Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

1. Executive summary

Microsoft's September 2026 Patch Tuesday is the largest on record: 973 vulnerabilities per Talos (Rapid7 counts 974 own-product CVEs plus 25 non-Microsoft CVEs for a 999 total; Tenable counts 964 — counting methodology differs across vendors), including 113 rated critical, 82 of them RCE. Two elevation-of-privilege zero-days are confirmed exploited in the wild and both are in the CISA KEV catalogue (added 2026-09-08): CVE-2026-81963 (Windows Update Stack, CVSS 7.8 HIGH, link-following/improper access control) and CVE-2026-85880 (Windows ALPC, CVSS 7.8 HIGH, heap-based buffer overflow/use of uninitialized resource). Both are local privilege-escalation primitives that convert low-privilege code execution into SYSTEM — the standard second stage of commodity ransomware and intrusion chains — so unpatched endpoints and multi-user servers are the immediate exposure for EMEA financial services estates. No other CVE in this release is in CISA KEV; the highest-severity unexploited items (CVE-2026-69730 Windows DNS Server RCE 9.8 CRITICAL, CVE-2026-69854 Spring Cloud Azure EoP 9.0 CRITICAL) carry Microsoft "more likely" exploitation ratings and warrant priority in the same patch cycle.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by this item: a vendor patch release is not itself an incident, and no fact in the source material triggers NIS2 Art. 21(2)(d) supply chain security measures or NIS2 Art. 23 / UK NIS reporting duties. Firms should treat this as routine-but-urgent patch management under existing DORA obligations.

3. Technical analysis & attack chain

Triage table (KEV entries first, then by severity/exploitation likelihood per the verified reference data; EPSS values were provided only for CVE-2026-69857):

The two urgent entries, in depth

CVE-2026-81963 — Windows Update Stack EoP (KEV, exploited in the wild). Per SANS, this affects Windows 11 and Windows Server 2025, including Server Core installations. Mechanism: improper link resolution before file access (CWE-59) combined with improper access control (CWE-284). A local, authenticated attacker with low privileges abuses link-following behaviour in the update stack to elevate to SYSTEM. Rapid7 characterises the patch as tightening controls to prevent the Windows Update Stack from following a malicious link and overwriting a system component with an attacker-controlled imposter. All supported versions of Windows receive a patch. Neither Talos nor SANS reports public disclosure before Patch Tuesday, so exploit detail in the wild is presumably limited to the attacker(s) — treat any claimed public PoC with suspicion.

CVE-2026-85880 — Windows ALPC EoP (KEV, exploited in the wild). Per SANS, affects Windows 10 and multiple Windows Server releases including Server 2012, 2016, 2019 and 2022 — notably not Server 2025 or Windows 11, which Rapid7 reads as evidence that Microsoft's Rust rewrite of critical kernel components is closing this class. Mechanism: heap-based buffer overflow (CWE-122) plus use of uninitialized resource (CWE-908) in the ALPC inter-process communication mechanism. Exploitation is local: the attacker must already be able to run code in a low-privilege AppContainer; no user interaction is required. Successful exploitation escapes the sandbox and yields SYSTEM. SANS specifically flags multi-user systems, exposed workstations, and servers with local code-execution paths as highest risk.

Attack chain (confirmed steps, generic to both KEV items)

1. Attacker obtains low-privilege code execution on a target host — via malware delivery, compromised service account, malicious macro, or an initial-access broker foothold (the source material does not describe the in-the-wild delivery vector for either CVE; this step is the standard precondition, not an observed fact).
2. Attacker runs the EoP exploit against the vulnerable component (Windows Update Stack link-following for CVE-2026-81963; ALPC heap overflow from AppContainer for CVE-2026-85880).
3. Process context transitions to SYSTEM; sandbox/AppContainer boundary is crossed.
4. Attacker proceeds to credential theft, persistence, or lateral movement with full host privilege. Rapid7 notes explicitly that a two-stage chain of low-privileged local access plus EoP is cheaper and more reliable for attackers than a one-shot RCE — this is why these 7.8s matter more than several 9.8s in the same release.

Other items with corroborated technical detail (SANS, multi-source with Talos)

• CVE-2026-66302 — Skype for Business Server RCE, 9.8, "less likely." External control of file name or path. An unauthenticated attacker sends a specially crafted network request that writes an attacker-controlled file to an arbitrary location on the server; successful exploitation yields code execution without authentication or user interaction. Affected versions: Skype for Business Server 2015 CU13, 2019 CU8, Subscription Edition CU1. Not exploited in the wild, not publicly disclosed pre-Patch Tuesday.
• CVE-2026-69579 — Windows Message Queuing (MSMQ) RCE, 9.8, "unlikely." Use-after-free. Unauthenticated remote exploitation by sending a specially crafted packet to an affected Message Queuing service, no user interaction, high CIA impact. SANS's text is truncated mid-sentence on the mitigation ("where Me…"), but the direction is clear: MSMQ systems are a patching priority; where the service is unused, disable it.

Caveats and single-sourced points. The exploited-in-the-wild status of both KEV CVEs is corroborated by Talos, SANS, Rapid7 and Tenable. The specific affected-version lists (Windows 11/Server 2025 for CVE-2026-81963; Windows 10/Server 2012–2022 for CVE-2026-85880) are single-sourced to SANS — verify against the Microsoft KB before scoping deployment. The Rapid7 observation that CVE-2026-85880's absence from Server 2025/Windows 11 indicates Rust-rewrite benefit is vendor inference, not confirmed fact. No threat actor is named in any source; no attribution is available, and none should be assumed. No IOCs, exploit samples, or observed victimology are described for either exploited CVE.

4. Mitigation & containment

P1 — within 24 hours

• Patch CVE-2026-81963 and CVE-2026-85880 everywhere. Both are KEV-listed and actively exploited. Prioritise: multi-user hosts (terminal servers, jump hosts, VDI), developer workstations (AppContainer code execution is trivially available), and any host with existing malware detections. Per SANS, CVE-2026-81963 patches apply to all supported Windows versions including Server Core; CVE-2026-85880 patches apply to Windows 10 and Server 2012/2016/2019/2022.
• Hunt before assuming clean: if a host cannot be patched within 24h, review it for anomalous SYSTEM-privilege process creation from low-integrity/AppContainer parents, unexpected service installs, and link-file (.lnk/symlink) abuse in update-related paths. Isolate hosts with confirmed anomalies.
• Patch CVE-2026-69730 (Windows DNS Server, 9.8) and CVE-2026-69854 (Spring Cloud Azure, 9.0) on all DNS server roles and Spring Cloud Azure deployments — both carry Microsoft "more likely" exploitation ratings.

P2 — within 72 hours

• Patch the remaining "more likely" list: CVE-2026-69676 (Kerberos), CVE-2026-69852 (RRAS), CVE-2026-72957 (Deployment Services), CVE-2026-70585 (NFS ONCRPC XDR), CVE-2026-83501 (VBS), CVE-2026-69857 (Azure Cosmos DB).
• Patch exposed server-side RCEs regardless of likelihood rating: CVE-2026-66302 (Skype for Business Server — unauthenticated arbitrary file write; if SfB Server edge roles are internet-facing, treat as P1), CVE-2026-69579 (MSMQ — and disable the Message Queuing service on any host that does not require it), CVE-2026-72982 (Windows Netlogon, 9.8), CVE-2026-72983 (Internet Connection Sharing, 9.8), CVE-2026-73009 (SSTP, 9.8), CVE-2026-73010 (Failover Cluster, 9.8), CVE-2026-77493 (Graphics Component, 9.8), CVE-2026-69590 (RRAS, 9.8), CVE-2026-69595/CVE-2026-78445 (NFS ONCRPC XDR, 9.8), CVE-2026-69845/CVE-2026-72979 (DHCP Server, 9.8), CVE-2026-69769 (HTTP Print Provider, 9.8), CVE-2026-69829 (Windows Shell, 9.8).
• Cloud identity items: CVE-2026-83711 (Azure AD B2C, 10.0), CVE-2026-70352 (Azure AI Language, 10.0), CVE-2026-83941 (Entra ID, 9.9), CVE-2026-80098 (Copilot Studio, 9.3), CVE-2026-62916 (Entra ID, 9.1) — these are service-side; confirm Microsoft remediation status in affected tenants and review for prior abuse of the relevant authorization/authentication paths.

P3 — within 7 days

• Complete the remaining critical/important estate via standard patch cycles: the Office/Excel/Word/PowerPoint/Outlook document-parsing heap-overflow families, Windows Secure Kernel Mode and Hyper-V EoPs, Windows Hello EoPs, and the long tail of the 60+ "important" more-likely EoPs Talos lists (Win32k, kernel, Print Spooler, TCP/IP, LSA Server, etc.).
• Deploy the Talos Snort coverage for this release: Snort 2 SIDs 67011–67032 and 67036–67084; Snort 3 SIDs 301619–301629, 301632–301655, and 67046. Cisco Secure Firewall customers: update the SRU. Open-source Snort Subscriber Ruleset customers: pull the latest rule pack from Snort.org. Talos notes additional rules may follow and current rules are subject to change.
• Rapid7 flags a related gap: Google patched Chrome zero-day CVE-2026-85046 (V8, exploited in the wild) on 2026-09-03 and the Edge stable channel shipped a fix 2026-09-02, but Microsoft had not published the corresponding security advisory as of publication. If your vulnerability management keys off advisories rather than build versions, verify Edge is at the 2026-09-02 stable channel release or later.

5. Indicators of compromise

No indicators of compromise available in the source material. Neither exploited CVE has published exploit artefacts, samples, or victimology in any provided source.

6. Detection

Insufficient indicators to author detection rules. The source material describes vulnerability mechanisms, not threat artefacts — no exploit strings, file names, mutexes, command lines, or network signatures are present. Network-side detection for exploitation attempts is provided by the Talos Snort ruleset referenced in §4 (Snort 2 SIDs 67011–67032, 67036–67084; Snort 3 SIDs 301619–301629, 301632–301655, 67046); deploy those rather than attempting to author equivalents.

CVE assessment

10 referenced CVEs — 2 actively exploited (CISA KEV), 2 critical (CVSS ≥ 9.0)

7. Sources

• Cisco Talos — Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities — https://blog.talosintelligence.com/microsoft-patch-tuesday-for-september-2026/ — 2026-09-08
• SANS Internet Storm Center — September 2026 Microsoft Patch Tuesday — https://isc.sans.edu/diary/rss/33320 — 2026-09-08
• Rapid7 — Patch Tuesday, September 2026 — https://www.rapid7.com/blog/post/em-patch-tuesday-september-2026 — 2026-09-08
• Tenable Research — Microsoft's September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880) — https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880 — 2026-09-08

8. Adverse Trace position

This is the largest Patch Tuesday on record by every vendor's count, but volume is not the risk driver — the two KEV-listed, actively exploited local EoP zero-days are. Both CVE-2026-81963 and CVE-2026-85880 are CVSS 7.8 HIGH, both were added to CISA KEV on 2026-09-08, and both convert low-privilege footholds into SYSTEM, which makes them the enabling stage for the ransomware and data-theft intrusions that dominate EMEA financial-services incident response. We assess the practical severity of these two as higher than their base scores suggest, consistent with Rapid7's assessment that attackers prefer a two-stage EoP chain over a one-shot RCE. No attribution exists in the source material and none should be inferred; the affected-version lists are single-sourced to SANS and should be verified against Microsoft's KB before deployment scoping. Our recommendation to clients is a 24-hour emergency cycle for the two KEV items plus the DNS Server and Spring Cloud Azure criticals, a 72-hour cycle for the remaining "more likely" list and exposed server-side RCEs, and standard-cycle handling of the long tail. Adverse Trace will monitor for public exploit artefacts, PoC releases, and KEV additions to the remaining September CVEs and will re-issue this advisory if exploitation of any non-KEV item is confirmed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.