 | Microsoft Exchange Server elevation of privilege vulnerability
CVE-2026-69380 is an EoP in Microsoft Exchange Server. It received a CVSSv3 score of 8.1 and is rated as important. This is a missing authorization vulnerability. An authenticated attacker with access to a mailbox through a low-user privilege user account could exploit this vulnerability to gain access to other mailboxes. Successful exploitation would allow the attacker to send and receive emails as other Exchange users as well as access attachments. Despite the high CVSS score, this vulnerability is rated as “Exploitation Less Likely” according to the Microsoft Exploitability Index.
CVE-2026-69525 | Remote Desktop Services remote code execution vulnerability
CVE-2026-69525 is an RCE vulnerability affecting Remote Desktop Services. It received a CVSSv3 score of 9.8 and is rated as important. Successful exploitation of this flaw would allow an attacker to execute arbitrary code by exploiting a use-after-free flaw. Microsoft assesses this vulnerability as “Exploitation More Likely.”
In addition to CVE-2026-69525, three RCEs in Remote Desktop Services were also patched this month. While each were rated as important, they differed in their CVSS scoring and exploitability rating as noted in the table below:
| CVE | CVSSv3 | Exploitability Assessment |
|---|---|---|
| CVE-2026-69514 | 7.5 | Exploitation Unlikely |
| CVE-2026-69539 | 7.5 | Exploitation Unlikely |
| CVE-2026-69599 | 7.5 | Exploitation Less Likely |
| CVE-2026-69536 | 7.1 | Exploitation Less Likely |
CVE-2026-69730 | Windows DNS Server remote code execution vulnerability
CVE-2026-69730 is an RCE vulnerability affecting Windows DNS Server. It received a CVSSv3 score of 9.8 and is rated Critical. According to the advisory, an unauthenticated, remote attacker could send a crafted packet to exploit a use-after-free flaw in Windows DNS in order to achieve remote code execution. Microsoft assesses this flaw as “Exploitation More Likely.”
Eight additional RCEs in Windows DNS Server were patched this month, however they did not achieve the same exploitability assessment as CVE-2026-69730. These eight are outlined in the table below:
| CVE | CVSSv3 | Severity | Exploitability Assessment |
|---|---|---|---|
| CVE-2026-69551 | 8.8 | Important | Exploitation Less Likely |
| CVE-2026-69813 | 8.1 | Critical | Exploitation Less Likely |
| CVE-2026-69858 | 8.1 | Critical | Exploitation Unlikely |
| CVE-2026-77505 | 8.1 | Critical | Exploitation Less Likely |
| CVE-2026-69782 | 8.1 | Important | Exploitation Unlikely |
| CVE-2026-69827 | 8.1 | Critical | Exploitation Unlikely |
| CVE-2026-69989 | 8.1 | Important | Exploitation Unlikely |
| CVE-2026-72928 | 7.5 | Important | Exploitation Less Likely |
CVE-2026-69676 | Windows Kerberos remote code execution vulnerability
CVE-2026-69676 is an RCE vulnerability affecting Windows Kerberos. It received a CVSSv3 score of 8.8 and is rated critical. An attacker with low-level access could exploit this authentication bypass flaw using capture-replay against Windows Kerberos in order to execute arbitrary code. Microsoft assesses this flaw as “Exploitation More Likely.”
Tenable Solutions
A list of all the plugins released for Microsoft’s September 2026 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.
For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.
Get more information
- Microsoft's September 2026 Security Updates
- Tenable plugins for Microsoft September 2026 Patch Tuesday Security Updates
Join Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
Learn more
- Exposure Management
- Vulnerability Management
Tenable One
Request a demo
The world’s leading AI-powered exposure management platform.
Thank You
Thank you for your interest in Tenable One.
A representative will be in touch soon.
Form ID: 7469
Form Name: one-eval
Form Class: c-form form-panel__global-form c-form--mkto js-mkto-no-css js-form-hanging-label c-form--hide-comments
Form Wrapper ID: one-eval-form-wrapper
Confirmation Class: one-eval-confirmform-modal
Simulate Success