September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th)

1. Executive summary

Microsoft's September 2026 Patch Tuesday is the largest release on record: 973 vulnerabilities patched, 113 rated critical, well ahead of the previous high of 664 set in July 2026. Two Windows elevation-of-privilege flaws are confirmed exploited in the wild and both are in CISA's KEV catalogue as of 2026-09-08: CVE-2026-81963 (Windows Update Stack EoP, CVSS 7.8 HIGH, link-resolution flaw affecting Windows 11 and Windows Server 2025) and CVE-2026-85880 (Windows ALPC EoP, CVSS 7.8 HIGH, heap-based buffer overflow enabling AppContainer sandbox escape to SYSTEM on Windows 10 and Server 2012–2022). Three unauthenticated, no-user-interaction critical RCEs — CVE-2026-66302 (Skype for Business Server, CVSS 9.8), CVE-2026-69579 (MSMQ, CVSS 9.8) and CVE-2026-69590 (RRAS, CVSS 9.8) — are not yet KEV-listed but present pre-authentication server compromise paths directly relevant to EMEA financial services estates. No vulnerability in this release was publicly disclosed before patch day. Patch deployment capacity, not threat novelty, is the binding constraint this month.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by the facts of this item beyond generic patch-management duties, which would apply to virtually any Patch Tuesday; we do not force that mapping.

3. Technical analysis & attack chain

Triage table (KEV entries first, then by severity from verified reference data):

The remaining ~966 CVEs in the release are not itemised here; the source provides a full table at https://patchlens.io. Notable clusters from that table include large batches of Office/Word/Excel/PowerPoint RCE and information-disclosure fixes, an extensive Windows Biometric Service EoP family, multiple Windows DHCP Server RCEs (including two 9.8s, CVE-2026-69845 and CVE-2026-72979), Windows DNS Server RCEs (CVE-2026-69730 at 9.8), and Exchange Server fixes — none exploited in the wild per the source.

Attack chain — the two KEV entries (confirmed exploited in the wild)

1. Initial access / precondition (local foothold): Both flaws require a local, authenticated attacker. CVE-2026-81963 requires low privileges on Windows 11 or Windows Server 2025 (including Server Core). CVE-2026-85880 requires the ability to run code inside a low-privilege AppContainer on Windows 10 or Server 2012/2016/2019/2022.
2. Vulnerability mechanism: - CVE-2026-81963 is an improper link resolution before file access flaw (CWE-59 per verified data; NVD also records CWE-284 improper access control — both classifications describe the same link-following abuse). The attacker abuses link-following behaviour in the Windows Update Stack to redirect a privileged file operation. - CVE-2026-85880 is a heap-based buffer overflow (CWE-122; NVD also records CWE-908 use of uninitialized resource) in Windows Advanced Local Procedure Call. The attacker triggers the overflow from within the AppContainer.
3. Privilege escalation outcome: CVE-2026-81963 yields SYSTEM. CVE-2026-85880 escapes the AppContainer sandbox and yields SYSTEM. Neither requires user interaction.
4. Post-exploitation: Not described in the source. No payload, C2, persistence mechanism, or attributed actor is reported for either flaw. Treat these as privilege-escalation primitives that an attacker with an existing low-privilege foothold (phishing payload, commodity malware, compromised low-priv account) chains to SYSTEM; the source's own guidance — prioritise multi-user systems, exposed workstations, and servers with local code-execution paths — reflects that chaining model.

The three critical unauthenticated RCEs (not exploited in the wild, not publicly disclosed)

• CVE-2026-66302 — Skype for Business Server. External control of a file name or path (CWE-73). An unauthenticated attacker sends a specially crafted network request that writes an attacker-controlled file to an arbitrary location on the server. Successful exploitation yields code execution without authentication or user interaction. Affected builds: Skype for Business Server 2015 CU13, 2019 CU8, Subscription Edition CU1. This is a classic arbitrary-file-write-to-RCE pattern on an edge-facing UC platform; any internet-exposed SfB Server front-end pool is the priority surface.
• CVE-2026-69579 — Windows Message Queuing. Use-after-free (CWE-416) in the MSMQ service. An unauthenticated attacker sends a specially crafted packet to an affected Message Queuing service over the network; no user interaction required; code execution with high confidentiality/integrity/availability impact. The source names TCP port 1801 as the MSMQ traffic to restrict where the service is retained.
• CVE-2026-69590 — Windows RRAS. Heap-based buffer overflow (CWE-122) in Routing and Remote Access Service. Unauthenticated remote attacker sends a crafted packet to an affected RRAS service over the network; no user interaction; code execution with serious CIA impact. Affects supported Windows 10, Windows 11, and Windows Server releases. RRAS is commonly enabled on edge/VPN hosts — precisely the systems where pre-auth RCE is most damaging.

Confidence caveats. The exploited-in-the-wild status of CVE-2026-81963 and CVE-2026-85880 is corroborated by both Microsoft (per the source) and CISA KEV listing (verified reference data, both added 2026-09-08). One discrepancy to note: the source text states CVE-2026-85880 "is not currently in CISA's Known Exploited Vulnerabilities catalogue" — the verified reference data supersedes this; it is in KEV as of 2026-09-08. No actor attribution exists for either exploited flaw; any naming of a group behind them would be unconfirmed and we make none. The technical descriptions of the three 9.8 RCEs are single-sourced (SANS ISC summary of Microsoft's advisories); verify against Microsoft's individual advisories before enforcing configuration changes such as service disablement.

4. Mitigation & containment

P1 — within 24 hours

• CVE-2026-81963 and CVE-2026-85880 (both KEV, both actively exploited): Deploy the September Windows security updates to all Windows 11 and Windows Server 2025 hosts (including Server Core) for CVE-2026-81963, and all Windows 10 and Server 2012/2016/2019/2022 hosts for CVE-2026-85880. Prioritise multi-user systems (terminal servers, jump hosts, VDI), exposed workstations, and any server where untrusted local code execution is possible. There is no vendor workaround named in the source; patching is the remediation.
• CVE-2026-66302 (Skype for Business Server): Apply Microsoft's updates to SfB Server 2015 CU13, 2019 CU8, and Subscription Edition CU1 immediately on any internet-facing or DMZ-adjacent deployment. Until patched, restrict network access to SfB Server front-end roles at the firewall. Review server logs for suspicious file writes and unexpected server-side code execution.

P2 — within 72 hours

• CVE-2026-69579 (MSMQ): Patch all hosts running Message Queuing. Where MSMQ is not required, disable the service. Where it is required, restrict network access to the service and limit exposure of MSMQ traffic including TCP port 1801 at host and perimeter firewalls until updates are applied.
• CVE-2026-69590 (RRAS): Patch all systems running RRAS. Where RRAS is not needed, disable it. Where it is needed (VPN/edge hosts), restrict network access to the service with firewalls or VPN controls and monitor for unexpected traffic to RRAS-enabled hosts.
• Inventory sweep: Identify every host running SfB Server, MSMQ, or RRAS across the estate — these three services are the ones with unauthenticated network RCE this month and are the most likely to be running unmanaged on legacy boxes.

P3 — within 7 days

• Remaining criticals by patch mechanism: Roll the September cumulative Windows updates across the standard estate (this captures the DHCP Server 9.8s CVE-2026-69845/CVE-2026-72979, the DNS Server 9.8 CVE-2026-69730, the Failover Cluster 9.8 CVE-2026-73010, the ICS 9.8 CVE-2026-72983, and the large Office/Word/Excel RCE batches in one motion). Apply the .NET security updates for CVE-2026-69805 and CVE-2026-69806 to servers running affected .NET versions. Apply Exchange Server updates (the EoP CVE-2026-69641 at 9.1 and spoofing CVE-2026-69356 at 9.3 are the highest in that cluster). Azure/AI-service items marked "no customer action required" need no client-side change.
• Validation: Confirm patch compliance for the two KEV CVEs estate-wide and evidence it — given both are actively exploited, unpatched hosts after day 7 should carry a documented exception.

5. Indicators of compromise

No indicators of compromise available in the source material. No exploits, payloads, hashes, domains, or IP addresses are associated with any CVE in this release in the provided content.

Behavioural indicators (derived from vulnerability mechanics, not observed intrusions):

6. Detection

Insufficient indicators to author detection rules. The source material contains no exploit artefacts, malicious strings, filenames, command lines, or network signatures — only vulnerability descriptions. Authoring YARA or Sigma rules from CVE identifiers or product names would detect reporting about these flaws, not exploitation of them. Recommend instead: enable and review EDR privilege-escalation detection on the KEV-affected platforms, and baseline file-write activity on SfB Server, MSMQ, and RRAS hosts pending vendor detection content.

CVE assessment

7 referenced CVEs — 2 actively exploited (CISA KEV), 3 critical (CVSS ≥ 9.0)

7. Sources

• SANS Internet Storm Center — September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th) — https://isc.sans.edu/diary/rss/33320 — 2026-09-08
• Verified reference data (NVD/CISA KEV, as supplied): CVE-2026-81963, CVE-2026-85880, CVE-2026-66302, CVE-2026-69579, CVE-2026-69590, CVE-2026-69805, CVE-2026-69806 — accessed 2026-09-08
• Context only (prior months, not basis for this advisory): Tenable Research, July 2026 Patch Tuesday — https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164; Cisco Talos, August 2026 — https://blog.talosintelligence.com/microsoft-patch-tuesday-for-august-2026/; SANS ISC, August 2026 — https://isc.sans.edu/diary/rss/33236

8. Adverse Trace position

This is the largest Patch Tuesday ever issued and the volume itself is the risk: patch-deployment pipelines sized for 200–400 CVEs per month will not clear 973 within standard SLAs, and the two KEV-listed, actively exploited EoP flaws (CVE-2026-81963, CVE-2026-85880 — both CVSS 7.8 HIGH) mean some fraction of the estate is exposed to a known-active threat from day one. We assess the KEV pair as the immediate priority for all EMEA financial services clients regardless of segment, followed by the three unauthenticated 9.8 CRITICAL RCEs (SfB Server, MSMQ, RRAS) on any internet-adjacent or internal-network-exposed hosts; the remaining long tail should be cleared through standard cumulative-update channels within the week, with documented exceptions for anything that cannot. Attribution for the in-the-wild exploitation is absent from all available material and we treat it as unknown; the technical detail on the three RCEs is single-sourced to the SANS summary of Microsoft advisories and should be verified against the vendor advisories before enforcement actions such as service disablement. Adverse Trace will monitor for exploit artefacts, PoC publication, and any KEV additions among the 9.8 RCEs, and will issue a follow-up note if exploitation of the non-KEV criticals is confirmed or if detection content becomes available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.