Microsoft Patch Tuesday Analysis – September 2026

Executive Summary

On Tuesday, September 8, 2026, Microsoft released its monthly security update, addressing 973 vulnerabilities across its products.

By Severity Level:

• Important - 860;
• Critical - 113.

Exploited (Zero-Days) and Publicly Disclosed Vulnerabilities

Special attention should be paid to the following 2 vulnerabilities. Patching them is the highest priority:

• CVE-2026-81963 (CVSS 7.8; Important) - Windows Update Stack Elevation of Privilege Vulnerability (Elevation of Privilege). A local vulnerability in the Windows Update Stack related to improper handling of symbolic links prior to file access (link following / CWE-59). An authenticated attacker with low privileges can exploit file operation redirection by a system component to manipulate protected file system objects, allowing privilege escalation to the SYSTEM level.
• CVE-2026-85880 (CVSS 7.8; Important) - Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (Elevation of Privilege). A heap-based buffer overflow and uninitialized resource vulnerability in the Windows ALPC inter-process communication mechanism. The flaw allows a local attacker executing code with low privileges (e.g., inside an isolated AppContainer) to bypass sandbox restrictions (sandbox escape) and escalate privileges to the SYSTEM level without requiring user interaction.

General Trends

The September 2026 Patch Tuesday is rightfully considered a record-breaking release. Microsoft published fixes for 973 vulnerabilities, 113 of which are classified as "Critical." This volume exceeds even the staggering numbers from July (622) and points to a global, foundational overhaul of security across entire Windows and Azure ecosystems. Installing this volume of updates within standard operational procedures is nearly impossible. Key trends of this release:

• Two Actively Exploited Zero-Days: Two privilege escalation vulnerabilities are already being exploited in the wild — in the Windows Update Stack (CVE-2026-81963) and the ALPC mechanism (CVE-2026-85880). The second is particularly dangerous, as it allows attackers to escape isolated sandboxes (AppContainer) and gain SYSTEM privileges. These are prime tools for persistence following successful phishing campaigns or web vulnerability exploits.
• Maximum Threat (CVSS 10.0 and 9.9) for Cloud and AI: September has become a critical month for cloud infrastructure. Maximum-severity vulnerabilities threaten foundational identity and management services: Azure AD B2C, Entra ID Provisioning Service, and Azure AI Language. Exploiting these flaws implies full compromise of an organization's cloud perimeter and user databases.
• Network Apocalypse (Mass RCE CVSS 9.8): The release contains dozens of critical Remote Code Execution vulnerabilities in key network nodes. The highest-risk zones include DNS, DHCP, RRAS servers, Message Queuing (MSMQ) services, and Skype for Business. These vulnerabilities do not require authentication and are ideal for creating network worms capable of paralyzing corporate network operations within minutes.
• Endless Stream of Client-Side Threats: The Microsoft Office suite (especially Excel and Word), as well as media-handling components (Media Foundation, GDI+, XPS), received hundreds (!) of RCE fixes. This means attackers still maintain a vast arsenal for crafting malicious files that bypass operating system defenses.
• Foundational File System Flaws: Strikingly, there are numerous RCE and EoP fixes for file system drivers (NTFS, ReFS). Low-level kernel flaws are extremely hazardous because they are processed by the OS kernel before high-level antivirus scanners can intervene.

Full List of Vulnerabilities

The table below lists all the vulnerabilities patched this month.