Two bugs already being exploited
Microsoft's September 2026 security update, released September 8, patches two vulnerabilities that attackers are already using in the wild. Both are elevation-of-privilege (EoP) flaws, meaning they do not get an attacker into a machine on their own but let someone who already has a foothold jump up to full SYSTEM-level control.
CVE-2026-81963 sits in the Windows Update Stack. It is a link-following flaw: improper resolution of a file link before Windows acts on it, which an attacker can abuse to redirect a privileged operation somewhere it should not go. Microsoft credits the discovery to independent researcher Romain Deperne and its own Microsoft Threat Intelligence Center (MSTIC). Notably, security researchers at the Zero Day Initiative (ZDI) point out this is the first time in five years that a zero-day has turned up in the Update Stack component, out of seven flaws patched there in that span.
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the messaging mechanism Windows processes use to talk to each other. It can be used to escalate privileges locally, including breaking out of an AppContainer sandbox. Credit for finding it is shared among Volexity, researcher Mark Kelly, David Galazin and Jeremy Hedges of Proofpoint.
Both carry a Common Vulnerability Scoring System (CVSS) score of 7.8 and are now listed in the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog, which gives US federal civilian agencies until September 22, 2026 to apply the fix.
The bug nobody has seen exploited yet, but should worry about more
The month's most dangerous-looking flaw is not one of the two zero-days. CVE-2026-73009 affects the Windows Secure Socket Tunneling Protocol (SSTP) service, Microsoft's built-in virtual private network (VPN) protocol, which ships as part of Routing and Remote Access Service (RRAS). It scores 9.8 out of 10 on CVSS because an unauthenticated attacker can send a single crafted packet to the SSTP listener and run code on the target, no login and no prior access required. Organizations that run SSTP-based remote-access VPNs typically expose the service directly to the internet on port 443, which is exactly the kind of setup this bug targets. Microsoft has not confirmed active exploitation of this one, but ZDI flags it as more likely to be attacked given how it works.
A second critical bug worth flagging is CVE-2026-69730, a use-after-free flaw in Windows DNS Server (CVSS 9.8) that also allows remote code execution. ZDI describes it as SigRed's "spiritual successor," a reference to the wormable DNS Server bug from 2020 that forced a wave of emergency patching. There is also CVE-2026-69676, an authentication-bypass flaw in Windows Kerberos (CVSS 8.8) that can lead to arbitrary code execution.
Twenty bugs that could spread on their own
Beyond the headline flaws, ZDI and other researchers count 20 separate patches this month that qualify as wormable: a remote, unauthenticated attacker can trigger code execution with no user interaction at all, the same conditions that let malware move from machine to machine without anyone clicking anything. This month's wormable-rated bugs touch Dynamic Host Configuration Protocol (DHCP) Server, Active Directory, Windows DNS Server, the Server Message Block (SMB) client, Netlogon, Network File System (NFS), RRAS, IP Helper and Message Queuing. That is an unusually wide spread of network-facing components to see flagged in a single month.
By category, elevation-of-privilege fixes made up close to 45 percent of everything patched this month, and remote-code-execution fixes made up roughly 27 percent, according to vulnerability-management firm Tenable's breakdown of the release.
How big was this Patch Tuesday, exactly
Trackers disagree on the exact CVE (Common Vulnerabilities and Exposures) count, and the disagreement comes down to what each one counts. Tenable puts the total at 964 CVEs with 104 rated critical; BleepingComputer counted 966 flaws with 105 critical. ZDI's count runs higher, 972 CVEs issued directly by Microsoft plus 25 more affecting third-party components bundled into Windows, mostly in the Chromium engine behind Microsoft Edge, for a combined 997 with 114 rated critical. Whichever total is used, this is Microsoft's largest single Patch Tuesday of 2026 so far.
What it means in practice
The two zero-days need attention first, precisely because they are already being used, even though neither gives an attacker a way in on its own; they matter most on systems where phishing or another bug could already have handed someone a foothold. Anyone running an SSTP-based VPN endpoint reachable from the internet should treat CVE-2026-73009 as urgent regardless of the lack of confirmed in-the-wild exploitation, since the bug requires no credentials to trigger. Windows DNS Server and Active Directory operators should also prioritize their patches given the wormable classification and the SigRed comparison. Federal agencies in the US are on a September 22 clock for the two confirmed zero-days, but everyone else should treat that date as a reasonable outer limit rather than a target to wait for.
