Patch Tuesday - September 2026

1. Executive summary

Microsoft's September 2026 Patch Tuesday is the largest single-day release in the company's history: 974 own-product CVEs (723 in Windows), plus 25 non-Microsoft CVEs fixed through Microsoft channels — 999 in total, with vendor counts varying slightly (Tenable counts 964; SANS/Talos 973). Two Windows elevation-of-privilege zero-days are confirmed exploited in the wild and both are in the CISA KEV catalogue: CVE-2026-85880 (Windows ALPC, CVSS 7.8 HIGH, heap-based buffer overflow, KEV added 2026-09-08) and CVE-2026-81963 (Windows Update Stack, CVSS 7.8 HIGH, improper link resolution, KEV added 2026-09-08). Both grant SYSTEM from low-privileged local access with no user interaction, making them the classic second stage of a two-stage ransomware/malware chain — the standard pattern for EMEA financial services compromise. Separately, CVE-2026-85046 (Chromium V8, CVSS 8.8 HIGH, KEV added 2026-09-04) is an exploited-in-the-wild browser zero-day patched in Chrome on 2026-09-03 and in the Edge stable channel on 2026-09-02, but Microsoft has published no security advisory for it — clients relying on advisories rather than patch status will miss it. The Adobe Commerce/Magento zero-day CVE-2026-75650 ("StyleSmuggler", unauthenticated RCE, actively abused against stores since 2026-09-04) is also in scope for any client running e-commerce.

2. Regulatory framing

No other article in the regulatory reference is engaged by the specific facts of this item.

3. Technical analysis & attack chain

This is a patch-cycle advisory covering ~999 CVEs; the triage table below is ordered KEV-first, then by EPSS, per verified reference data. Full mechanism depth is given only for the three most urgent items.

Prioritised triage table

CVE-2026-85880 — Windows ALPC EoP (KEV, exploited in the wild)

Mechanism. Heap-based buffer overflow (CWE-122) with use of an uninitialized resource (CWE-908) in the Windows Advanced Local Procedure Call (ALPC) mechanism, a kernel capability facilitating inter-process communication. The overflow enables an out-of-bounds write.

Confirmed attack chain

1. Attacker obtains low-privileged code execution on the target host (initial access via separate vector — phishing payload, commodity malware, or an RCE elsewhere in the chain; not specified in the sources).
2. Attacker runs code inside a low-privilege AppContainer.
3. The AppContainer code triggers the ALPC heap overflow / out-of-bounds write.
4. Sandbox escape: the attacker escapes the AppContainer and gains SYSTEM privileges on the host.
5. No user interaction is required at any step.

Affected versions (per SANS): Windows 10 and Windows Server 2012, 2016, 2019 and 2022. Notably, Windows 11 and Windows Server 2025 receive no patch because they are not affected — Rapid7 attributes this to Microsoft's ongoing rewrite of critical kernel components in Rust. This is a useful estate signal: Windows 11/Server 2025 hosts are not exposed to this specific flaw.

Impact. SYSTEM on multi-user hosts, exposed workstations, and servers where local code execution paths exist. Rapid7's framing is direct: this is the elevation stage of a standard ransomware entry sequence. No attribution for the in-the-wild exploitation has been published — treat any actor claim as unconfirmed.

CVE-2026-81963 — Windows Update Stack EoP (KEV, exploited in the wild)

Mechanism. Improper link resolution before file access (link following, CWE-59) combined with improper access control (CWE-284) in the Windows Update Stack.

Confirmed attack chain

1. Attacker has low-privileged local access on the target (authenticated local attacker).
2. Attacker plants a malicious link that the Windows Update Stack follows.
3. The Update Stack resolves the attacker-controlled link and overwrites a system component with an attacker-controlled imposter (Rapid7's characterisation of the patch's effect — the precise overwrite target is not published).
4. Attacker elevates to SYSTEM.

Affected versions: all supported Windows versions receive a patch. SANS specifies Windows 11 and Windows Server 2025, including Server Core installations; Rapid7 states all supported versions are covered.

Impact. Same end-state as CVE-2026-85880: SYSTEM from low-privilege local access. Zero Day Initiative's Dustin Childs assesses it is more likely to be combined with a code-execution bug to spread malware or ransomware than used alone. No attribution published.

CVE-2026-85046 — Chromium V8 zero-day (KEV, exploited in the wild)

Mechanism. Type confusion (CWE-843) in the V8 JavaScript engine shared by Chrome and Edge. Google Chrome patched it on 2026-09-03 alongside 11 other vulnerabilities; the Edge stable channel received the fix a day earlier, on 2026-09-02, per the Edge release notes.

The advisory gap. As of 2026-09-08, Microsoft has published no security advisory for CVE-2026-85046 — the advisory URL returns a 404. Clients whose vulnerability management is driven by vendor advisories will not see this exploited zero-day at all. Patched Edge/Chrome builds are protected; unpatched builds are exposed to an actively exploited V8 flaw.

Edge exposure uncertainty (single-sourced caveat). Rapid7 states it is not yet clear whether the 11 other Chromium vulnerabilities Chrome fixed alongside CVE-2026-85046 — including CVE-2026-85045 (TOCTOU race, CVSS 7.5 HIGH, not in KEV, EPSS 0%) — are patched in Edge. Until Microsoft confirms, the safe assumption is that they remain unpatched in Edge. This is a single-vendor assessment; verify against Edge release notes before treating Edge as fully current on the Chromium backlog.

Other items of note from the release (corroborated across sources)

• CVE-2026-55007 — Exchange Server RCE, CVSS 8.1, exploitation less likely. Childs rates it the most important Exchange patch this month: a remote, unauthenticated attacker sends an email with a malicious Visio attachment; code executes when the server processes the attachment during content indexing, no user interaction. Microsoft calls it "difficult to reliably trigger"; Childs counters that the attacker only needs to succeed once. Nine Exchange Server CVEs total this month.
• CVE-2026-66302 — Skype for Business Server unauthenticated RCE, CVSS 9.8 CRITICAL (external control of file name/path; crafted network request writes attacker-controlled file to arbitrary location). Affects Skype for Business Server 2015 CU13, 2019 CU8, Subscription Edition CU1. Not exploited in the wild.
• CVE-2026-69579 — Windows Message Queuing (MSMQ) use-after-free RCE, CVSS 9.8 CRITICAL, unauthenticated remote via crafted packet to the MSMQ service. Not exploited in the wild.
• CVE-2026-69845 / CVE-2026-72979 — Windows DHCP Server RCE, both CVSS 9.8, exploitation less likely.
• CVE-2026-69730 — Windows DNS Server use-after-free RCE, CVSS 9.8, exploitation more likely per Microsoft.
• CVE-2026-69676 — Windows Kerberos RCE, CVSS 8.8, exploitation more likely.
• CVE-2026-69854 — Spring Cloud Azure EoP, CVSS 9.0, exploitation more likely.
• Childs counts 20 wormable patches in this release.
• Adobe CVE-2026-75650 "StyleSmuggler" — unauthenticated RCE in Magento/Adobe Commerce 2.4.4 through 2.4.9 via injection of malicious PHP into Magento templates through "styles" properties, evading detection. Actively exploited since 2026-09-04 (Sansec); confirmed attacks install a backdoor connecting to a C2 server. In KEV. Relevant to any client e-commerce estate.

Count discrepancies. Rapid7 counts 974 Microsoft CVEs (999 total with non-Microsoft); Tenable counts 964 (104 critical, 860 important); SANS and Talos count 973 (113 critical, 82 of them RCE). These are counting-methodology differences, not factual disputes; the release is record-setting under any count.

4. Mitigation & containment

P1 — within 24 hours

1. Patch CVE-2026-85880 (ALPC) and CVE-2026-81963 (Update Stack) on all affected Windows hosts. Both are KEV-listed and actively exploited; CISA has set a 2026-09-22 remediation deadline for federal agencies, which is a sensible external benchmark for your own estate. Prioritise multi-user systems (VDI, terminal servers, trading-floor workstations), exposed workstations, and servers with local code-execution paths. Windows 11 and Server 2025 need no action for CVE-2026-85880 (not affected); all supported versions need the CVE-2026-81963 patch, including Server Core.
2. Verify Edge and Chrome are on the 2026-09-02/03 stable builds (CVE-2026-85046). Do not wait for a Microsoft advisory — none exists. Force-update browser fleets via update policy; confirm build versions estate-wide. Treat the 11 accompanying Chromium fixes (including CVE-2026-85045) as unpatched in Edge until Microsoft confirms, and consider a short-term policy of preferring Chrome where both are installed and only Chrome is confirmed current.
3. Patch Adobe Commerce/Magento CVE-2026-75650 immediately if any e-commerce property runs Magento/Adobe Commerce 2.4.4–2.4.9 (CISA deadline 2026-09-11). Hotfix shipped 2026-09-07 (Monday). Review web server logs for template "styles" modifications and unexpected outbound connections since 2026-09-04.

P2 — within 72 hours

4. Patch Exchange Server — all nine CVEs, led by CVE-2026-55007 (unauthenticated RCE via malicious Visio attachment in email processing). Exchange is perimeter-facing in most financial services estates; schedule downtime now.
5. Patch exposed network services with RCE exposure: MSMQ (CVE-2026-69579), DNS Server (CVE-2026-69730 — exploitation more likely), DHCP Server (CVE-2026-69845, CVE-2026-72979), Kerberos (CVE-2026-69676 — exploitation more likely), Skype for Business Server (CVE-2026-66302). Where patching lags, disable the service if not required (MSMQ is a common candidate) and restrict port exposure at the firewall.
6. Patch Azure-hosted items where the client operates the service: Azure AI Language (CVE-2026-70352, CVSS 10.0), Azure Arc SQL Server Extension (CVE-2026-62895), Azure Cosmos DB (CVE-2026-69857 — exploitation more likely), Azure CycleCloud (CVE-2026-77909), Spring Cloud Azure (CVE-2026-69854 — exploitation more likely), Microsoft Authenticator (CVE-2026-80097).
7. Hunt for prior exploitation of the two Windows zero-days: review EDR telemetry for AppContainer processes exhibiting ALPC abuse and for suspicious link/symlink creation followed by Windows Update Stack file writes, on hosts that were unpatched between disclosure and remediation.

P3 — within 7 days

8. Complete the remaining Windows EoP backlog — the release is dominated by elevation-of-privilege fixes in kernel and service components (Biometric Service alone accounts for dozens of 7.8-scored EoP CVEs). Roll these through the standard ring-based deployment; the two-stage chain risk they represent is real but they are not under active exploitation.
9. Patch the developer toolchain (.NET/Visual Studio/VS Code RCE and security-feature-bypass sets) on build and developer machines.
10. October 2026 lifecycle planning (act now, before the dates): Windows 11 24H2 Home/Pro end servicing 2026-10-14; Windows Server 2012/2012 R2 ESU expires finally; Office 2021 (including LTSC) leaves support with no ESU; Exchange Server 2016 and 2019 join the no-ESU club after two reprieves. Inventory these versions now and budget migration or isolation.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators (from source descriptions of the exploited flaws and StyleSmuggler attacks; no atomic IOCs published):

6. Detection

Insufficient indicators to author detection rules.

The sources describe vulnerability mechanisms and patch scope but contain no threat artefacts — no malicious strings, command lines, mutexes, file names, registry keys, hashes or C2 infrastructure — for the exploited CVEs or the StyleSmuggler backdoor. Authoring YARA/Sigma rules from CVE identifiers or product names would detect reporting about these threats, not the threats themselves.

CVE assessment

10 referenced CVEs — 3 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• Rapid7 — Patch Tuesday – September 2026 — https://www.rapid7.com/blog/post/em-patch-tuesday-september-2026 — 2026-09-08
• SANS Internet Storm Center — September 2026 Microsoft Patch Tuesday — https://isc.sans.edu/diary/rss/33320 — 2026-09-08
• The Register — Microsoft breaks Patch Tuesday record with 974-CVE deluge — https://www.theregister.com/security/2026/09/09/microsoft-breaks-patch-tuesday-record-with-974-cve-deluge/5295160 — 2026-09-09
• Cisco Talos — Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities — https://blog.talosintelligence.com/microsoft-patch-tuesday-for-september-2026/ — 2026-09-08
• Tenable Research — Microsoft's September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880) — https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880 — 2026-09-08

8. Adverse Trace position

This is the largest Microsoft patch release on record and it contains two actively exploited, KEV-listed Windows elevation-of-privilege zero-days — the exact class of flaw that converts a routine commodity infection into a SYSTEM-level ransomware deployment. Severity for the estate is HIGH: CVE-2026-85880 and CVE-2026-81963 are confirmed exploited in the wild (multi-source: Microsoft via Rapid7, SANS, Talos, The Register; both in CISA KEV per verified reference data), and the browser zero-day CVE-2026-85046 is equally confirmed but invisible to advisory-driven processes due to the missing Microsoft advisory — a process gap clients should treat as a standing risk for Chromium-based Edge coverage. Attribution for all three exploitations is unconfirmed; no actor names have been published and we will not speculate. The StyleSmuggler campaign against Magento/Adobe Commerce is corroborated by Sansec via The Register and is directly relevant to any client e-commerce or payments front-end; its C2 infrastructure is unpublished, so detection rests on template-integrity and egress monitoring. We assess the single-sourced items — the Edge status of the 11 accompanying Chromium fixes, and the precise overwrite mechanics of the Update Stack flaw — as low-to-moderate confidence pending Microsoft clarification. Adverse Trace will monitor for Microsoft's CVE-2026-85046 advisory, any published IOCs or attribution for the two Windows zero-days, and KEV additions from this release, and will issue a follow-up note if exploitation expands beyond the current three.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.