September 2026 Patch Tuesday fixes a record 974 CVEs including 2 exploited zero-days, 20 wormable bugs, and a critical Exchange RCE via Visio email.
Microsoft’s September 2026 Patch Tuesday set a new record. Depending on how researchers count external and Chromium bugs, Microsoft fixed between 966 and 997 CVEs in this update. The company also fixed another 204 vulnerabilities earlier in September across Azure, Entra ID, Edge, and other services. This means the total number of September fixes is already much higher than the headline figure.
“It’s a new record release from Microsoft, but, again, that seems to be the new normal. As always, counting this beast is tricky, but I see 972 new CVEs rolling out from Redmond this month.” reads the report published by ZDI. “On the one hand, congrats to the security gnomes at Microsoft for being able to patch bugs at this rate. On the other hand, AI-assisted vulnerability discovery shows no signs of slowing down. However, we have not seen a correlating spike in active exploits – yet.”
The number of addressed issues skyrockets due to the use of AI for code auditing in the monthly counts, it has been climbing steadily through 2026. What hasn’t arrived yet, and ZDI notes the absence explicitly, is a corresponding spike in active exploits, though 58 of this month’s fixes are rated by Microsoft as more likely to be exploited.
The two vulnerabilities already under attack both allow attackers to gain higher privileges. CVE-2026-85880 (CVSS score of 7.8) is a heap buffer overflow in Windows Advanced Local Procedure Call (ALPC). It lets a local attacker gain SYSTEM-level privileges, and the researchers note it is only the second ALPC zero-day Microsoft has patched since January 2023.
CVE-2026-81963 (CVSS score of 7.8) flaw resides in the Windows Update Stack. It lets an attacker follow a malicious link and escalate privileges. It is the first Update Stack vulnerability that Microsoft has confirmed attackers actively exploiting. Both flaws require local access and user-level privileges, so attackers would likely use them after gaining an initial foothold and then use them to gain higher privileges.
The Exchange Server situation this month is more pressing than either zero-day. CVE-2026-55007 is a remote code execution vulnerability that deserves immediate attention.
“An unauthenticated attacker could send a specially crafted Visio attachment to an affected Exchange server. The server could process the attachment during content indexing, and successful exploitation could allow the attacker to execute code on the server. User interaction is not required.” reads the advisory. “Successful exploitation requires the target system to be under sustained low-memory (memory pressure) conditions, which are not commonly present in normal operation. This makes the vulnerability difficult to reliably trigger, as the attacker must first induce or wait for a constrained memory state before exploitation becomes possible.”
Microsoft rates the exploit as unreliable, but an attacker trying repeatedly only needs to succeed once. A second Exchange bug, CVE-2026-69380 (CVSS 8.1), is also a priority: it lets a low-privileged authenticated attacker impersonate any user in the organization and hijack every mailbox. If your Exchange servers face the internet, test and deploy these patches immediately.
Remote Desktop Services adds another urgent item: CVE-2026-69525 (CVSS score of 9.8) is a use-after-free bug that lets an unauthenticated in-network attacker execute arbitrary code. Microsoft specifies an “in-network” requirement, but the CVSS network vector score suggests any network path could be relevant. RDP is everywhere in enterprise environments, and that CVSS score combined with the unauthenticated attack path makes this one worth treating as urgent regardless of the technical qualifier.
Microsoft also fixed 20 wormable vulnerabilities. These flaws let remote, unauthenticated attackers execute code without any user interaction, creating the kind of conditions that can help malware spread from system to system. The affected components include DHCP Server, Active Directory, Windows DNS Server, SMB Client, Netlogon, NFS, RRAS, IP Helper, Message Queuing, and others. One DNS flaw, CVE-2026-69730, has a CVSS score of 9.8. ZDI calls it a “SigRed’s spiritual successor,” referring to the critical DNS flaw exploited in 2020. Fixing 20 wormable bugs in one Patch Tuesday is an unusually high number.
Microsoft also patched 17 SharePoint flaws, including four that allow remote code execution, and more than 60 SQL Server vulnerabilities. One SQL Server flaw affects SQL Copilot in SQL Server Management Studio. Microsoft also fixed an Android Microsoft Authenticator flaw that can let a malicious app gain valid access tokens after the user completes an authentication step. Teams should prioritize these fixes based on their own environments, but they should not ignore any of them.
The full list of vulnerabilities addressed by Microsoft this month is available here.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Patch Tuesday)
Entrar
