--- title: Microsoft's September 2026 Patch Tuesday fixes 974... description: Microsoft's September 2026 Patch Tuesday is the largest single patch release in company history, fixing between 964 and 974 CVEs, surpassing July's record of... canonical: https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited zero-days | daily.dev og:description: Microsoft's September 2026 Patch Tuesday is the largest single patch release in company history, fixing between 964 and 974 CVEs, surpassing July's record of... og:url: https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7 og:image: https://api.daily.dev/og/posts/b8aoT91D7.png og:image:alt: Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited zero-days og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited zero-days **[Collections](https://daily.dev/sources/collections)** · 5 min read · 3 upvotes · 1 comments ## Summary Microsoft's September 2026 Patch Tuesday is the largest single patch release in company history, fixing between 964 and 974 CVEs, surpassing July's record of 570. Two zero-days are under active exploitation: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (Windows ALPC EoP), both privilege escalation bugs suggesting attackers already have footholds. Other critical flaws include a CVSS 9.8 Windows DNS Server RCE, a CVSS 9.8 Windows Shell RCE, a CVSS 9.8 Remote Desktop Services RCE, an 8.8 Kerberos RCE, and an Exchange Server elevation of privilege bug. Elevation of privilege made up nearly 45% of patches and RCE about 27%. Researchers point to AI-assisted vulnerability discovery as a driver behind rising patch volumes across Microsoft, Adobe, Cisco, Google, Mozilla, and Oracle, with Google moving to biweekly security updates in response. Tenable recommends prioritizing the two zero-days plus the CVSS 9.8 RCE flaws, especially those touching DNS, RDS, and Exchange. ## Content ## What happened Microsoft's September 2026 Patch Tuesday fixed 974 of its own vulnerabilities, plus 25 third-party CVEs, for a total of 999 patches in a single day — the largest release in the program's history. That follows records of 570 in July and 620 in August, so this is now three consecutive record-breaking months. For the year so far, Microsoft has patched roughly 2,760 vulnerabilities. That's more than double last year's total and on pace to exceed the combined totals from 2023 through 2025. ## The two zero-days under active attack Two vulnerabilities were already being exploited before patches shipped: - **CVE-2026-81963** — Windows Update Stack elevation of privilege, CVSS 7.8. Affects all supported Windows versions. Allows an attacker to escalate to SYSTEM-level access. - **CVE-2026-85880** — Windows ALPC elevation of privilege, CVSS 7.8. Also allows SYSTEM-level access. Notably absent from Windows Server 2025 and Windows 11, which researchers attribute to Rust rewrites of certain kernel components. Both should be treated as immediate priorities. ## Other critical flaws worth flagging - **CVE-2026-69730** — Windows DNS Server RCE, CVSS 9.8. Described as wormable and compared to the 2021 SigRed vulnerability. No user interaction required. - **CVE-2026-69525** — Remote Desktop Services RCE, CVSS 9.8. - **CVE-2026-69676** — Windows Kerberos RCE, CVSS 8.8. Affects domain controllers with no login required. - **CVE-2026-69380** — Microsoft Exchange Server elevation of privilege, CVSS 8.1. - **CVE-2026-65669** — SQL Copilot flaw. An AI assistant becoming an attack surface is a new category worth watching. Zero Day Initiative's Dustin Childs flagged 20 wormable bugs in this release that require no authentication or user interaction. Elevation of privilege bugs made up 44.7% of all patches; remote code execution flaws accounted for 26.8%. The unusually large clusters — 36 DHCP fixes, 64 Biometric Service fixes — suggest AI-assisted fuzzing on Microsoft's side, which is part of what's driving the volume. ## The broken Excel situation The update KB5002914, part of this Patch Tuesday release, broke copy-paste, autofill, and formula dragging in Excel 2016, 2019, 2021, and 2024. The failure is silent — no error message, no beep. Cells just don't paste. Microsoft has confirmed the issue and says it's still investigating. No fix or timeline has been provided. A separate report notes the same update also broke WSL functionality due to Plan9 issues. Workarounds that users report working: - Uninstall KB5002914 - Roll back to a prior Click-to-Run build via Command Prompt - Manually replace excel.exe (not recommended — stability and security risks) LibreOffice Calc has been suggested as a temporary alternative for affected users who can't roll back. ## The emergency out-of-band patches Within days of Patch Tuesday, Microsoft issued emergency out-of-band fixes for regressions introduced by the September update: - Remote Desktop Services instability: RDP connection failures, sign-in issues, unresponsive MMC and File Explorer - Hyper-V host folder shares becoming unavailable in Linux VMs - USB audio devices failing in multichannel mode This is becoming a pattern. Patch volume is growing faster than pre-release testing can keep up with. ## Beyond Microsoft Other vendors also shipped significant patches this cycle: - **Adobe** patched an actively exploited zero-day in Commerce/Magento (dubbed StyleSmuggler) - **SAP** fixed two critical unauthenticated RCE flaws in ABAP Extended Passport Processing (OVERPASS, CVSS 10.0) and NetWeaver Message Server (S4GET), affecting all modern SAP kernels - **Fortinet** confirmed exploitation of older FortiOS authentication bypass vulnerabilities - **Cisco** and **Red Hat** fixed critical flaws in their respective products - **CrowdStrike** disclosed a suspected zero-day (FalconFlank) in Falcon Sensor for Windows enabling privilege escalation - **HPE** fixed a critical RCE in ArubaOS-CX - **Microsoft Edge** patched an actively exploited Chromium V8 zero-day (CVE-2026-85046) a day before Chrome did, but hadn't published a security advisory for it nearly a week later ## The AI angle Researchers including Zero Day Initiative's Dustin Childs and others attribute much of the volume surge to AI-assisted vulnerability discovery — both on the offensive and defensive sides. OpenAI, Anthropic, AWS, Google, Microsoft, and over 100 other organizations signed an open letter warning that AI-enabled attacks will grow more sophisticated, narrowing the window between patch release and active exploitation. The honest read: bigger patch batches don't automatically mean more exploitable risk. AI tools are finding more bugs, including lower-severity ones that inflate the count. But the wormable DNS flaw and the two zero-days in this release are real, and the volume is making it harder for IT teams to prioritize, test, and deploy fixes before something breaks — as the Excel situation demonstrates. The practical response isn't to patch everything immediately. It's staged rollouts, test environments, and rollback capabilities. Vendors catching every regression before release is no longer a realistic expectation. ## Regulatory note The EU's Cyber Resilience Act began requiring exploited-vulnerability reporting on September 11, 2026. Microsoft's October release will be the first full Patch Tuesday cycle under the new rule. ## Upcoming lifecycle milestones (October 14, 2026) - Windows 11 24H2 Home and Pro reach end of servicing - Windows Server 2022 moves to extended support - Windows Server 2012/2012 R2 ESU ends - Office 2021 reaches end of support - Exchange Server 2016/2019 loses ESU eligibility ## Questions this post answers ### What are the two actively exploited zero-days in Microsoft's September 2026 Patch Tuesday? CVE-2026-81963, a Windows Update Stack elevation of privilege bug, and CVE-2026-85880, a Windows ALPC elevation of privilege bug, both rated CVSS 7.8. Both are privilege escalation flaws, meaning attackers likely already have a foothold on a system and are using these vulnerabilities to escalate to SYSTEM-level access. _Security teams tracking active exploits can follow zero-day disclosures like these on daily.dev._ ### How many vulnerabilities did Microsoft fix in September 2026 Patch Tuesday compared to previous records? Microsoft fixed between 964 and 974 CVEs depending on counting method, making it the largest single patch release in company history and surpassing the previous record of 570 set in July 2026. Roughly 104 to 113 of the fixes are rated critical, with elevation of privilege bugs making up nearly 45% of patches and remote code execution about 27%. _Teams triaging huge patch batches each month can track Patch Tuesday trends on daily.dev._ ### Which Windows vulnerabilities from September 2026 Patch Tuesday should be prioritized first? Tenable recommends prioritizing the two actively exploited zero-days plus the CVSS 9.8 remote code execution flaws: CVE-2026-69730 (Windows DNS Server RCE), CVE-2026-69829 (Windows Shell RCE), and CVE-2026-69525 (Remote Desktop Services RCE), along with the CVSS 8.8 Kerberos RCE (CVE-2026-69676) and an Exchange Server elevation of privilege bug (CVE-2026-69380). _Admins prioritizing patch rollouts can find critical CVE breakdowns like these on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@petecapecod** · 1 upvotes > Broooooo there are so many bugs with this latest update. Idk who vibe coder the crap out of it, but they need some extra help! > > It even broke my 5 gz wifi band on my computer. Don't ever say windows didn't slow you down lol ## Similar posts on daily.dev - [June 2026 Microsoft Patch Tuesday](https://daily.dev/posts/june-2026-microsoft-patch-tuesday-soc9er861) · Tenable Blog · 0 upvotes · 0 comments - [A Record-Breaking Patch Tuesday for June 2026 – Krebs on Security](https://daily.dev/posts/a-record-breaking-patch-tuesday-for-june-2026-krebs-on-security-7qkpaks07) · Krebs on Security · 0 upvotes · 0 comments - [Microsoft Patch Tuesday, March 2026 Edition – Krebs on Security](https://daily.dev/posts/microsoft-patch-tuesday-march-2026-edition-krebs-on-security-vio6duyhq) · Krebs on Security · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#windows](https://daily.dev/tags/windows), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited zero-days","url":"https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7"},"datePublished":"2026-09-08T21:47:47.042Z","dateModified":"2026-09-15T20:28:29.457Z","description":"Microsoft's September 2026 Patch Tuesday is the largest single patch release in company history, fixing between 964 and 974 CVEs, surpassing July's record of...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccf336b82b59c78ffb1066a273b4c530?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccf336b82b59c78ffb1066a273b4c530?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,microsoft,windows,zero-day","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited zero-days"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7","comment":[{"@type":"Comment","text":"Broooooo there are so many bugs with this latest update. Idk who vibe coder the crap out of it, but they need some extra help!\nIt even broke my 5 gz wifi band on my computer. Don’t ever say windows didn’t slow you down lol","datePublished":"2026-09-15T12:44:27.676Z","url":"https://daily.dev/posts/b8aoT91D7#c-G2jmYDQAq","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7#faq","mainEntity":[{"@type":"Question","name":"What are the two actively exploited zero-days in Microsoft's September 2026 Patch Tuesday?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-81963, a Windows Update Stack elevation of privilege bug, and CVE-2026-85880, a Windows ALPC elevation of privilege bug, both rated CVSS 7.8. Both are privilege escalation flaws, meaning attackers likely already have a foothold on a system and are using these vulnerabilities to escalate to SYSTEM-level access. Security teams tracking active exploits can follow zero-day disclosures like these on daily.dev."}},{"@type":"Question","name":"How many vulnerabilities did Microsoft fix in September 2026 Patch Tuesday compared to previous records?","acceptedAnswer":{"@type":"Answer","text":"Microsoft fixed between 964 and 974 CVEs depending on counting method, making it the largest single patch release in company history and surpassing the previous record of 570 set in July 2026. Roughly 104 to 113 of the fixes are rated critical, with elevation of privilege bugs making up nearly 45% of patches and remote code execution about 27%. Teams triaging huge patch batches each month can track Patch Tuesday trends on daily.dev."}},{"@type":"Question","name":"Which Windows vulnerabilities from September 2026 Patch Tuesday should be prioritized first?","acceptedAnswer":{"@type":"Answer","text":"Tenable recommends prioritizing the two actively exploited zero-days plus the CVSS 9.8 remote code execution flaws: CVE-2026-69730 (Windows DNS Server RCE), CVE-2026-69829 (Windows Shell RCE), and CVE-2026-69525 (Remote Desktop Services RCE), along with the CVSS 8.8 Kerberos RCE (CVE-2026-69676) and an Exchange Server elevation of privilege bug (CVE-2026-69380). Admins prioritizing patch rollouts can find critical CVE breakdowns like these on daily.dev."}}]} ```