> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Microsoft fixes record 964 flaws, including 2 exploited zero-days - URL: https://f4n6.co.uk/security-feed/microsoft-fixes-record-964-flaws-including-2-exploited-zero-days/ - Published: 2026-09-09T10:59:53.000Z - Updated: 2026-09-09T10:59:53.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-81963, CVE-2026-85880 ## 1\. Executive summary Microsoft's September 2026 Patch Tuesday is the largest single-day release on record: 964 customer-actionable CVEs (104 Critical, 860 Important), drawn from a full release list of 974 that includes 10 cloud-service or Microsoft-serviced items. Two Windows local elevation-of-privilege zero-days were exploited in the wild before patches shipped: **CVE-2026-81963** (Windows Update Stack, CVSS 7.8 HIGH, improper link resolution, **in CISA KEV since 2026-09-08**) and **CVE-2026-85880** (Windows ALPC heap-based buffer overflow enabling AppContainer sandbox escape, CVSS 7.8 HIGH, **in CISA KEV since 2026-09-08**). Neither bug is a remote-access primitive on its own — both require an attacker to already hold low-privileged local code execution — but SYSTEM-level elevation is the standard second stage after phishing or credential-theft footholds, which is precisely the initial-access pattern that dominates financial-sector intrusions. The release also carries high-severity RCE fixes in Windows DNS Server, Remote Desktop Services, Skype for Business Server, MSMQ and RRAS, plus Exchange, SharePoint and SQL Server. EMEA financial services clients should treat the two KEV-listed EoP bugs as the P1 driver and expect an unusually long patch-deployment tail this cycle. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | A record 964-CVE release with two actively exploited, KEV-listed Windows EoP zero-days means standard patch cadence cannot be assumed to cover exposure; clients must be able to demonstrate their testing regime detects and validates remediation of exploited-in-the-wild flaws at this volume. | Evidence patch-coverage verification for the two KEV entries (and the unauthenticated RCE set) as part of resilience testing records; a backlog of unpatched KEV items is an audit finding. | | NIS2 Art. 21(2)(d): supply chain security measures | The exploited CVE-2026-81963 sits in the Windows Update Stack itself — the mechanism clients rely on to distribute fixes — and Rapid7 notes Microsoft shipped an Edge fix for Chrome zero-day CVE-2026-85046 without a corresponding advisory, degrading the vulnerability intelligence clients depend on from a critical supplier. | Do not rely on vendor advisories alone as the supply-chain feed for Microsoft patch status; verify deployed build/patch levels directly against vendor release notes. | No other specific DORA/NIS2 article is directly engaged by this item. This is a vulnerability disclosure and patch event, not a confirmed incident at a client; Art. 18/19 and NIS2 Art. 23 reporting triggers would only engage on an actual detected intrusion exploiting these CVEs. ## 3\. Technical analysis & attack chain ### Triage table (prioritised) | CVE | Component | CVSS | KEV/EPSS | Why it matters | | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | CVE-2026-81963 | Windows Update Stack | 7.8 HIGH | **IN CISA KEV** (added 2026-09-08); actively exploited pre-patch | Exploited-in-the-wild EoP to SYSTEM via link following; affects Windows 11 and Windows Server 2025 including Server Core; all supported Windows versions receive a patch | | CVE-2026-85880 | Windows ALPC | 7.8 HIGH | **IN CISA KEV** (added 2026-09-08); actively exploited pre-patch | Heap-based buffer overflow / out-of-bounds write; AppContainer sandbox escape to SYSTEM, no user interaction; affects Windows 10 and Server 2012/2016/2019/2022 — notably *not* patched for Server 2025/Windows 11 | | CVE-2026-66302 | Skype for Business Server | 9.8 CRITICAL | Not in KEV; not exploited, not publicly disclosed (per SANS) | Unauthenticated RCE via external control of file name/path — crafted network request writes attacker-controlled file to arbitrary location; affects SfB Server 2015 CU13, 2019 CU8, Subscription Edition CU1 | | CVE-2026-69579 | Windows Message Queuing (MSMQ) | 9.8 CRITICAL | Not in KEV; not exploited, not publicly disclosed (per SANS) | Unauthenticated remote RCE via use-after-free; crafted packet to MSMQ service, no user interaction; supported Windows client and server releases | | RRAS RCE (September release) | Routing and Remote Access Service | High (per Malwarebytes: "high-severity") | Not in KEV | Flagged by SANS among notable critical RCEs; adjacent-network attack surface on edge servers | | Windows DNS Server / RDS RCE | DNS Server role; Remote Desktop Services | High (per Malwarebytes: "high-severity") | Not in KEV | Named by Malwarebytes as high-severity RCEs in this release; classic perimeter-facing financial-institution exposure | | \~958 further CVEs | Exchange, SharePoint, SQL Server, Office, AD CS/AD DS/AD FS, Hyper-V, OpenSSH for Windows, DHCP, and \~100 further components (per Tenable's September component list) | 104 Critical / 860 Important overall | Not in KEV | Long tail; roll up by patch mechanism, not per-CVE triage | ### Attack chain — the two exploited zero-days (confirmed steps) 1. **Initial access (prerequisite, not provided by these CVEs):** attacker obtains low-privileged local code execution on a Windows host — via phishing-delivered malware, stolen credentials, or another method (Malwarebytes). Both bugs are local EoP only; neither grants remote access by itself. 2. **Privilege escalation, path A — CVE-2026-85880:** attacker code running in a low-privilege AppContainer triggers a heap-based buffer overflow in Windows ALPC (the internal inter-process messaging facility). The overflow enables an out-of-bounds write (Rapid7). No additional user interaction is required. Result: escape from the AppContainer sandbox and elevation to SYSTEM. Affected: Windows 10 and Windows Server 2012, 2016, 2019, 2022\. Rapid7 observes that Server 2025 and Windows 11 receive no patch for this CVE, which it reads as evidence that Microsoft's Rust rewrite of critical kernel components is closing this class — meaning older fleet is where this bug lives. 3. **Privilege escalation, path B — CVE-2026-81963:** an authorised (authenticated, low-privilege) local attacker abuses improper link resolution before file access ("link following") in the Windows Update Stack. Windows follows a shortcut-like pointer without properly validating its target, and can be persuaded to open or modify the wrong file; Rapid7 infers the patch tightens controls preventing the Update Stack from following a malicious link and overwriting a system component with an attacker-controlled imposter. Result: SYSTEM privileges. Affected: Windows 11 and Windows Server 2025, including Server Core installations; all supported Windows versions receive a patch. 4. **Post-exploitation (typical, per Malwarebytes):** with SYSTEM, an intruder disables defences, accesses protected data, establishes persistence, or moves laterally through the network. Rapid7's assessment is blunt: no serious attacker needs an intricate one-shot RCE when a two-stage chain of low-privileged access plus EoP reaches the same goal more easily. ### Other technical detail worth acting on - **Skype for Business Server (CVE-2026-66302, 9.8):** unauthenticated, no user interaction; external control of a file name or path lets a crafted network request write an attacker-controlled file to an arbitrary location on the server, leading to code execution. SANS recommends reviewing exposed deployments, logging and access controls for suspicious file writes or unexpected server-side code execution. Affected builds: SfB Server 2015 CU13, 2019 CU8, Subscription Edition CU1. - **MSMQ (CVE-2026-69579, 9.8):** use-after-free; unauthenticated remote code execution by sending a crafted packet to an affected Message Queuing service, no user interaction, high CIA impact. Any system running MSMQ is a patching priority. - **Advisory-gap issue (Rapid7, single-sourced):** Google patched Chrome V8 zero-day CVE-2026-85046 on 2026-09-03; the Edge stable channel received the fix a day earlier (2026-09-02, per Edge release notes), but as of publication Microsoft had published no security advisory for it. Clients relying on Microsoft advisories as their Edge vulnerability feed would miss an exploited-in-the-wild zero-day. Chrome patched 11 further vulnerabilities alongside it; whether those are covered in Edge was not yet confirmed. Single-sourced; verify Edge build levels directly rather than relying on advisory presence. ### Discrepancies and confidence notes - **CVE counts:** Malwarebytes/Tenable report 964 customer-actionable CVEs (974 total, 10 Microsoft-serviced/cloud); SANS reports 973 total including 113 Critical; Rapid7 reports 974 own-product CVEs (723 in Windows) plus 25 non-Microsoft CVEs for a 999 total. We use 964/104 Critical as the headline per the primary source; the variance is counting methodology, not substance. - **CWE classification:** the verified NVD data records CVE-2026-81963 as CWE-59 (Improper Link Resolution Before File Access) and CWE-284 (Improper Access Control) — consistent with the "link following" description — and CVE-2026-85880 as CWE-122 (Heap-based Buffer Overflow) and CWE-908 (Use of Uninitialized Resource). SANS states CVE-2026-85880 was "not currently in CISA's Known Exploited Vulnerabilities catalogue" at its publication time; the verified reference data shows it **is in KEV, added 2026-09-08** — treat KEV listing as authoritative and the SANS statement as a timing artefact. - **Attribution:** no threat actor is named for the in-the-wild exploitation of either zero-day in any source. Exploitation is confirmed by Microsoft; who is exploiting remains unknown. No MITRE ATT&CK actor profile applies. ## 4\. Mitigation & containment ### P1 — within 24 hours 1. **Patch the two KEV-listed EoP zero-days first.** Deploy September 2026 cumulative updates to all Windows 11 and Windows Server 2025 hosts (CVE-2026-81963) and all Windows 10 / Server 2012, 2016, 2019, 2022 hosts (CVE-2026-85880). Prioritise, per SANS: multi-user systems (terminal servers, Citrix/VDH hosts), exposed workstations, and any server where local code-execution paths exist (web front ends, mail relays, jump hosts). Server Core installations are in scope for CVE-2026-81963 — do not let headless servers skip the queue. 2. **Emergency patch ring:** given both bugs are exploited in the wild and require only a low-privilege foothold, fast-track the September cumulative to internet-facing and user-facing Windows estates ahead of the normal pilot/broad rings. Both are EoP-only, so the residual risk of a rapid deployment is contained to the OS components patched. 3. **Hunt for prior exploitation:** because exploitation predates the patch, sweep EDR telemetry for the period before deployment for anomalous token-manipulation/sandbox-escape patterns on hosts now being patched — AppContainer escape (CVE-2026-85880) and Update Stack file-overwrite events (CVE-2026-81963). Any hit on a domain-joined host should trigger incident-response escalation, not just patching. ### P2 — within 72 hours 1. **Patch unauthenticated RCE surface:** Skype for Business Server 2015 CU13 / 2019 CU8 / Subscription Edition CU1 (CVE-2026-66302) — if SfB Server is exposed, treat as perimeter-critical; verify no unexpected file writes in SfB logging. MSMQ hosts (CVE-2026-69579) — patch, and where MSMQ is not required, disable the Message Queuing service outright. Cover the RRAS and Windows DNS Server / Remote Desktop Services high-severity RCEs in the same pass. 2. **Verify Edge build levels directly** rather than waiting for a Microsoft advisory: confirm the stable-channel build deployed includes the 2026-09-02 fix covering Chrome CVE-2026-85046 (V8, exploited in the wild). Do not treat absence of an advisory as absence of exposure. 3. **Containment for unpatchable hosts:** for any Windows 10/Server 2012–2022 system that cannot take the September update inside 72 hours, enforce EDR policy blocking child-process/spawn behaviour from AppContainer-resident and sandboxed processes, and restrict interactive low-privilege code execution (application allow-listing, removal of unnecessary local accounts). These are compensating controls only — they do not fix the bugs. ### P3 — within 7 days 1. **Complete the remaining \~958 CVEs by patch mechanism, not per CVE:** roll the September cumulative OS updates across the full Windows estate; apply the Exchange Server, SharePoint, SQL Server, Office and .NET/Visual Studio updates through their standard servicing channels; cover the remaining component families in Tenable's September list (AD CS/AD DS/AD FS, Hyper-V, OpenSSH for Windows, DHCP client/server, and the rest) via the same monthly servicing pass. 2. **Update vulnerability-management thresholds:** at 964 CVEs per cycle, per-CVE manual triage is no longer viable. Configure scanners to auto-deploy vendor severity/KEV-driven priorities and reserve analyst time for the KEV list and internet-facing RCEs. Rapid7's assessment that this volume is the new baseline, not an outlier, should drive that resourcing decision. ## 5\. Indicators of compromise No indicators of compromise available in the source material. Neither Microsoft nor any source published hashes, domains, IPs, exploit artefacts or sample identifiers for the in-the-wild exploitation of CVE-2026-81963 or CVE-2026-85880. **Behavioural indicators** (derived from the vulnerability mechanics described in the sources; no atomic IOCs exist yet): | Behaviour | Where to observe | Confidence | | -------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | | AppContainer-resident process achieving SYSTEM-level token/access (sandbox escape) on Windows 10 / Server 2012–2022 | EDR process-integrity and token-manipulation telemetry | High — matches CVE-2026-85880 mechanism | | Windows Update Stack following a link and overwriting a system component with an attacker-controlled file, on Windows 11 / Server 2025 | EDR file-write monitoring on Update Stack paths; unexpected writes to system component files during non-update windows | High — matches CVE-2026-81963 mechanism (Rapid7's characterisation) | | Low-privilege local process followed by SYSTEM-privilege child/spawn on the same host (two-stage chain) | EDR process-tree anomaly detection | High — the documented exploitation pattern for both CVEs | | Unexpected file writes to arbitrary paths on Skype for Business Server, or unexpected server-side code execution | SfB Server logging, file-integrity monitoring | Medium — SANS-recommended review for CVE-2026-66302; no observed exploitation | ## 6\. Detection The sources contain no exploit artefacts, hashes, strings, mutexes or file names for the in-the-wild exploitation — only vulnerability mechanics. Behavioural detection can be expressed in Sigma against the privilege-escalation pattern common to both zero-days: ```yaml title: Windows Local EoP to SYSTEM - September 2026 Zero-Day Pattern (CVE-2026-85880 / CVE-2026-81963) id: 9a1f0c3e-4b7d-4e2a-8c5f-1d6b2a7e0f34 status: experimental description: > Flags a process running at low integrity / AppContainer context spawning or elevating to a SYSTEM-privilege process on the same host, matching the documented exploitation pattern of CVE-2026-85880 (ALPC AppContainer escape) and CVE-2026-81963 (Update Stack link-following EoP). Tune to exclude known legitimate installers and service managers. references: - https://www.malwarebytes.com/blog/news/2026/09/microsoft-fixes-record-964-flaws-including-2-exploited-zero-days - https://isc.sans.edu/diary/rss/33320 author: Adverse Trace date: 2026-09-09 logsource: product: windows category: process_creation detection: selection: IntegrityLevel: - 'AppContainer' - 'Low' ParentIntegrityLevel: - 'AppContainer' - 'Low' IntegrityLevel|contains: 'System' condition: selection falsepositives: - Legitimate software installers elevating via UAC - Service control manager operations level: high ``` No YARA rule is emitted: there are no file-based artefacts, strings or samples in the source material, and a rule keyed to CVE identifiers or product names would detect reporting about the threat, not the threat itself. ## CVE assessment 2 referenced CVEs — **2 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-81963](https://nvd.nist.gov/vuln/detail/CVE-2026-81963?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-09-08 | — | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate… | | [CVE-2026-85880](https://nvd.nist.gov/vuln/detail/CVE-2026-85880?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-09-08 | — | Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | ## 7\. Sources - Malwarebytes — *Microsoft fixes record 964 flaws, including 2 exploited zero-days* — https://www.malwarebytes.com/blog/news/2026/09/microsoft-fixes-record-964-flaws-including-2-exploited-zero-days — 2026-09-09 - SANS Internet Storm Center — *September 2026 Microsoft Patch Tuesday* — https://isc.sans.edu/diary/rss/33320 — 2026-09-08 - Rapid7 — *Patch Tuesday - September 2026* — https://www.rapid7.com/blog/post/em-patch-tuesday-september-2026 — 2026-09-2026 (September 2026 release) - Tenable Research — *Microsoft's September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)* — https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880 — 2026-09 - Tenable Research — *Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820)* — https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820 — August 2026 (context) - Tenable Research — *Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)* — https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164 — July 2026 (context) ## 8\. Adverse Trace position This is a high-attention patch event, not an emergency: both exploited zero-days are CVSS 7.8 HIGH local EoP bugs requiring a pre-existing foothold, but both are CISA KEV-listed as of 2026-09-08 and confirmed exploited in the wild by Microsoft, which makes them mandatory patching under any defensible vulnerability-management standard — and the fact that one of them (CVE-2026-81963) sits in the Windows Update Stack itself, the mechanism clients depend on for remediation, raises the stakes on slow movers. The real client risk in EMEA financial services is the tail: 964 CVEs against estates that include legacy Windows 10 and Server 2012–2022 (exactly the platforms exposed to CVE-2026-85880), perimeter Skype for Business and MSMQ deployments with unauthenticated 9.8 RCEs, and vulnerability-management processes sized for a pre-2026 patch volume that Rapid7 assesses is gone for good. Attribution for the in-the-wild exploitation is unconfirmed — no actor is named in any source — and no IOCs exist yet, so detection effort should go to behavioural EDR coverage for AppContainer escape and anomalous SYSTEM elevation rather than indicator pivoting. We will monitor for exploit artefacts, actor attribution and any KEV additions among the September RCE set, and will issue a follow-up if IOCs or a second-wave exploitation pattern emerges. --- [Read the original source →](https://www.malwarebytes.com/blog/news/2026/09/microsoft-fixes-record-964-flaws-including-2-exploited-zero-days?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*