← gociux.comall Patch Tuesdays

Patch Tuesday · September 2026

Patch Tuesday September 2026: 973 Microsoft CVEs, 2 exploited, 113 critical

, Gociux · 8 Sep 2026 · generated from Microsoft's security update API · 3 min read

973CVEs fixed
2exploited
113critical
0publicly disclosed

Microsoft's September 2026 release (published 8 Sep 2026) fixes 973 Microsoft CVEs across Windows, Office, Azure and server products. 2 are already exploited in the wild, which makes them the first thing to deploy. 113 are rated critical and 58 are assessed as more likely to be exploited. CISA has already added 2 of them to its Known Exploited Vulnerabilities catalog.

Patch order: exploited first, then publicly disclosed, then critical remote code execution on internet-facing systems, then everything Microsoft marks "exploitation more likely". The list below is in that order. Use stack check for Microsoft CVEs CISA has confirmed exploited over time.

Patch first (10)

CVE-2026-81963EXPLOITEDCISA KEVCVSS 7.8

Windows Update Stack Elevation of Privilege Vulnerability

Important · Elevation of Privilege · Windows Update Stack

CVE-2026-85880EXPLOITEDCISA KEVCVSS 7.8

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

Important · Elevation of Privilege · Windows ALPC

CVE-2026-69730CVSS 9.8

Windows DNS Server Remote Code Execution Vulnerability

Critical · Remote Code Execution · Windows DNS

CVE-2026-69854CVSS 9.0

Spring Cloud Azure Elevation of Privilege Vulnerability

Critical · Elevation of Privilege · Spring Cloud Azure

CVE-2026-69676CVSS 8.8

Windows Kerberos Remote Code Execution Vulnerability

Critical · Remote Code Execution · Windows Kerberos

CVE-2026-69857CVSS 8.5

Azure Cosmos DB Spoofing Vulnerability

Critical · Spoofing · Azure Cosmos DB

CVE-2026-72957CVSS 7.8

Windows Deployment Services Remote Code Execution Vulnerability

Critical · Remote Code Execution · Windows Deployment Services

CVE-2026-69852CVSS 7.5

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Critical · Remote Code Execution · Windows Routing and Remote Access Service (RRAS)

CVE-2026-70585CVSS 7.0

Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

Critical · Remote Code Execution · Windows Services for NFS ONCRPC XDR Driver

CVE-2026-83501CVSS 5.5

Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability

Critical · Information Disclosure · Windows Virtualization-Based Security (VBS) Enclave

By impact

ImpactCVEs
Elevation of Privilege435
Remote Code Execution259
Information Disclosure173
Denial of Service55
Security Feature Bypass19
Spoofing16
Tampering13
Other3

Most-patched components

ComponentCVEs
Windows Biometric Service64
SQL Server61
Microsoft Office Word37
Windows DHCP Server36
Microsoft Office Excel32
Windows NTFS29
Windows Win32K23
Microsoft Standard XPS18
Windows Spaceport.sys17
Microsoft Office16

How this is made: built automatically from Microsoft's September 2026 release via the MSRC CVRF API. Counted: CVEs assigned by Microsoft and first published on release day; third-party CVEs Microsoft republishes (Chromium for Edge, Linux and Azure Linux packages, open-source libraries) and later re-releases are excluded, so totals can differ slightly from other trackers. Cross-checked against the CISA KEV catalog. Severity, impact and exploitation status are Microsoft's own assessments at release time and can change; always confirm in the Security Update Guide before scheduling changes.

← August 2026all Patch Tuesdays →

Patching on evidence, every month?

We wire Microsoft's monthly release, CISA KEV and EPSS into your vulnerability workflow, so the few updates that matter ship first, with deadlines an auditor accepts.

Get in touch →