September 2026 Patch Tuesday: 964 CVEs, Two Zero-Days

Microsoft shipped 964 CVEs on September 8, and depending on which tracker you read, the real number might be closer to 974. Either way, it’s the biggest Patch Tuesday the program has ever produced, breaking the record July set just two months ago by a wide margin. Two of those fixes are for bugs already being exploited, and neither one is the kind of headline-grabbing remote attack you’d expect from a record-setting month. Both need an attacker who’s already on the box.

The scale, briefly

September 2026 Patch Tuesday fixed 964 CVEs, according to Tenable’s count: 104 rated Critical, 860 rated Important, none rated Moderate or Low. Other outlets reported totals as high as 974, depending on how bundled third-party fixes are counted. Every tracker agrees it’s the largest Patch Tuesday on record.

That discrepancy is worth naming rather than papering over, the same way we flagged the 569-vs-622 gap in July’s record-setting release. Qualys, BleepingComputer, and CrowdStrike each landed somewhere between 966 and 974, and Petri, working from Microsoft’s own advisory metadata, counted 114 Critical flaws rather than 104. The gap comes down to methodology, not disagreement about severity. Whichever number you use, this release clears July’s 622 by a wide margin and stands as the biggest monthly total Microsoft has ever shipped.

Elevation-of-privilege bugs are the largest single category again this month, at 44.7% of the total. Remote code execution comes in second at roughly 26.8%. That split has held steady since June, which tells you something about where Microsoft’s own fuzzing and the research community’s effort are concentrated right now: less on finding new ways in from the internet, more on what an attacker does once they’re already inside.

The two actively exploited zero-days

CVE-2026-81963 (Windows Update Stack) is an elevation-of-privilege vulnerability, CVSS 7.8, that lets a local attacker escalate to SYSTEM privileges. What makes it notable isn’t the score, it’s the location: this is the first Windows Update Stack EoP exploited as a zero-day since 2022. The update stack runs with high trust by design, since it’s the mechanism that installs everything else, so a privilege escalation bug there is a particularly good foothold once an attacker has any presence on the machine at all.

CVE-2026-85880 (Windows ALPC) is a heap-based buffer overflow, also CVSS 7.8, also an elevation-of-privilege bug that hands a local attacker SYSTEM-level access. Advanced Local Procedure Call is old, deeply embedded plumbing that Windows processes use to talk to each other, and it hasn’t produced a Patch Tuesday entry since April 2023. Two rare bug classes resurfacing as active zero-days in the same release, in the same month, is the kind of coincidence worth a second look, even without evidence the two are related.

Neither CVE is remotely exploitable by itself. Both require local access already, which means neither is the opening move in an attack. They’re the second stage: the part where a phishing foothold, a compromised service account, or a low-privilege shell turns into full SYSTEM control. That’s exactly why they matter. Most ransomware and post-compromise playbooks depend on exactly this kind of bug to go from “we got a user’s session” to “we own the box,” the same role a state-backed group played with a different low-level Windows driver bug in August. If either has a working exploit circulating, and both clearly do since Microsoft confirmed active exploitation, they’ll show up chained behind whatever initial-access technique is popular this quarter.

What’s operationally urgent this week

The DNS Server and Kerberos bugs below matter more this week than the zero-days do, and that’s a deliberate ordering, not an oversight. A local-privilege-escalation zero-day needs an attacker to already be inside. An unauthenticated remote RCE against a DNS server does not.

CVE	Component	CVSS	Type
CVE-2026-69730	Windows DNS Server	9.8	RCE, “Exploitation More Likely”
CVE-2026-69676	Windows Kerberos	8.8	RCE, authentication-bypass-class
CVE-2026-69525	Remote Desktop Services	9.8	RCE, use-after-free
CVE-2026-81963	Windows Update Stack	7.8	EoP, exploited zero-day
CVE-2026-85880	Windows ALPC	7.8	EoP, exploited zero-day
CVE-2026-69380	Exchange Server	8.1	EoP, missing authorization

CVE-2026-69730 (Windows DNS Server, CVSS 9.8) is rated “Exploitation More Likely” by Microsoft, which is the closest thing to a warning short of confirmed active exploitation. This is at least the third notable Windows DNS Server RCE of 2026; we covered August’s wormable DNS Server bug a month ago, and the pattern of DNS infrastructure surfacing critical, unauthenticated RCEs release after release is worth flagging to whoever owns your name resolution layer, not treating as a one-off.

CVE-2026-69676 (Windows Kerberos, CVSS 8.8) falls into the authentication-bypass class, which is the kind of bug that doesn’t just compromise one machine, it compromises trust in the identity system everything else relies on. Kerberos sits under nearly every authenticated Windows action in a domain environment.

CVE-2026-69525 (Remote Desktop Services, CVSS 9.8) is a use-after-free vulnerability. RDS is internet-facing on a lot of networks by necessity, which makes a 9.8 RCE there a genuine priority, just one rung below DNS and Kerberos because RDS exposure is easier to fence off with network controls in the short term than core DNS is.

CVE-2026-69380 (Exchange Server, CVSS 8.1) is a missing-authorization flaw that can expose mailbox contents to an attacker who shouldn’t have access. It only matters if you run Exchange on-prem, but if you do, an authorization bug that leaks mail is the kind of thing that turns into a breach disclosure fast.

The rest of the release

Beyond the headline CVEs, this month’s release carries two broad clusters worth knowing about even without individual CVE numbers to track.

The first is 21+ critical RCEs spread across Outlook, Word, Excel, PowerPoint, and the shared Office and Windows Graphics components. A meaningful chunk of these trigger just from the Outlook Reading Pane or Explorer Preview Pane rendering a file, no click past viewing it required. If your organization has any policy of disabling the Reading Pane on machines that handle external mail, this is the month that policy earns its keep. If you don’t have that policy, this is a reasonable month to start one while you work through the patch backlog.

The second is 17+ unauthenticated, network-reachable RCEs spanning core infrastructure protocols: DNS, DHCP, MSMQ, NFS, and SSTP VPN. None of these individually made the “top” list above, but as a group they’re the reason a September that looks, at a glance, like “two zero-days and a big number” is actually a month where infrastructure teams have more real work than the headline suggests.

What to actually do this week

1. Patch Windows DNS Server and Kerberos first. Both are critical, both are remote and unauthenticated, and both sit on infrastructure that’s genuinely painful to take down for an emergency maintenance window, which is exactly why attackers target it and why you shouldn’t wait.
2. Close the two exploited zero-days next, even though they need local access. Attackers already have working exploits for CVE-2026-81963 and CVE-2026-85880, and they’re valuable as the second stage of any chain that starts elsewhere.
3. Disable or lock down the Reading Pane and Preview Pane on machines that handle external mail or files until the Office and Graphics component patches are fully rolled out, then patch those systems.
4. Get to Remote Desktop Services and the DNS/DHCP/MSMQ/NFS/SSTP cluster after the above. They’re still critical and remote; they’re just slightly lower priority than the infrastructure you can’t take offline at all.
5. If you run Exchange Server on-prem, patch CVE-2026-69380 in the same window as your other Exchange maintenance. It’s an authorization flaw, not an RCE, but a leaked mailbox is still a breach.

A record month like this one doesn’t change the math of triage, it just makes the queue longer. Patch the network-reachable infrastructure bugs before the local-only zero-days, patch the zero-days before you relax, and don’t assume “not exploited yet” means “not this week” once you see a 9.8 sitting on something you can’t take offline.