> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Patch Tuesday - September 2026 - URL: https://f4n6.co.uk/security-feed/patch-tuesday-september-2026/ - Published: 2026-09-09T09:23:06.000Z - Updated: 2026-09-09T09:23:05.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-85880, CVE-2026-81963, CVE-2026-85046, CVE-2026-85045, CVE-2026-80097 ## 1\. Executive summary Microsoft's September 2026 Patch Tuesday is the largest single-day release in the company's history: 974 own-product CVEs (723 in Windows), plus 25 non-Microsoft CVEs fixed through Microsoft channels — 999 in total, with vendor counts varying slightly (Tenable counts 964; SANS/Talos 973). Two Windows elevation-of-privilege zero-days are confirmed exploited in the wild and both are in the CISA KEV catalogue: **CVE-2026-85880** (Windows ALPC, CVSS 7.8 HIGH, heap-based buffer overflow, KEV added 2026-09-08) and **CVE-2026-81963** (Windows Update Stack, CVSS 7.8 HIGH, improper link resolution, KEV added 2026-09-08). Both grant SYSTEM from low-privileged local access with no user interaction, making them the classic second stage of a two-stage ransomware/malware chain — the standard pattern for EMEA financial services compromise. Separately, **CVE-2026-85046** (Chromium V8, CVSS 8.8 HIGH, KEV added 2026-09-04) is an exploited-in-the-wild browser zero-day patched in Chrome on 2026-09-03 and in the Edge stable channel on 2026-09-02, but Microsoft has published no security advisory for it — clients relying on advisories rather than patch status will miss it. The Adobe Commerce/Magento zero-day CVE-2026-75650 ("StyleSmuggler", unauthenticated RCE, actively abused against stores since 2026-09-04) is also in scope for any client running e-commerce. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | Two KEV-listed, actively exploited Windows kernel/update-stack elevation-of-privilege flaws (CVE-2026-85880, CVE-2026-81963) with no compensating control short of patching — the release is too large (974 CVEs) for undifferentiated deployment | Use risk-based patch prioritisation as the documented testing approach: KEV/exploited items inside the standard window, remainder tiered by exposure; evidence the prioritisation decision, not just the deployment | | DORA Art. 18: classification of ICT-related incidents and cyber threats | Active in-the-wild exploitation of CVE-2026-85880 and CVE-2026-81963 is a cyber threat requiring classification under the client's incident process even where no compromise has yet been detected | Threat-intel-driven classification of the KEV items should be logged; any confirmed exploitation on estate converts to an incident under Art. 17/19 handling | | NIS2 Art. 21(2)(d): supply chain security measures | The Edge advisory gap on CVE-2026-85046 — a patch shipped 2026-09-02 with no vendor advisory — plus October 2026 end-of-support events (Windows 11 24H2 Home/Pro, Office 2021, Exchange 2016/2019, Server 2012/R2 ESU expiry) mean vendor advisory feeds understate exposure | Do not treat vendor advisory publication as the exposure signal; verify patch status directly for Chromium-based Edge and inventory unsupported versions before the October dates | No other article in the regulatory reference is engaged by the specific facts of this item. ## 3\. Technical analysis & attack chain This is a patch-cycle advisory covering \~999 CVEs; the triage table below is ordered KEV-first, then by EPSS, per verified reference data. Full mechanism depth is given only for the three most urgent items. ### Prioritised triage table | CVE | Component | CVSS | KEV/EPSS | Why it matters | | -------------- | ------------------------------ | ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2026-85880 | Windows ALPC (kernel IPC) | 7.8 HIGH | **KEV (added 2026-09-08)** | Exploited in the wild; AppContainer sandbox escape to SYSTEM; affects Windows 10 and Server 2012/2016/2019/2022 — not Windows 11/Server 2025 | | CVE-2026-81963 | Windows Update Stack | 7.8 HIGH | **KEV (added 2026-09-08)** | Exploited in the wild; link-following EoP to SYSTEM; all supported Windows versions affected | | CVE-2026-85046 | Chromium V8 (Chrome/Edge) | 8.8 HIGH | **KEV (added 2026-09-04)** / EPSS 1% | Exploited in the wild; patched in Edge stable 2026-09-02 and Chrome 2026-09-03 but **no Microsoft advisory published** | | CVE-2026-70352 | Azure AI Language | 10.0 CRITICAL | Not in KEV / EPSS 1% | Missing authentication for critical function (CWE-306); CVSS 10.0; Microsoft exploitability index N/A | | CVE-2026-85045 | Chromium (TOCTOU) | 7.5 HIGH | Not in KEV / EPSS 0% | Patched in Chrome alongside CVE-2026-85046; **unconfirmed whether fixed in Edge** — treat as open in Edge until Microsoft states otherwise | | CVE-2026-80097 | Microsoft Authenticator | 8.6 HIGH | Not in KEV | Improper authentication (CWE-287); EoP; exploitation assessed less likely | | CVE-2026-62895 | Azure Arc SQL Server Extension | 8.8 HIGH | Not in KEV | SQL injection (CWE-89/942); EoP; exploitation less likely | | CVE-2026-69857 | Azure Cosmos DB | 8.5 HIGH | Not in KEV / EPSS 0% | IDOR-style authorization bypass (CWE-639); spoofing; Microsoft rates exploitation **more likely** | | CVE-2026-58611 | Xbox Gaming Services | 7.8 HIGH | Not in KEV | Improper authorization (CWE-285); EoP; exploitation less likely | | CVE-2026-77909 | Azure CycleCloud | 7.7 HIGH | Not in KEV | Insufficiently protected credentials (CWE-522); information disclosure; exploitation less likely | ### CVE-2026-85880 — Windows ALPC EoP (KEV, exploited in the wild) **Mechanism.** Heap-based buffer overflow (CWE-122) with use of an uninitialized resource (CWE-908) in the Windows Advanced Local Procedure Call (ALPC) mechanism, a kernel capability facilitating inter-process communication. The overflow enables an out-of-bounds write. ### Confirmed attack chain 1. Attacker obtains low-privileged code execution on the target host (initial access via separate vector — phishing payload, commodity malware, or an RCE elsewhere in the chain; not specified in the sources). 2. Attacker runs code inside a low-privilege AppContainer. 3. The AppContainer code triggers the ALPC heap overflow / out-of-bounds write. 4. Sandbox escape: the attacker escapes the AppContainer and gains SYSTEM privileges on the host. 5. No user interaction is required at any step. **Affected versions (per SANS):** Windows 10 and Windows Server 2012, 2016, 2019 and 2022\. Notably, **Windows 11 and Windows Server 2025 receive no patch because they are not affected** — Rapid7 attributes this to Microsoft's ongoing rewrite of critical kernel components in Rust. This is a useful estate signal: Windows 11/Server 2025 hosts are not exposed to this specific flaw. **Impact.** SYSTEM on multi-user hosts, exposed workstations, and servers where local code execution paths exist. Rapid7's framing is direct: this is the elevation stage of a standard ransomware entry sequence. No attribution for the in-the-wild exploitation has been published — treat any actor claim as unconfirmed. ### CVE-2026-81963 — Windows Update Stack EoP (KEV, exploited in the wild) **Mechanism.** Improper link resolution before file access (link following, CWE-59) combined with improper access control (CWE-284) in the Windows Update Stack. ### Confirmed attack chain 1. Attacker has low-privileged local access on the target (authenticated local attacker). 2. Attacker plants a malicious link that the Windows Update Stack follows. 3. The Update Stack resolves the attacker-controlled link and overwrites a system component with an attacker-controlled imposter (Rapid7's characterisation of the patch's effect — the precise overwrite target is not published). 4. Attacker elevates to SYSTEM. **Affected versions:** all supported Windows versions receive a patch. SANS specifies Windows 11 and Windows Server 2025, including Server Core installations; Rapid7 states all supported versions are covered. **Impact.** Same end-state as CVE-2026-85880: SYSTEM from low-privilege local access. Zero Day Initiative's Dustin Childs assesses it is more likely to be combined with a code-execution bug to spread malware or ransomware than used alone. No attribution published. ### CVE-2026-85046 — Chromium V8 zero-day (KEV, exploited in the wild) **Mechanism.** Type confusion (CWE-843) in the V8 JavaScript engine shared by Chrome and Edge. Google Chrome patched it on 2026-09-03 alongside 11 other vulnerabilities; the Edge stable channel received the fix a day earlier, on 2026-09-02, per the Edge release notes. **The advisory gap.** As of 2026-09-08, Microsoft has published no security advisory for CVE-2026-85046 — the advisory URL returns a 404\. Clients whose vulnerability management is driven by vendor advisories will not see this exploited zero-day at all. Patched Edge/Chrome builds are protected; unpatched builds are exposed to an actively exploited V8 flaw. **Edge exposure uncertainty (single-sourced caveat).** Rapid7 states it is not yet clear whether the 11 other Chromium vulnerabilities Chrome fixed alongside CVE-2026-85046 — including CVE-2026-85045 (TOCTOU race, CVSS 7.5 HIGH, not in KEV, EPSS 0%) — are patched in Edge. Until Microsoft confirms, the safe assumption is that they remain unpatched in Edge. This is a single-vendor assessment; verify against Edge release notes before treating Edge as fully current on the Chromium backlog. ### Other items of note from the release (corroborated across sources) - **CVE-2026-55007** — Exchange Server RCE, CVSS 8.1, exploitation less likely. Childs rates it the most important Exchange patch this month: a remote, unauthenticated attacker sends an email with a malicious Visio attachment; code executes when the server processes the attachment during content indexing, no user interaction. Microsoft calls it "difficult to reliably trigger"; Childs counters that the attacker only needs to succeed once. Nine Exchange Server CVEs total this month. - **CVE-2026-66302** — Skype for Business Server unauthenticated RCE, CVSS 9.8 CRITICAL (external control of file name/path; crafted network request writes attacker-controlled file to arbitrary location). Affects Skype for Business Server 2015 CU13, 2019 CU8, Subscription Edition CU1\. Not exploited in the wild. - **CVE-2026-69579** — Windows Message Queuing (MSMQ) use-after-free RCE, CVSS 9.8 CRITICAL, unauthenticated remote via crafted packet to the MSMQ service. Not exploited in the wild. - **CVE-2026-69845 / CVE-2026-72979** — Windows DHCP Server RCE, both CVSS 9.8, exploitation less likely. - **CVE-2026-69730** — Windows DNS Server use-after-free RCE, CVSS 9.8, exploitation **more likely** per Microsoft. - **CVE-2026-69676** — Windows Kerberos RCE, CVSS 8.8, exploitation **more likely**. - **CVE-2026-69854** — Spring Cloud Azure EoP, CVSS 9.0, exploitation **more likely**. - Childs counts **20 wormable patches** in this release. - **Adobe CVE-2026-75650 "StyleSmuggler"** — unauthenticated RCE in Magento/Adobe Commerce 2.4.4 through 2.4.9 via injection of malicious PHP into Magento templates through "styles" properties, evading detection. Actively exploited since 2026-09-04 (Sansec); confirmed attacks install a backdoor connecting to a C2 server. In KEV. Relevant to any client e-commerce estate. **Count discrepancies.** Rapid7 counts 974 Microsoft CVEs (999 total with non-Microsoft); Tenable counts 964 (104 critical, 860 important); SANS and Talos count 973 (113 critical, 82 of them RCE). These are counting-methodology differences, not factual disputes; the release is record-setting under any count. ## 4\. Mitigation & containment ### P1 — within 24 hours 1. **Patch CVE-2026-85880 (ALPC) and CVE-2026-81963 (Update Stack) on all affected Windows hosts.** Both are KEV-listed and actively exploited; CISA has set a 2026-09-22 remediation deadline for federal agencies, which is a sensible external benchmark for your own estate. Prioritise multi-user systems (VDI, terminal servers, trading-floor workstations), exposed workstations, and servers with local code-execution paths. Windows 11 and Server 2025 need no action for CVE-2026-85880 (not affected); all supported versions need the CVE-2026-81963 patch, including Server Core. 2. **Verify Edge and Chrome are on the 2026-09-02/03 stable builds** (CVE-2026-85046). Do not wait for a Microsoft advisory — none exists. Force-update browser fleets via update policy; confirm build versions estate-wide. Treat the 11 accompanying Chromium fixes (including CVE-2026-85045) as unpatched in Edge until Microsoft confirms, and consider a short-term policy of preferring Chrome where both are installed and only Chrome is confirmed current. 3. **Patch Adobe Commerce/Magento CVE-2026-75650 immediately if any e-commerce property runs Magento/Adobe Commerce 2.4.4–2.4.9** (CISA deadline 2026-09-11). Hotfix shipped 2026-09-07 (Monday). Review web server logs for template "styles" modifications and unexpected outbound connections since 2026-09-04. ### P2 — within 72 hours 1. **Patch Exchange Server** — all nine CVEs, led by CVE-2026-55007 (unauthenticated RCE via malicious Visio attachment in email processing). Exchange is perimeter-facing in most financial services estates; schedule downtime now. 2. **Patch exposed network services with RCE exposure:** MSMQ (CVE-2026-69579), DNS Server (CVE-2026-69730 — exploitation more likely), DHCP Server (CVE-2026-69845, CVE-2026-72979), Kerberos (CVE-2026-69676 — exploitation more likely), Skype for Business Server (CVE-2026-66302). Where patching lags, disable the service if not required (MSMQ is a common candidate) and restrict port exposure at the firewall. 3. **Patch Azure-hosted items** where the client operates the service: Azure AI Language (CVE-2026-70352, CVSS 10.0), Azure Arc SQL Server Extension (CVE-2026-62895), Azure Cosmos DB (CVE-2026-69857 — exploitation more likely), Azure CycleCloud (CVE-2026-77909), Spring Cloud Azure (CVE-2026-69854 — exploitation more likely), Microsoft Authenticator (CVE-2026-80097). 4. **Hunt for prior exploitation** of the two Windows zero-days: review EDR telemetry for AppContainer processes exhibiting ALPC abuse and for suspicious link/symlink creation followed by Windows Update Stack file writes, on hosts that were unpatched between disclosure and remediation. ### P3 — within 7 days 1. **Complete the remaining Windows EoP backlog** — the release is dominated by elevation-of-privilege fixes in kernel and service components (Biometric Service alone accounts for dozens of 7.8-scored EoP CVEs). Roll these through the standard ring-based deployment; the two-stage chain risk they represent is real but they are not under active exploitation. 2. **Patch the developer toolchain** (.NET/Visual Studio/VS Code RCE and security-feature-bypass sets) on build and developer machines. 3. **October 2026 lifecycle planning (act now, before the dates):** Windows 11 24H2 Home/Pro end servicing 2026-10-14; Windows Server 2012/2012 R2 ESU expires finally; Office 2021 (including LTSC) leaves support with no ESU; Exchange Server 2016 and 2019 join the no-ESU club after two reprieves. Inventory these versions now and budget migration or isolation. ## 5\. Indicators of compromise No indicators of compromise available in the source material. **Behavioural indicators** (from source descriptions of the exploited flaws and StyleSmuggler attacks; no atomic IOCs published): | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | | Low-privilege AppContainer process triggering ALPC kernel activity consistent with out-of-bounds write, followed by SYSTEM-level process creation | EDR process telemetry on Windows 10 / Server 2012–2022 hosts unpatched for CVE-2026-85880 | High (mechanism confirmed; no observed sample) | | Creation of malicious links/symlinks by low-privilege accounts followed by Windows Update Stack component file overwrites | EDR file/registry telemetry, Sysmon Event ID 4697/59 (symbolic link creation) and file-write monitoring on system component paths | Medium (mechanism inferred from patch description) | | Unexpected file writes to arbitrary server paths on Skype for Business Server 2015/2019/SE | Server-side file integrity monitoring, unexpected binaries in web/served paths | Medium (flaw not exploited in the wild) | | Magento/Adobe Commerce template "styles" properties containing injected PHP, and outbound connections from web server to unknown C2 | Web server file integrity monitoring on template files; egress firewall/NetFlow from e-commerce hosts, since 2026-09-04 | High (confirmed in attacks per Sansec; specific C2 addresses not published) | ## 6\. Detection Insufficient indicators to author detection rules. The sources describe vulnerability mechanisms and patch scope but contain no threat artefacts — no malicious strings, command lines, mutexes, file names, registry keys, hashes or C2 infrastructure — for the exploited CVEs or the StyleSmuggler backdoor. Authoring YARA/Sigma rules from CVE identifiers or product names would detect reporting about these threats, not the threats themselves. ## CVE assessment 10 referenced CVEs — **3 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-85046](https://nvd.nist.gov/vuln/detail/CVE-2026-85046?ref=f4n6.co.uk) | 8.8 High | ⚠ KEV 2026-09-04 | 1% | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the san… | | [CVE-2026-85880](https://nvd.nist.gov/vuln/detail/CVE-2026-85880?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-09-08 | — | Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | | [CVE-2026-81963](https://nvd.nist.gov/vuln/detail/CVE-2026-81963?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-09-08 | — | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate… | | [CVE-2026-70352](https://nvd.nist.gov/vuln/detail/CVE-2026-70352?ref=f4n6.co.uk) | 10.0 Critical | — | 1% | Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a… | | [CVE-2026-62895](https://nvd.nist.gov/vuln/detail/CVE-2026-62895?ref=f4n6.co.uk) | 8.8 High | — | — | Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a… | | [CVE-2026-80097](https://nvd.nist.gov/vuln/detail/CVE-2026-80097?ref=f4n6.co.uk) | 8.6 High | — | — | Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally. | | [CVE-2026-69857](https://nvd.nist.gov/vuln/detail/CVE-2026-69857?ref=f4n6.co.uk) | 8.5 High | — | 0% | Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a ne… | | [CVE-2026-58611](https://nvd.nist.gov/vuln/detail/CVE-2026-58611?ref=f4n6.co.uk) | 7.8 High | — | — | Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally. | | [CVE-2026-77909](https://nvd.nist.gov/vuln/detail/CVE-2026-77909?ref=f4n6.co.uk) | 7.7 High | — | — | Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network. | | [CVE-2026-85045](https://nvd.nist.gov/vuln/detail/CVE-2026-85045?ref=f4n6.co.uk) | 7.5 High | — | 0% | Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the san… | ## 7\. Sources - Rapid7 — *Patch Tuesday – September 2026* — https://www.rapid7.com/blog/post/em-patch-tuesday-september-2026 — 2026-09-08 - SANS Internet Storm Center — *September 2026 Microsoft Patch Tuesday* — https://isc.sans.edu/diary/rss/33320 — 2026-09-08 - The Register — *Microsoft breaks Patch Tuesday record with 974-CVE deluge* — https://www.theregister.com/security/2026/09/09/microsoft-breaks-patch-tuesday-record-with-974-cve-deluge/5295160 — 2026-09-09 - Cisco Talos — *Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities* — https://blog.talosintelligence.com/microsoft-patch-tuesday-for-september-2026/ — 2026-09-08 - Tenable Research — *Microsoft's September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)* — https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880 — 2026-09-08 ## 8\. Adverse Trace position This is the largest Microsoft patch release on record and it contains two actively exploited, KEV-listed Windows elevation-of-privilege zero-days — the exact class of flaw that converts a routine commodity infection into a SYSTEM-level ransomware deployment. Severity for the estate is HIGH: CVE-2026-85880 and CVE-2026-81963 are confirmed exploited in the wild (multi-source: Microsoft via Rapid7, SANS, Talos, The Register; both in CISA KEV per verified reference data), and the browser zero-day CVE-2026-85046 is equally confirmed but invisible to advisory-driven processes due to the missing Microsoft advisory — a process gap clients should treat as a standing risk for Chromium-based Edge coverage. Attribution for all three exploitations is unconfirmed; no actor names have been published and we will not speculate. The StyleSmuggler campaign against Magento/Adobe Commerce is corroborated by Sansec via The Register and is directly relevant to any client e-commerce or payments front-end; its C2 infrastructure is unpublished, so detection rests on template-integrity and egress monitoring. We assess the single-sourced items — the Edge status of the 11 accompanying Chromium fixes, and the precise overwrite mechanics of the Update Stack flaw — as low-to-moderate confidence pending Microsoft clarification. Adverse Trace will monitor for Microsoft's CVE-2026-85046 advisory, any published IOCs or attribution for the two Windows zero-days, and KEV additions from this release, and will issue a follow-up note if exploitation expands beyond the current three. --- [Read the original source →](https://www.rapid7.com/blog/post/em-patch-tuesday-september-2026?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*