Microsoft September 2026 Patch Tuesday Patches a Record 973 Vulnerabilities: Update-Stack and ALPC Privilege-Escalation Zero-Days Exploited in the Wild

Microsoft's September Patch Tuesday patches a record 973 vulnerabilities. Two privilege-escalation zero-days in the Windows update stack and ALPC are exploited in the wild and added to the CISA KEV catalog. Prioritize the DNS Server 9.8 RCE.

Microsoft released the September 2026 security updates on September 8, patching 973 vulnerabilities — a Patch Tuesday record. Two privilege-escalation zero-days — Windows update stack CVE-2026-81963 and Windows ALPC CVE-2026-85880 — are confirmed exploited in the wild and were added to the CISA KEV catalog on release day. Environments running Windows 11 and Windows Server 2025 should complete updates promptly.

Incident Overview

This month's updates cover Windows, Exchange Server, Office, Teams, and other product lines. 113 vulnerabilities are rated Critical; 58 are marked Exploitation More Likely by Microsoft. The patch count exceeds July (576) and August (428) combined, setting a record for the third consecutive month. All CVEs are 2026-issued. Microsoft attributed part of the surge to deployment of AI-assisted vulnerability discovery.

Two Zero-Days Exploited in the Wild

CVE-2026-81963: Windows Update Stack Privilege Escalation

CVSS 7.8, local privilege escalation. The attacker needs a low-privilege foothold first, then abuses link-resolution and access-control flaws in the update stack to escalate to SYSTEM. Microsoft confirmed in-the-wild exploitation. Note: the update stack is the component defenders rely on to clear persistence. If an attacker controls it, incident response becomes significantly harder.

CVE-2026-85880: Windows ALPC Privilege Escalation

Caused by an untrusted pointer dereference. Also exploited in the wild and added to the KEV catalog. Successful exploitation elevates to Virtual Trust Level 1 (VTL1). Requires relatively high existing privileges; no user interaction.

Other High-Severity Vulnerabilities

• CVE-2026-69730: Windows DNS Server remote code execution, CVSS 9.8. Use-after-free. Unauthenticated, no user interaction, low attack complexity. Because Microsoft installs the DNS role on domain controllers by default, this is equivalent to code execution on the DC in most on-prem environments. Affects Windows Server 2012 through 2025.
• CVE-2026-69829: Windows Shell heap buffer overflow. A network attacker can trigger it remotely with no privileges.
• CVE-2026-69595 / 78445: NFS ONCRPC XDR driver use-after-free. A single crafted packet can trigger unauthenticated code execution.
• CVE-2026-69676: Kerberos remote code execution, CVSS 8.8. Requires an authenticated low-privilege attacker. Second reason to patch domain controllers this week.

Remediation

• Deploy the September cumulative updates immediately via Windows Update or WSUS. Prioritize the two KEV zero-days and the DNS Server RCE.
• Hunt endpoints with unknown or long-stale update status — if you cannot confirm how long the update stack has been running, you cannot confirm the fix.
• Monitor for SYSTEM-level processes spawned from standard-user sessions, especially those touching the update catalog or update service.
• Windows 10 and older server versions are not affected by CVE-2026-81963, but the DNS Server vulnerability covers all versions from Windows Server 2012 onward.

References

• Automox – Patch Tuesday September 2026: CVE Analysis
• ThreatCluster – Microsoft September 2026 Patch Tuesday Addresses 973 Vulnerabilities
• Action1 – Patch Tuesday September 2026