> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880) - URL: https://f4n6.co.uk/security-feed/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880/ - Published: 2026-09-08T22:58:02.000Z - Updated: 2026-09-08T22:58:02.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-81963, CVE-2026-85880 ## 1\. Executive summary Microsoft's September 2026 Patch Tuesday is the largest release on record: 964 CVEs patched, 104 rated critical and 860 rated important, with zero moderate or low. Two elevation-of-privilege zero-days were exploited in the wild prior to patching and are both listed in CISA's KEV (added 2026-09-08): CVE-2026-81963 (Windows Update Stack EoP, CVSS 7.8 HIGH) and CVE-2026-85880 (Windows ALPC EoP, CVSS 7.8 HIGH). Both are local privilege-escalation paths to SYSTEM, meaning attackers must already have a foothold — but that is exactly the position ransomware and access-broker operators occupy post-initial-access. EMEA financial services clients running broad Windows estates should treat the two KEV EoPs and the unauthenticated RCEs in DNS Server (CVE-2026-69730, 9.8) and Remote Desktop Services (CVE-2026-69525, 9.8) as this month's priority patch targets. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | A record 964-CVE release, including two actively exploited zero-days, materially exceeds what ad-hoc patching cycles can absorb; clients must be able to demonstrate their testing regime covers a release of this scale within a defined window. | Use this release as a forcing function to evidence risk-based patch prioritisation (KEV first, then Exploitation More Likely, then CVSS) as part of the Art. 24 testing programme, rather than treating patching as an out-of-scope operational task. | | DORA Art. 28: ICT third-party risk — general principles | The release patches components commonly delivered through third-party or managed service arrangements (Azure Arc, Azure CycleCloud, Azure HDInsights, Power Automate, Spring Cloud Azure, Microsoft Teams for Android), where the client does not directly control patch cadence. | Identify which of the 964 CVEs fall on assets operated by ICT third-party providers, and confirm contractual and operational mechanisms exist to get those patched — do not assume the provider's default cycle covers KEV items on your estate. | No specific NIS2 article is directly engaged by this item: NIS2 Art. 21(2(d) supply chain security measures and Art. 23 incident reporting obligations are triggered by incidents and supply-chain relationships generally, not by anything distinctive to this patch release, and forcing them here would be compliance-checkbox padding. ## 3\. Technical analysis & attack chain ### Triage table (prioritised: KEV entries first, then by urgency within the release) | CVE | Component | CVSS | KEV/Exploitability | Why it matters | | -------------- | -------------------------------------------- | ------------ | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2026-81963 | Windows Update Stack | 7.8 HIGH | **IN CISA KEV** (added 2026-09-08); exploited in the wild as a zero-day | Local EoP to SYSTEM via link-following flaw in the update stack itself — the component that delivers patches. First Windows Update Stack EoP to be exploited in the wild of seven patched since 2022. | | CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) | 7.8 HIGH | **IN CISA KEV** (added 2026-09-08); exploited in the wild as a zero-day | Local EoP to SYSTEM via ALPC. First ALPC flaw in Patch Tuesday since April 2023; second ALPC zero-day exploited in the wild since CVE-2023-21674 (January 2023). | | CVE-2026-69730 | Windows DNS Server | 9.8 CRITICAL | Not in KEV; Microsoft assesses "Exploitation More Likely" | Unauthenticated, remote RCE via use-after-free — a crafted packet to an exposed DNS server yields code execution without credentials. Eight additional DNS Server RCEs patched this month did not reach this exploitability rating. | | CVE-2026-69525 | Remote Desktop Services | 9.8 | Not in KEV; "Exploitation More Likely" | RCE via use-after-free in RDS. Three additional RDS RCEs patched this month with differing CVSS and exploitability ratings. | | CVE-2026-69676 | Windows Kerberos | 8.8 CRITICAL | Not in KEV; "Exploitation More Likely" | RCE via authentication bypass using capture-replay against Kerberos, from low-level access. Direct path into identity infrastructure. | | CVE-2026-69380 | Microsoft Exchange Server | 8.1 | Not in KEV; "Exploitation Less Likely" | Missing-authorization EoP: an authenticated low-privilege mailbox user can read/send as other mailboxes and access attachments. High CVSS but low assessed exploitability. | ### Attack chain — the two KEV zero-days (confirmed steps only) 1. **Precondition:** attacker already has code execution on a target Windows host under a low-privilege context (user-level), or can induce a user to run malicious code. Both CVEs are local EoP; neither is a remote initial-access vector. 2. **Privilege escalation:** the attacker triggers the vulnerable component — - CVE-2026-81963: a link-following vulnerability in the Windows Update Stack (NVD classifies this as CWE-59, improper link resolution before file access, alongside CWE-284 improper access control). Exploitation elevates the attacker to SYSTEM. - CVE-2026-85880: a flaw in Windows ALPC (NVD classifies as CWE-122 heap-based buffer overflow alongside CWE-908 use of uninitialized resource). Exploitation yields SYSTEM-level privileges. 3. **Post-exploitation:** with SYSTEM, the attacker operates with full local control — credential theft from LSASS, installation of persistence (services, scheduled tasks, drivers), disabling of security tooling, and unimpeded lateral movement preparation. **Why this pairing matters:** both zero-days are EoP-only, so their operational value is as the *second stage* of an intrusion — converting an initial foothold (phishing payload, malicious macro, exploited edge device, commodity infostealer) into full local control. Detection effort should therefore focus on the post-exploitation window on endpoints, not on network ingress. **Context on scale:** EoP vulnerabilities accounted for 44.7% of this month's 964 CVEs, with RCE at 26.8%. The release spans the full Windows and Microsoft stack — including AD CS, AD DS, AD FS, Exchange Server, SharePoint, SQL Server, OpenSSH for Windows, Hyper-V, BitLocker, Kerberos, NTFS, SMB client and server, HTTP.sys, and numerous kernel and storage drivers. Microsoft's July 2026 release (569 CVEs) was itself a record, attributed by Microsoft to its multi-model agentic scanning harness (MDASH) surfacing vulnerabilities faster; September nearly doubles that figure. Clients should expect elevated release volumes to be the new baseline, not an anomaly. **Caveats and confidence:** All technical detail above is single-sourced to Tenable's Patch Tuesday analysis of Microsoft's advisories. The specific in-the-wild exploitation claims ("exploited in the wild as a zero-day") are attributed by Tenable to Microsoft; no victim sectors, actor attribution, or campaign detail is available in the source material, and no MITRE ATT&CK actor profile exists for any named actor — there is no named actor. The KEV listing and CVSS 7.8 HIGH ratings for both zero-days are corroborated by the verified NVD/CISA reference data. Note one discrepancy: Tenable rates both zero-days "important" per Microsoft's severity banding, while the verified NVD data records both at CVSS 7.8 HIGH — the verified values govern here. ## 4\. Mitigation & containment ### P1 — within 24 hours - **Patch CVE-2026-81963 and CVE-2026-85880 first.** Both are in CISA KEV with confirmed in-the-wild exploitation. Prioritise internet-exposed, multi-user, and high-value endpoints (workstations, jump hosts, terminal servers, developer machines) where a low-privilege foothold is most likely to exist. - **Patch CVE-2026-69730 (DNS Server RCE, 9.8, unauthenticated, "Exploitation More Likely")** on every server holding the DNS Server role — especially any with port 53 reachable beyond the internal segment. Until patched, restrict inbound DNS (TCP/UDP 53) at the firewall to trusted resolver clients only. - **Patch CVE-2026-69525 (RDS RCE, 9.8, "Exploitation More Likely")** on all Remote Desktop Services hosts. Until patched, confirm RDP (TCP 3389 / UDP) is not internet-exposed and enforce RD Gateway or VPN-only access. - **Hunt for prior exploitation:** both KEV EoPs leave no source-disclosed IOC trail, so hunt behaviourally — unexpected SYSTEM-privilege processes spawned from user-context parents, new services or scheduled tasks created under user sessions, and ALPC-related crash artefacts (WER reports referencing ALPC) on high-value hosts. ### P2 — within 72 hours - **Patch CVE-2026-69676 (Kerberos RCE, 8.8 critical, "Exploitation More Likely")** on all domain controllers and Kerberos-bearing servers. Review Kerberos ticketing logs for capture-replay anomalies (repeated ticket reuse from single principals). - **Patch CVE-2026-69380 (Exchange EoP, 8.1)** on Exchange servers. Although rated "Exploitation Less Likely," the impact — cross-mailbox access and send-as capability — is a direct fraud and BEC enabler for financial services. Review mailbox audit logs for anomalous cross-mailbox access by low-privilege accounts. - **Patch the remaining RDS and DNS Server RCEs** (three additional RDS RCEs; eight additional DNS Server RCEs) — same attack surface, same patch deployment, no reason to split them across maintenance windows. ### P3 — within 7 days - **Work the long tail by patch mechanism, not CVE-by-CVE:** deploy the cumulative Windows update to all endpoints and servers (this clears the Windows kernel, driver, Win32K, storage, and networking CVEs in one pass); apply the Exchange Server, SharePoint, Office, SQL Server, .NET/Visual Studio, and Azure-component updates to the respective server roles; push the Microsoft Teams for Android update via MDM; update Visual Studio Code and GitHub Copilot extensions on developer estates. - **Re-scan** the environment after deployment to confirm coverage — with 964 CVEs across this many components, partial deployment is the most likely failure mode. Tenable's plugin list for this release is available via their September 2026 Patch Tuesday post. - **Feed the KEV entries into your vulnerability-management SLA tracking** as evidence of risk-based prioritisation (supports the DORA Art. 24 position above). ## 5\. Indicators of compromise No indicators of compromise available in the source material. **Behavioural indicators** (derived from the vulnerability mechanics; no atomic IOCs were published for the in-the-wild exploitation): | Behaviour | Where to observe | Confidence | | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | Local privilege escalation to SYSTEM from a user-context process on unpatched hosts (both KEV CVEs) | EDR process-tree telemetry; Windows event logs (4688 process creation, 7045 service installation) | Moderate — mechanism is confirmed, specific post-exploitation behaviour is not described in sources | | Heap corruption / crash in ALPC-related components on unpatched hosts (CVE-2026-85880, CWE-122) | Windows Error Reporting / application crash dumps referencing ALPC | Low — inferred from the CWE classification, not observed | | Unauthenticated crafted-packet RCE attempts against Windows DNS Server (CVE-2026-69730) | DNS server firewall and packet logs; EDR on DNS servers | Low — vulnerability is confirmed, no exploit traffic described in sources | | Cross-mailbox access by low-privilege authenticated accounts (CVE-2026-69380) | Exchange mailbox audit logging | Moderate — access pattern is directly described in the advisory | ## 6\. Detection Insufficient indicators to author detection rules. The source material describes vulnerability mechanisms only — no malware samples, command lines, file artefacts, mutexes, or network signatures exist for the in-the-wild exploitation of either KEV CVE. Authoring YARA or Sigma rules from CVE identifiers or component names would detect reporting about the threat, not the threat itself. Rely on the behavioural hunting outlined in §4 P1 and the behavioural indicators in §5 until Microsoft or CISA publish exploitation detail. ## CVE assessment 2 referenced CVEs — **2 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-81963](https://nvd.nist.gov/vuln/detail/CVE-2026-81963?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-09-08 | — | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate… | | [CVE-2026-85880](https://nvd.nist.gov/vuln/detail/CVE-2026-85880?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-09-08 | — | Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | ## 7\. Sources - Tenable Research — Microsoft's September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880) — https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880 — 2026-09-08 - Tenable Research — Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164) — https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164 — July 2026 (context on MDASH-driven release volume) - BleepingComputer — Microsoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flaws — https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2026-patch-tuesday-fixes-3-zero-day-200-flaws/ — June 2026 (context only) - Verified reference data: NVD/CISA KEV records for CVE-2026-81963 and CVE-2026-85880 (both CVSS 7.8 HIGH, KEV added 2026-09-08) ## 8\. Adverse Trace position This is the largest Patch Tuesday on record and the second consecutive record month, driven by Microsoft's agentic scanning programme — clients must assume high-volume releases are now structural, not exceptional. Severity is driven by the two KEV-listed EoP zero-days (both CVSS 7.8 HIGH, both confirmed exploited in the wild, both single-sourced to Tenable's reporting of Microsoft's advisories — verify against Microsoft's own advisories before enforcing SLA breach notifications internally), reinforced by unauthenticated 9.8-rated RCEs in DNS Server and RDS that are one misconfigured firewall rule away from remote compromise. For EMEA financial services the practical risk is not any single CVE but patch-deployment failure across a 964-CVE release: partial coverage of the cumulative update leaves KEV items unpatched on forgotten estates. We will monitor for Microsoft or CISA publication of exploitation detail and IOCs for CVE-2026-81963 and CVE-2026-85880, update this advisory if attack-chain or actor attribution emerges, and track whether October's release sustains the elevated volume. --- [Read the original source →](https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*