Microsoft has set a new record with its September patch day, fixing around 974 security vulnerabilities, more than 100 of them rated critical. At the center of the update are two privilege escalation flaws that attackers are already exploiting, with no public details available beforehand.
Two zero-days lead to system-level access
CVE-2026-81963 sits in the Windows Update Stack, the component underlying update installation, and carries a CVSS score of 7.8. The flaw stems from faulty link resolution before a file is accessed. An attacker with low privileges can use it to place files under a different security context and gain full system rights. Microsoft confirms active exploitation but has not shared further attack details.
The second exploited flaw, CVE-2026-85880, sits in the Windows Advanced Local Procedure Call and also scores 7.8. A heap-based buffer overflow lets an attacker who is already running code with low privileges inside an AppContainer break out of the sandbox and escalate to SYSTEM. According to Microsoft, no user interaction is required. Microsoft credits the discovery to security firms Volexity and Proofpoint. Satnam Narang, a security researcher at Tenable, notes that this is only the second ALPC zero-day since CVE-2023-21674 in January 2023. The US Cybersecurity and Infrastructure Security Agency, CISA, has already added both flaws to its catalog of known exploited vulnerabilities, requiring federal agencies to prioritize fixes under directive BOD 26-04.
Twenty wormable flaws across the network
A vulnerability counts as wormable when it can spread from system to system without any user involvement, and this month brings twenty of them. CVE-2026-69730 in the Windows DNS Server scores 9.8 and can be triggered unauthenticated over the network. CVE-2026-69579 in the Message Queuing Service and CVE-2026-69590 in the Routing and Remote Access Service reach the same score and are likewise remotely exploitable without credentials. In Windows Netlogon, CVE-2026-72982 leads to code execution through a stack-based buffer overflow at the same top score. CVE-2026-72979 in the DHCP Server and CVE-2026-73009 in the Secure Socket Tunneling Protocol both stem from use-after-free bugs and also reach 9.8. CVE-2026-69525 in Remote Desktop Services is somewhat different, since Microsoft limits the attack to sources on the same network. On domain controllers, CVE-2026-69676 in Windows Kerberos affects authenticated domain users, who can execute code on the controller through a crafted request. Microsoft flags this one as more likely to be exploited.
Code execution through email and documents
In Exchange Server, CVE-2026-55007 enables remote code execution without authentication, triggered by a crafted Visio file attached to an email. The server processes the code as soon as the message arrives, before a user even opens it in the preview pane. In SharePoint Server, CVE-2026-69465 lets an authenticated attacker bypass a security check and load code from a file system under their own control. Even more severe is CVE-2026-78509 in Outlook, with a CVSS score of 9.8, where simply having the preview pane open is enough to trigger the attack, with no further action needed.
Cloud and AI services carry the highest scores
This month's highest ratings, somewhat ironically, hit cloud and AI services that Microsoft fixes on its own servers. CVE-2026-70352 in Azure AI Language reaches the maximum score of 10.0, as does CVE-2026-83711 in Azure Active Directory B2C. CVE-2026-83941 in Entra ID follows closely at 9.9, and CVE-2026-80098 in Copilot Studio allows a privilege escalation scored at 9.3. For these four flaws, organizations don't need to do anything, since Microsoft marks them as already fixed. CVE-2026-65669 in Microsoft SQL Server is different: it requires a user to submit crafted statements to SQL Copilot inside SQL Server Management Studio, after which an attacker gains database access at a CVSS score of 9.6.
The bottom line
September 2026 shifts risk in two directions at once. On the endpoint, the two already-exploited privilege escalations in the Update Stack and ALPC raise local rights to SYSTEM and work well as a second stage in an attack chain following an initial breach. Across the network, the twenty wormable flaws form the bigger blast-radius risk, while the two maximum scores in Azure AI Language and Azure Active Directory B2C show that AI services themselves now rank among the most critical targets. The Zero Day Initiative attributes the record volume to AI-assisted vulnerability hunting, but notes that the number of actually active attacks has stayed at previous levels.