Summary
This bulletin covers Microsoft’s Sept 8, 2026 Patch Tuesday release, and prioritizes the two actively exploited zero-day vulnerabilities: CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC) and CVE-2026-81963 in the Windows Update Stack. With over 110 flaws assigned Critical severity, this release also includes high-impact remote code execution vulnerabilities affecting Windows DNS Server, Remote Desktop Services, DHCP Server, Windows Shell, Exchange Server, SharePoint, and SQL Server, among other Microsoft products.
Key Updates:
- On Sept 8, 2026, Microsoft released fixes for 974 vulnerabilities across Microsoft products, plus 25 non-Microsoft CVEs, bringing the total to 999. This includes two actively exploited elevation of privilege vulnerabilities tracked as CVE-2026-85880 and CVE-2026-81963.
- CVE-2026-85880 (CVSS 7.8) is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) that allows an authorized attacker to elevate privileges locally and gain SYSTEM privileges. Exploitation requires code execution in a low-privilege AppContainer. No user interaction is needed.
- CVE-2026-81963 (CVSS 7.8) is an improper link resolution vulnerability in the Windows Update Stack that allows an authorized attacker to elevate privileges locally and gain SYSTEM privileges. While Microsoft has patched seven Privilege Escalation flaws affecting the Windows Update stack since 2022, this is the first zero-day, as well as the first to be exploited in the wild.
- Over 110 flaws in this release are assigned Critical severity. The release includes multiple CVSS 9.8-rated remote code execution vulnerabilities, several of which are unauthenticated and require no user interaction, affecting Windows DNS Server (CVE-2026-69730), Remote Desktop Services (CVE-2026-69525), Windows Services for NFS ONCRPC XDR Driver (CVE-2026-69595), Windows DHCP Server (CVE-2026-72979), and Windows Shell (CVE-2026-69829).
- Additional critical vulnerabilities include a double free in Microsoft Exchange Server (CVE-2026-55007, CVSS 8.1), an improper authentication flaw in Microsoft Authenticator on Android (CVE-2026-80097, CVSS 8.6), a missing authorization vulnerability in Microsoft Office SharePoint (CVE-2026-69465, CVSS 8.8), and an injection vulnerability in SQL Server (CVE-2026-65669, CVSS 9.6).
- The vulnerability distribution by product is as follows: Windows (723 flaws), Office and Office 2016 (111 flaws), SQL (62 flaws), and Developer Tools (22 flaws). Privilege escalation, remote code execution, and information disclosure account for nearly 90% of all flaws in this release.
- This release represents a 70% increase over the previous single-month record of 569 Microsoft-only CVEs, previously set in July 2026. According to TrendAI’s Zero Day Initiative, Microsoft has patched 2,760 security flaws year-to-date in 2026, already exceeding 2020’s previous annual record of 1,245 vulnerabilities with three months still remaining in the year.
- Both zero-day vulnerabilities were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, and Federal Civilian Executive Branch (FCEB) agencies are required to apply fixes by 22 Sep 2026.
- At this time there has been no public disclosure of proof of concept (PoC) exploit code for CVE-2026-85880 or CVE-2026-81963; however, both are confirmed as actively exploited in the wild by Microsoft, CISA, and general industry reporting.
- The unprecedented scale of the September 2026 update will create significant operational strain and increase the risk of delayed or incomplete remediation. As noted by security researchers, the challenge is not simply getting through the patch list, but knowing what needs attention first. Immediate triage, focused patching, and enhanced monitoring are essential.
Recommendations
Please follow your organization’s patching and testing guidelines to minimize potential operational impact.
- Prioritize patching the actively exploited zero-days first. Apply the Sept 8, 2026 Microsoft security updates for all affected Windows systems as a top priority. Use the Microsoft Security Update Guide to identify the correct KBs for CVE-2026-85880 and CVE-2026-81963.
- For CVE-2026-85880 (Windows ALPC), identify all Windows systems with services or applications running in low-privilege AppContainers, as exploitation originates from this context. Apply the security update to prevent heap-based buffer overflow exploitation leading to SYSTEM-level privilege escalation.
- For CVE-2026-81963 (Windows Update Stack), apply the update which tightens controls to prevent the Windows Update Stack from following a malicious link. Review systems for any evidence of unexpected privilege escalation activity associated with Windows Update components.
- Address CVSS 9.8 critical remote code execution vulnerabilities as the next priority, particularly those affecting network-facing services: Windows DNS Server (CVE-2026-69730), Remote Desktop Services (CVE-2026-69525), Windows Services for NFS (CVE-2026-69595), DHCP Server (CVE-2026-72979), and Windows Shell (CVE-2026-69829). These vulnerabilities enable unauthenticated, network-based code execution without user interaction.
- Patch Microsoft Exchange Server for CVE-2026-55007 (CVSS 8.1), a double free vulnerability that may be exploitable via malicious attachments. Review Exchange environments for indicators of suspicious attachment processing activity.
- Patch Microsoft Office SharePoint for CVE-2026-69465 (CVSS 8.8) and SQL Server for CVE-2026-65669 (CVSS 9.6). Both enable network-based exploitation and should be prioritized in environments where these services are exposed.
- For organizations using Microsoft Authenticator on Android, apply the update addressing CVE-2026-80097 (CVSS 8.6), which addresses an improper authentication flaw that could allow unauthorized local privilege escalation.
- Given the scale of this release (974 Microsoft CVEs), implement a risk-based triage approach rather than attempting sequential patching. Prioritize by exploitation status, then by CVSS score and exposure, focusing on internet-facing and critical infrastructure systems first.
- Monitor Windows event logs, authentication logs, and network traffic for indicators of privilege escalation, unexpected SYSTEM-level process creation, suspicious ALPC activity, and anomalous Windows Update behavior. Use SIEM or EDR tooling where available to detect post-exploitation activity.
- For environments where immediate patching is not possible, restrict network access to affected services (DNS, RDP, DHCP, NFS) where feasible, enforce network segmentation, and limit exposure of critical infrastructure to untrusted networks.
Temporary Workarounds
Windows ALPC (CVE-2026-85880):
- No vendor-supplied workaround has been identified as a substitute for patching.
- Limit exposure by reviewing and restricting which applications and services run within low-privilege AppContainers where possible.
- Monitor for unusual privilege escalation events and unexpected SYSTEM-level process execution originating from AppContainer contexts.
- Implement application whitelisting and endpoint detection controls to identify anomalous process behavior.
Windows Update Stack (CVE-2026-81963):
- No vendor-supplied workaround has been identified as a substitute for patching.
- Monitor Windows Update Stack components for suspicious link-following behavior and unexpected file system or registry access.
- Restrict local access to authorized administrators and review for any anomalous local authentication or privilege escalation activity on affected systems.
Network-Facing Critical RCE Vulnerabilities (CVSS 9.8):
- For Windows DNS Server (CVE-2026-69730), restrict DNS traffic to trusted sources and networks. Consider deploying alternative DNS infrastructure while patches are tested and applied.
- For Remote Desktop Services (CVE-2026-69525), disable RDP on systems where it is not required, restrict access via Network Level Authentication (NLA), and use VPN or jump servers to limit direct RDP exposure.
- For Windows DHCP Server (CVE-2026-72979) and Windows Services for NFS (CVE-2026-69595), isolate these services to dedicated network segments and restrict access to trusted clients only.
- For Windows Shell (CVE-2026-69829), restrict exposure of affected endpoints to untrusted network traffic and enforce email and web gateway filtering to reduce the attack surface.
Network Mitigations:
- Update IPS and IDS policies where vendors have released detections for the actively exploited zero-days and critical RCE vulnerabilities.
- Enforce network segmentation between critical infrastructure and general user networks to limit lateral movement potential.
NOTE: These workarounds may reduce risk but do not fix the underlying vulnerabilities. Network-level controls may not block all attack variants, particularly for the ALPC and Update Stack zero-days which require local access. Full patching remains the required remediation path.
