Microsoft released its September 2026 security updates on September 8, 2026. This release fixes 1007 vulnerabilities, with 113 rated Critical. It includes 2 zero-days: 2 already exploited by attackers. Patch those first.
- 1007 patches
- 113 Critical
- 2 zero-days
- 2 exploited
Zero-day vulnerabilities
Exploited by attackers or publicly disclosed before the fix. Treat these as urgent.
| CVE | What it affects | Type | CVSS | Status |
|---|---|---|---|---|
| CVE-2026-81963 | Windows Update Stack Elevation of Privilege Vulnerability | Elevation of Privilege | 7.8 | Exploited |
| CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Elevation of Privilege | 7.8 | Exploited |
Critical vulnerabilities
Highest severity scores first.
| CVE | What it affects | Type | CVSS | Status |
|---|---|---|---|---|
| CVE-2026-70352 | Azure AI Language Elevation of Privilege Vulnerability | Elevation of Privilege | 10.0 | |
| CVE-2026-83711 | Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability | Elevation of Privilege | 10.0 | |
| CVE-2026-83941 | Entra ID Elevation of Privilege Vulnerability | Elevation of Privilege | 9.9 | |
| CVE-2026-66302 | Skype for Business Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-67631 | Microsoft SQL Server Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-67643 | Microsoft SQL Server Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-69579 | Windows Message Queuing Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-69590 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-69595 | Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-69730 | Windows DNS Server Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-69769 | Windows HTTP Print Provider Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-69829 | Windows Shell Remote Code Execution Vulnerability | Remote Code Execution | 9.8 |
And 101 more Critical fixes. The full list is in Microsoft’s release notes below.
What kinds of problems were fixed
| Type | Count |
|---|---|
| Elevation of Privilege | 435 |
| Remote Code Execution | 259 |
| Information Disclosure | 173 |
| Denial of Service | 55 |
| Security Feature Bypass | 19 |
| Spoofing | 16 |
| Tampering | 13 |
What we recommend
- Patch anything marked as exploited first, ideally within days.
- Then roll out the Critical fixes, starting with internet-facing systems, domain controllers and email servers.
- Test on a small group before pushing to everyone, and keep a way to roll back.
- Check that endpoint protection and backups are healthy before you patch.
Short on time? Talk to Synova and we will help you prioritize and roll out the updates safely.
Counts are vulnerabilities (CVEs) first published on Patch Tuesday. Microsoft also published 185 fixes earlier in the month (mostly Edge and other browser components), which are not included above. Microsoft sometimes revises a release after launch, so this page updates itself. Last updated October 21, 2026, 1:52 AM GMT+0000. Source: Microsoft Security Update Guide, September 2026 release notes.