--- title: September 2026 Microsoft Patch Tuesday | daily.dev description: Microsoft's September 2026 Patch Tuesday addressed 964 CVEs, the largest release in its history, with 104 rated critical and 860 important. Two zero-day... canonical: https://daily.dev/posts/september-2026-microsoft-patch-tuesday-ozj18fhac twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: September 2026 Microsoft Patch Tuesday | daily.dev og:description: Microsoft's September 2026 Patch Tuesday addressed 964 CVEs, the largest release in its history, with 104 rated critical and 860 important. Two zero-day... og:url: https://daily.dev/posts/september-2026-microsoft-patch-tuesday-ozj18fhac og:image: https://api.daily.dev/og/posts/oZj18FHAc.png og:image:alt: September 2026 Microsoft Patch Tuesday og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # September 2026 Microsoft Patch Tuesday **[Tenable Blog](https://daily.dev/sources/tenable-blog)** · 8 min read · 1 upvotes · 0 comments ## Summary Microsoft's September 2026 Patch Tuesday addressed 964 CVEs, the largest release in its history, with 104 rated critical and 860 important. Two zero-day vulnerabilities exploited in the wild were patched: CVE-2026-81963 (Windows Update Stack elevation of privilege) and CVE-2026-85880 (Windows ALPC elevation of privilege), both with CVSSv3 7.8. Other notable flaws include CVE-2026-69380 (Exchange Server EoP), CVE-2026-69525 (Remote Desktop Services RCE, CVSS 9.8), CVE-2026-69730 (Windows DNS Server RCE, CVSS 9.8, critical), and CVE-2026-69676 (Windows Kerberos RCE, CVSS 8.8). Elevation of privilege bugs made up 44.7% of patches, remote code execution 26.8%. Tenable recommends prompt patching and regular vulnerability scanning. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the two zero-day vulnerabilities patched in Microsoft's September 2026 Patch Tuesday? The two zero-days are CVE-2026-81963, a Windows Update Stack elevation of privilege flaw caused by link following, and CVE-2026-85880, a Windows ALPC elevation of privilege flaw. Both received a CVSSv3 score of 7.8 and were exploited in the wild, allowing attackers to escalate to SYSTEM-level privileges. _Security teams tracking active exploitation follow zero-day patch details like these on daily.dev._ ### How many CVEs did Microsoft patch in the September 2026 Patch Tuesday release? Microsoft patched a record 964 CVEs, the largest Patch Tuesday release in its history, surpassing the previous record set in July. Of these, 104 were rated critical and 860 were rated important, with zero rated moderate or low. Elevation of privilege vulnerabilities made up 44.7% of the total, and remote code execution flaws made up 26.8%. _Admins prioritizing patch rollouts can keep tabs on record-breaking Patch Tuesday releases via daily.dev._ ### What is CVE-2026-69730 and why is it considered high risk? CVE-2026-69730 is a critical remote code execution vulnerability in Windows DNS Server with a CVSSv3 score of 9.8. An unauthenticated remote attacker can send a crafted packet to exploit a use-after-free flaw and achieve remote code execution, and Microsoft rates exploitation as 'More Likely.' Eight additional DNS Server RCEs were patched the same month with lower exploitability ratings. _Teams triaging critical RCEs in DNS infrastructure can track advisories like this on daily.dev._ ## Similar posts on daily.dev - [June 2026 Microsoft Patch Tuesday](https://daily.dev/posts/june-2026-microsoft-patch-tuesday-soc9er861) · Tenable Blog · 0 upvotes · 0 comments - [Microsoft Patch Tuesday, March 2026 Edition – Krebs on Security](https://daily.dev/posts/microsoft-patch-tuesday-march-2026-edition-krebs-on-security-vio6duyhq) · Krebs on Security · 0 upvotes · 0 comments - [Microsoft Patches 83 CVEs in March Update](https://daily.dev/posts/microsoft-patches-83-cves-in-march-update-vqfajqpoo) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#windows](https://daily.dev/tags/windows), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/september-2026-microsoft-patch-tuesday-ozj18fhac) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"September 2026 Microsoft Patch Tuesday","url":"https://daily.dev/posts/september-2026-microsoft-patch-tuesday-ozj18fhac","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/september-2026-microsoft-patch-tuesday-ozj18fhac"},"datePublished":"2026-09-08T18:16:06.610Z","dateModified":"2026-09-15T20:28:29.435Z","description":"Microsoft's September 2026 Patch Tuesday addressed 964 CVEs, the largest release in its history, with 104 rated critical and 860 important. Two zero-day...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ea778a00a8c5a8ae8fff286298f7d60e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ea778a00a8c5a8ae8fff286298f7d60e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Tenable Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Tenable Blog","logo":"https://media.daily.dev/image/upload/s--B6GAvw3H--/f_auto,q_auto/v1780213271/logos/tenable-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/tenable-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/september-2026-microsoft-patch-tuesday-ozj18fhac","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft,windows,zero-day","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tenable Blog","item":"https://daily.dev/sources/tenable-blog"},{"@type":"ListItem","position":3,"name":"September 2026 Microsoft Patch Tuesday"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/september-2026-microsoft-patch-tuesday-ozj18fhac#faq","mainEntity":[{"@type":"Question","name":"What are the two zero-day vulnerabilities patched in Microsoft's September 2026 Patch Tuesday?","acceptedAnswer":{"@type":"Answer","text":"The two zero-days are CVE-2026-81963, a Windows Update Stack elevation of privilege flaw caused by link following, and CVE-2026-85880, a Windows ALPC elevation of privilege flaw. Both received a CVSSv3 score of 7.8 and were exploited in the wild, allowing attackers to escalate to SYSTEM-level privileges. Security teams tracking active exploitation follow zero-day patch details like these on daily.dev."}},{"@type":"Question","name":"How many CVEs did Microsoft patch in the September 2026 Patch Tuesday release?","acceptedAnswer":{"@type":"Answer","text":"Microsoft patched a record 964 CVEs, the largest Patch Tuesday release in its history, surpassing the previous record set in July. Of these, 104 were rated critical and 860 were rated important, with zero rated moderate or low. Elevation of privilege vulnerabilities made up 44.7% of the total, and remote code execution flaws made up 26.8%. Admins prioritizing patch rollouts can keep tabs on record-breaking Patch Tuesday releases via daily.dev."}},{"@type":"Question","name":"What is CVE-2026-69730 and why is it considered high risk?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-69730 is a critical remote code execution vulnerability in Windows DNS Server with a CVSSv3 score of 9.8. An unauthenticated remote attacker can send a crafted packet to exploit a use-after-free flaw and achieve remote code execution, and Microsoft rates exploitation as 'More Likely.' Eight additional DNS Server RCEs were patched the same month with lower exploitability ratings. Teams triaging critical RCEs in DNS infrastructure can track advisories like this on daily.dev."}}]} ```