> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities - URL: https://f4n6.co.uk/security-feed/microsoft-patch-tuesday-for-september-2026-snort-rules-and-prominent-vulnerabilities/ - Published: 2026-09-09T09:24:16.000Z - Updated: 2026-09-09T09:24:16.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-81963, CVE-2026-85880, CVE-2026-69676, CVE-2026-69852, CVE-2026-72957 ## 1\. Executive summary Microsoft's September 2026 Patch Tuesday is the largest on record: 973 vulnerabilities per Talos (Rapid7 counts 974 own-product CVEs plus 25 non-Microsoft CVEs for a 999 total; Tenable counts 964 — counting methodology differs across vendors), including 113 rated critical, 82 of them RCE. Two elevation-of-privilege zero-days are confirmed exploited in the wild and both are in the CISA KEV catalogue (added 2026-09-08): CVE-2026-81963 (Windows Update Stack, CVSS 7.8 HIGH, link-following/improper access control) and CVE-2026-85880 (Windows ALPC, CVSS 7.8 HIGH, heap-based buffer overflow/use of uninitialized resource). Both are local privilege-escalation primitives that convert low-privilege code execution into SYSTEM — the standard second stage of commodity ransomware and intrusion chains — so unpatched endpoints and multi-user servers are the immediate exposure for EMEA financial services estates. No other CVE in this release is in CISA KEV; the highest-severity unexploited items (CVE-2026-69730 Windows DNS Server RCE 9.8 CRITICAL, CVE-2026-69854 Spring Cloud Azure EoP 9.0 CRITICAL) carry Microsoft "more likely" exploitation ratings and warrant priority in the same patch cycle. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | Two KEV-listed, actively exploited Windows privilege-escalation flaws (CVE-2026-81963, CVE-2026-85880) in the September release require verified patch deployment across the ICT estate, not just patch scheduling. | Evidence patch verification for the two exploited CVEs as part of resilience testing records; unpatched KEV items discovered in testing are a reportable control failure. | | DORA Art. 28: ICT third-party risk — general principles | The release includes critical fixes in third-party-relevant components financial firms consume as managed services or run in provider environments (Windows DNS Server, Skype for Business Server, SQL Server, RRAS). | Push patch-confirmation obligations at managed-service and hosting providers for the KEV items and the named 9.8 CRITICAL server-side RCEs; do not assume provider patching. | No NIS2 or UK NIS article is directly engaged by this item: a vendor patch release is not itself an incident, and no fact in the source material triggers NIS2 Art. 21(2)(d) supply chain security measures or NIS2 Art. 23 / UK NIS reporting duties. Firms should treat this as routine-but-urgent patch management under existing DORA obligations. ## 3\. Technical analysis & attack chain **Triage table** (KEV entries first, then by severity/exploitation likelihood per the verified reference data; EPSS values were provided only for CVE-2026-69857): | CVE | Component | CVSS | KEV/EPSS | Why it matters | | -------------- | ------------------------------------------ | ------------ | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2026-81963 | Windows Update Stack | 7.8 HIGH | **IN CISA KEV** (added 2026-09-08) | Exploited in the wild. Local EoP to SYSTEM via improper link resolution before file access + improper access control. | | CVE-2026-85880 | Windows ALPC | 7.8 HIGH | **IN CISA KEV** (added 2026-09-08) | Exploited in the wild. AppContainer sandbox escape to SYSTEM via heap-based buffer overflow + use of uninitialized resource. | | CVE-2026-69730 | Windows DNS Server | 9.8 CRITICAL | Not in KEV | "More likely" exploitation. Use-after-free RCE in a core directory service. | | CVE-2026-69854 | Spring Cloud Azure | 9.0 CRITICAL | Not in KEV | "More likely" exploitation. EoP via improper authentication in a cloud integration component. | | CVE-2026-69676 | Windows Kerberos | 8.8 HIGH | Not in KEV | "More likely" exploitation. RCE associated with authentication bypass by capture-replay in the core Windows authentication protocol. | | CVE-2026-69857 | Azure Cosmos DB | 8.5 HIGH | Not in KEV — EPSS 0% | "More likely" exploitation. Spoofing via authorization bypass through user-controlled key (IDOR). EPSS currently 0% — low near-term probability, but data-platform exposure. | | CVE-2026-72957 | Windows Deployment Services | 7.8 HIGH | Not in KEV | "More likely" exploitation. Heap overflow RCE in an imaging/deployment service commonly exposed on internal build networks. | | CVE-2026-69852 | Windows RRAS | 7.5 HIGH | Not in KEV | "More likely" exploitation. Heap overflow RCE in a remote-access service. | | CVE-2026-70585 | Windows Services for NFS ONCRPC XDR Driver | 7.0 HIGH | Not in KEV | "More likely" exploitation. Use-after-free RCE in NFS driver code paths. | | CVE-2026-83501 | Windows VBS | 5.5 MEDIUM | Not in KEV | "More likely" exploitation. Out-of-bounds read information disclosure against virtualization-based security. | ### The two urgent entries, in depth **CVE-2026-81963 — Windows Update Stack EoP (KEV, exploited in the wild).** Per SANS, this affects Windows 11 and Windows Server 2025, including Server Core installations. Mechanism: improper link resolution before file access (CWE-59) combined with improper access control (CWE-284). A local, authenticated attacker with low privileges abuses link-following behaviour in the update stack to elevate to SYSTEM. Rapid7 characterises the patch as tightening controls to prevent the Windows Update Stack from following a malicious link and overwriting a system component with an attacker-controlled imposter. All supported versions of Windows receive a patch. Neither Talos nor SANS reports public disclosure before Patch Tuesday, so exploit detail in the wild is presumably limited to the attacker(s) — treat any claimed public PoC with suspicion. **CVE-2026-85880 — Windows ALPC EoP (KEV, exploited in the wild).** Per SANS, affects Windows 10 and multiple Windows Server releases including Server 2012, 2016, 2019 and 2022 — notably *not* Server 2025 or Windows 11, which Rapid7 reads as evidence that Microsoft's Rust rewrite of critical kernel components is closing this class. Mechanism: heap-based buffer overflow (CWE-122) plus use of uninitialized resource (CWE-908) in the ALPC inter-process communication mechanism. Exploitation is local: the attacker must already be able to run code in a low-privilege AppContainer; no user interaction is required. Successful exploitation escapes the sandbox and yields SYSTEM. SANS specifically flags multi-user systems, exposed workstations, and servers with local code-execution paths as highest risk. ### Attack chain (confirmed steps, generic to both KEV items) 1. Attacker obtains low-privilege code execution on a target host — via malware delivery, compromised service account, malicious macro, or an initial-access broker foothold (the source material does not describe the in-the-wild delivery vector for either CVE; this step is the standard precondition, not an observed fact). 2. Attacker runs the EoP exploit against the vulnerable component (Windows Update Stack link-following for CVE-2026-81963; ALPC heap overflow from AppContainer for CVE-2026-85880). 3. Process context transitions to SYSTEM; sandbox/AppContainer boundary is crossed. 4. Attacker proceeds to credential theft, persistence, or lateral movement with full host privilege. Rapid7 notes explicitly that a two-stage chain of low-privileged local access plus EoP is cheaper and more reliable for attackers than a one-shot RCE — this is why these 7.8s matter more than several 9.8s in the same release. ### Other items with corroborated technical detail (SANS, multi-source with Talos) - **CVE-2026-66302 — Skype for Business Server RCE, 9.8, "less likely."** External control of file name or path. An unauthenticated attacker sends a specially crafted network request that writes an attacker-controlled file to an arbitrary location on the server; successful exploitation yields code execution without authentication or user interaction. Affected versions: Skype for Business Server 2015 CU13, 2019 CU8, Subscription Edition CU1\. Not exploited in the wild, not publicly disclosed pre-Patch Tuesday. - **CVE-2026-69579 — Windows Message Queuing (MSMQ) RCE, 9.8, "unlikely."** Use-after-free. Unauthenticated remote exploitation by sending a specially crafted packet to an affected Message Queuing service, no user interaction, high CIA impact. SANS's text is truncated mid-sentence on the mitigation ("where Me…"), but the direction is clear: MSMQ systems are a patching priority; where the service is unused, disable it. **Caveats and single-sourced points.** The exploited-in-the-wild status of both KEV CVEs is corroborated by Talos, SANS, Rapid7 and Tenable. The specific affected-version lists (Windows 11/Server 2025 for CVE-2026-81963; Windows 10/Server 2012–2022 for CVE-2026-85880) are single-sourced to SANS — verify against the Microsoft KB before scoping deployment. The Rapid7 observation that CVE-2026-85880's absence from Server 2025/Windows 11 indicates Rust-rewrite benefit is vendor inference, not confirmed fact. No threat actor is named in any source; no attribution is available, and none should be assumed. No IOCs, exploit samples, or observed victimology are described for either exploited CVE. ## 4\. Mitigation & containment ### P1 — within 24 hours - **Patch CVE-2026-81963 and CVE-2026-85880 everywhere.** Both are KEV-listed and actively exploited. Prioritise: multi-user hosts (terminal servers, jump hosts, VDI), developer workstations (AppContainer code execution is trivially available), and any host with existing malware detections. Per SANS, CVE-2026-81963 patches apply to all supported Windows versions including Server Core; CVE-2026-85880 patches apply to Windows 10 and Server 2012/2016/2019/2022. - **Hunt before assuming clean:** if a host cannot be patched within 24h, review it for anomalous SYSTEM-privilege process creation from low-integrity/AppContainer parents, unexpected service installs, and link-file (.lnk/symlink) abuse in update-related paths. Isolate hosts with confirmed anomalies. - **Patch CVE-2026-69730 (Windows DNS Server, 9.8) and CVE-2026-69854 (Spring Cloud Azure, 9.0)** on all DNS server roles and Spring Cloud Azure deployments — both carry Microsoft "more likely" exploitation ratings. ### P2 — within 72 hours - **Patch the remaining "more likely" list:** CVE-2026-69676 (Kerberos), CVE-2026-69852 (RRAS), CVE-2026-72957 (Deployment Services), CVE-2026-70585 (NFS ONCRPC XDR), CVE-2026-83501 (VBS), CVE-2026-69857 (Azure Cosmos DB). - **Patch exposed server-side RCEs regardless of likelihood rating:** CVE-2026-66302 (Skype for Business Server — unauthenticated arbitrary file write; if SfB Server edge roles are internet-facing, treat as P1), CVE-2026-69579 (MSMQ — and disable the Message Queuing service on any host that does not require it), CVE-2026-72982 (Windows Netlogon, 9.8), CVE-2026-72983 (Internet Connection Sharing, 9.8), CVE-2026-73009 (SSTP, 9.8), CVE-2026-73010 (Failover Cluster, 9.8), CVE-2026-77493 (Graphics Component, 9.8), CVE-2026-69590 (RRAS, 9.8), CVE-2026-69595/CVE-2026-78445 (NFS ONCRPC XDR, 9.8), CVE-2026-69845/CVE-2026-72979 (DHCP Server, 9.8), CVE-2026-69769 (HTTP Print Provider, 9.8), CVE-2026-69829 (Windows Shell, 9.8). - **Cloud identity items:** CVE-2026-83711 (Azure AD B2C, 10.0), CVE-2026-70352 (Azure AI Language, 10.0), CVE-2026-83941 (Entra ID, 9.9), CVE-2026-80098 (Copilot Studio, 9.3), CVE-2026-62916 (Entra ID, 9.1) — these are service-side; confirm Microsoft remediation status in affected tenants and review for prior abuse of the relevant authorization/authentication paths. ### P3 — within 7 days - Complete the remaining critical/important estate via standard patch cycles: the Office/Excel/Word/PowerPoint/Outlook document-parsing heap-overflow families, Windows Secure Kernel Mode and Hyper-V EoPs, Windows Hello EoPs, and the long tail of the 60+ "important" more-likely EoPs Talos lists (Win32k, kernel, Print Spooler, TCP/IP, LSA Server, etc.). - Deploy the Talos Snort coverage for this release: Snort 2 SIDs 67011–67032 and 67036–67084; Snort 3 SIDs 301619–301629, 301632–301655, and 67046\. Cisco Secure Firewall customers: update the SRU. Open-source Snort Subscriber Ruleset customers: pull the latest rule pack from Snort.org. Talos notes additional rules may follow and current rules are subject to change. - Rapid7 flags a related gap: Google patched Chrome zero-day CVE-2026-85046 (V8, exploited in the wild) on 2026-09-03 and the Edge stable channel shipped a fix 2026-09-02, but Microsoft had not published the corresponding security advisory as of publication. If your vulnerability management keys off advisories rather than build versions, verify Edge is at the 2026-09-02 stable channel release or later. ## 5\. Indicators of compromise No indicators of compromise available in the source material. Neither exploited CVE has published exploit artefacts, samples, or victimology in any provided source. ## 6\. Detection Insufficient indicators to author detection rules. The source material describes vulnerability mechanisms, not threat artefacts — no exploit strings, file names, mutexes, command lines, or network signatures are present. Network-side detection for exploitation attempts is provided by the Talos Snort ruleset referenced in §4 (Snort 2 SIDs 67011–67032, 67036–67084; Snort 3 SIDs 301619–301629, 301632–301655, 67046); deploy those rather than attempting to author equivalents. ## CVE assessment 10 referenced CVEs — **2 actively exploited (CISA KEV)**, 2 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-81963](https://nvd.nist.gov/vuln/detail/CVE-2026-81963?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-09-08 | — | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate… | | [CVE-2026-85880](https://nvd.nist.gov/vuln/detail/CVE-2026-85880?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-09-08 | — | Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | | [CVE-2026-69730](https://nvd.nist.gov/vuln/detail/CVE-2026-69730?ref=f4n6.co.uk) | 9.8 Critical | — | — | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | | [CVE-2026-69854](https://nvd.nist.gov/vuln/detail/CVE-2026-69854?ref=f4n6.co.uk) | 9.0 Critical | — | — | Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network. | | [CVE-2026-69676](https://nvd.nist.gov/vuln/detail/CVE-2026-69676?ref=f4n6.co.uk) | 8.8 High | — | — | Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network. | | [CVE-2026-69857](https://nvd.nist.gov/vuln/detail/CVE-2026-69857?ref=f4n6.co.uk) | 8.5 High | — | 0% | Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a ne… | | [CVE-2026-72957](https://nvd.nist.gov/vuln/detail/CVE-2026-72957?ref=f4n6.co.uk) | 7.8 High | — | — | Heap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code locally. | | [CVE-2026-69852](https://nvd.nist.gov/vuln/detail/CVE-2026-69852?ref=f4n6.co.uk) | 7.5 High | — | — | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to vic… | | [CVE-2026-70585](https://nvd.nist.gov/vuln/detail/CVE-2026-70585?ref=f4n6.co.uk) | 7.0 High | — | — | Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to execute code locally. | | [CVE-2026-83501](https://nvd.nist.gov/vuln/detail/CVE-2026-83501?ref=f4n6.co.uk) | 5.5 Medium | — | — | Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information… | ## 7\. Sources - Cisco Talos — Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities — https://blog.talosintelligence.com/microsoft-patch-tuesday-for-september-2026/ — 2026-09-08 - SANS Internet Storm Center — September 2026 Microsoft Patch Tuesday — https://isc.sans.edu/diary/rss/33320 — 2026-09-08 - Rapid7 — Patch Tuesday, September 2026 — https://www.rapid7.com/blog/post/em-patch-tuesday-september-2026 — 2026-09-08 - Tenable Research — Microsoft's September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880) — https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880 — 2026-09-08 ## 8\. Adverse Trace position This is the largest Patch Tuesday on record by every vendor's count, but volume is not the risk driver — the two KEV-listed, actively exploited local EoP zero-days are. Both CVE-2026-81963 and CVE-2026-85880 are CVSS 7.8 HIGH, both were added to CISA KEV on 2026-09-08, and both convert low-privilege footholds into SYSTEM, which makes them the enabling stage for the ransomware and data-theft intrusions that dominate EMEA financial-services incident response. We assess the practical severity of these two as higher than their base scores suggest, consistent with Rapid7's assessment that attackers prefer a two-stage EoP chain over a one-shot RCE. No attribution exists in the source material and none should be inferred; the affected-version lists are single-sourced to SANS and should be verified against Microsoft's KB before deployment scoping. Our recommendation to clients is a 24-hour emergency cycle for the two KEV items plus the DNS Server and Spring Cloud Azure criticals, a 72-hour cycle for the remaining "more likely" list and exposed server-side RCEs, and standard-cycle handling of the long tail. Adverse Trace will monitor for public exploit artefacts, PoC releases, and KEV additions to the remaining September CVEs and will re-issue this advisory if exploitation of any non-KEV item is confirmed. --- [Read the original source →](https://blog.talosintelligence.com/microsoft-patch-tuesday-for-september-2026/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*