Microsoft published 999 CVEs on September 2026 Patch Tuesday, made up of 974 vulnerabilities in its own products plus fixes for 25 non-Microsoft CVEs. Windows alone accounts for 723 of them. Rapid7 notes this is by far the most CVEs Microsoft has ever published in a single day, and that there is no reason to expect a return to pre-2026 volumes.

974 Microsoft product vulnerabilities, 723 of them in Windows, bringing the September 2026 total to 999 CVEs.

Two of them are under active exploitation. CVE-2026-85880 is an elevation of privilege flaw in the Windows Advanced Local Procedure Call (ALPC) mechanism, the kernel feature that handles communication between processes. A buffer overflow leading to an out-of-bounds write hands an attacker SYSTEM privileges, and the CVSS v3 base score is 7.8. Notably, neither Windows Server 2025 nor Windows 11 receives a patch for it.

The second, CVE-2026-81963, sits in the Windows Update Stack and also reaches SYSTEM, this time through improper link resolution. Every supported version of Windows gets a fix.

Neither zero-day was publicly disclosed ahead of the patch, and Microsoft flags nothing else this month as publicly known.

Beyond the exploited pair, the release spans the usual severity mix. Several 9.8-rated remote code execution issues affect Windows Compressed Folder, RPC Runtime Library, Telnet Client, Microsoft DirectMusic, Windows PDF, Media Foundation, Internet Connection Sharing and Standard XPS. On the cloud side, Azure AI Language and Azure Active Directory B2C both carry 10.0 scores, with Entra ID at 9.9. Elevation of privilege dominates the Windows bulk, including dozens of separate Windows Biometric Service entries. Exchange Server, Visual Studio Code and .NET each pick up multiple fixes as well, so your patch triage this month spans endpoints, servers, developer tooling and tenant identity at once.

CVE-2026-58611 and the Other Notable Flaws in This Cycle

CVE-2026-58611 is an elevation of privilege flaw in Xbox Gaming Services, carrying a CVSS v3 base score of 7.8. Microsoft rates exploitation as "less likely" and reports no public disclosure, but the component matters more than the score suggests: Gaming Services installs a privileged Windows service on consumer and hybrid-managed endpoints, which means a local user or any code already running at low privilege can use it as a stepping stone to higher rights on that machine.

The 7.8 score pattern across this release is consistent with local attack vectors requiring low privileges and no user interaction. That combination is what makes elevation of privilege bugs practical for attackers who already have a foothold through phishing or a stolen session, and it explains why Rapid7 points out that no serious attacker will build an intricate one-shot remote code execution exploit when local access plus privilege escalation reaches the same result.

The rest of the cycle groups into a handful of clusters worth reading as sets:

• The CVE-2026-843xx block is Chromium, inherited by Microsoft Edge. It spans use-after-free bugs in Proxy, WebRTC, Browser, TabStrip and Shared Tab Groups, a buffer overflow in GPU, an uninitialized resource in V8, information leaks in MediaCapture and Skia, and a long run of authorization failures in FileSystem, Autofill, CredentialProvider, SiteSettings, Navigation and Chromoting. Authorization bugs in Autofill and CredentialProvider matter for credential handling in the browser your staff use all day.
• Identity and Azure control plane: CVE-2026-70352 (Azure AI Language) and CVE-2026-83711 (Azure Active Directory B2C) both score a maximum 10.0 for elevation of privilege, with CVE-2026-83941 (Entra ID) at 9.9 and CVE-2026-62916 (Entra ID) at 9.1. These are service-side flaws in tenant identity infrastructure, so the exposure is to your directory and the applications that trust it rather than to individual desktops.
• Cloud data and tooling: CVE-2026-69857, a Cosmos DB spoofing flaw at 8.5, and CVE-2026-69854 in Spring Cloud Azure at 9.0 are both rated "exploitation more likely," the highest-probability tier in this batch outside the confirmed zero-days. CVE-2026-83948 gives remote code execution through the Azure CLI at 8.0, and CVE-2026-84003 is a spoofing flaw in the Microsoft Authentication Library for Node.js at 7.4, which affects applications you built on MSAL rather than Microsoft-hosted services.
• Chain candidates: CVE-2026-77909 (Azure CycleCloud information disclosure, 7.7) and CVE-2026-62906 (Discovery Studio information disclosure, 7.4) leak data that pairs naturally with elevation of privilege bugs like CVE-2026-62895 in the Azure Arc SQL Server extension (8.8) and CVE-2026-81349 in Azure HDInsight Ambari (7.2). On Windows, the same logic applies to the Win32k information disclosure entries feeding the four Windows Search Component escalations rated "more likely."
• Authenticator: CVE-2026-80097 is an elevation of privilege flaw in Microsoft Authenticator at 8.6, sitting directly in the multi-factor path many organizations depend on for conditional access.

CVE-2026-85046 is the exploited-in-the-wild V8 zero-day Google patched on September 3, 2026. Edge stable received the fix a day earlier on September 2, but Microsoft has still not published an advisory, and the CVE URL returns a 404. Chrome fixed 11 other bugs alongside it, including CVE-2026-85045, and there is no published confirmation that those are addressed in Edge. Alongside CVE-2026-81963 in the Windows Update Stack, which resolves malicious links to overwrite system components with attacker-controlled files, these are the entries with the shortest gap between disclosure and real-world abuse.

Exposure Across Enterprise Estates

The heaviest concentration of risk in this release sits on systems you cannot take offline casually. CVE-2026-69525, a Remote Desktop Services remote code execution flaw with a CVSS v3 base score of 9.8, is rated "Exploitation More Likely" by Microsoft. If you publish RDS or a Remote Desktop Gateway for contractors or remote staff, that single CVE justifies pulling the patch forward ahead of your normal ring schedule.

Internet-facing and network-reachable services account for several of the highest scores this month. Alongside RDS, you are looking at CVE-2026-72983 (Internet Connection Sharing RCE, 9.8), CVE-2026-69819 (RPC Runtime Library RCE, 9.8), and CVE-2026-69496 (Windows Compressed Folder RCE, 9.8). RPC in particular underpins routine Windows-to-Windows communication, so exposure is not limited to servers you deliberately published.

Your Exchange estate carries its own cluster. CVE-2026-69356 is a spoofing flaw at 9.3, CVE-2026-69641 an elevation of privilege issue at 9.1, and CVE-2026-55007 and CVE-2026-69355 are both remote code execution at 8.1 and 8.8. Mail server compromise typically produces exactly the outcomes your insurers ask about: mailbox access, invoice fraud through spoofed internal senders, and notification obligations once message content is confirmed exposed.

Identity infrastructure is where the scores top out. CVE-2026-83711 in Azure Active Directory B2C and CVE-2026-70352 in Azure AI Language both carry a 10.0, and CVE-2026-83941 in Entra ID sits at 9.9, with CVE-2026-62916 at 9.1. Privilege escalation in a tenant directory means an attacker operates with legitimate permissions across every application federated to it, which is the hardest kind of activity for your team to distinguish from normal administration.

Domain controllers and certificate infrastructure also draw fixes, including Active Directory Certificate Services elevation of privilege (CVE-2026-62810, CVE-2026-69821) and Active Directory Domain Services remote code execution (CVE-2026-69524, CVE-2026-69546, both 8.1). A denial of service flaw in AD FS (CVE-2026-72978) and four separate DHCP Server denial of service issues matter differently: those do not leak data, they stop staff from authenticating or obtaining addresses, and the cost shows up as lost billable hours.

Developer workstations are a distinct exposure group you may not patch on the same cadence as the rest of the fleet:

• CVE-2026-81376, a Visual Studio Code security feature bypass at 9.6, with seven further bypass CVEs in the same component
• CVE-2026-77906 and CVE-2026-77907, Visual Studio remote code execution at 8.8
• CVE-2026-69522 and CVE-2026-71328, .NET and Visual Studio remote code execution at 8.8
• CVE-2026-69854, Spring Cloud Azure elevation of privilege at 9.0 and rated "Exploitation More Likely"

Compromise of a build machine gives an attacker signing credentials, cloud deployment tokens, and source code in one step.

The scheduling problem is real. Running an emergency out-of-band cycle for a handful of these means overtime, unplanned reboots on production servers, and a change advisory exception, while deferring to your next window leaves publicly reachable services exposed for weeks. If you sit under PCI DSS, HIPAA, or CMMC obligations, your patch window for critical vulnerabilities is contractually defined, and a volume this large makes a documented triage decision the evidence your auditor will ask to see.

October 14, 2026 compounds the arithmetic. Windows Server 2012 and 2012 R2 reach the end of the final paid Extended Security Update year, Office 2021 including the Long-Term Servicing Channel drops out of support with no ESU offered, and Exchange Server 2016 and 2019 join the same category after two prior six-month extensions. Anything you still run in those categories stops receiving fixes for issues like the ones above.

Patch Sequencing and Interim Mitigations

Start with the two exploited elevation of privilege flaws, but scope them correctly before you push anything. CVE-2026-85880 has no patch for Windows Server 2025 or Windows 11, which means your inventory work is identifying the older Windows 10 and down-level server builds that do receive a fix. CVE-2026-81963 in the Windows Update Stack is different: every supported version of Windows gets a patch, so there is no filtering to do, only deployment.

Both are local privilege escalation, so the practical target is any host where a low-privileged foothold is plausible. Jump boxes, RMM agents, developer workstations, and terminal servers first. An attacker who already has code running as a standard user chains either flaw to SYSTEM, which is the step that turns a single compromised mailbox into domain-wide access.

Your second immediate track is Exchange. This release carries CVE-2026-69641 (elevation of privilege, 9.1), CVE-2026-69356 (spoofing, 9.3), and remote code execution in CVE-2026-69355 (8.8) and CVE-2026-55007 (8.1). Exchange Server 2016 and 2019 lose support in October 2026 with no Extended Security Update option after two prior six-month reprieves, so treat this month's cumulative update as part of a migration plan and not a standing arrangement.

Then verify Edge by hand. Microsoft has not published an advisory for CVE-2026-85046, the exploited-in-the-wild V8 zero-day that Chrome fixed on September 3, 2026, even though the Edge stable channel received the fix on September 2 according to its release notes. Check edge://settings/help against the release notes rather than the Security Update Guide. Chrome patched eleven other flaws at the same time, including CVE-2026-85045, and the safe assumption is that those remain unpatched in Edge until Microsoft says otherwise.

Within a few days, work through the endpoint clusters Microsoft flags as "Exploitation More Likely":

• Windows Search Component privilege escalation (CVE-2026-69305, CVE-2026-69585, CVE-2026-69600, CVE-2026-69911)
• CVE-2026-70342, Ancillary Function Driver for WinSock, 8.1
• CVE-2026-80093, Cloud Files Mini Filter Driver, and CVE-2026-69391, Broker Infrastructure Service
• CVE-2026-69277 in the LSA Server and CVE-2026-72957 in Windows Deployment Services, 7.8

Developer and cloud tooling is separate from Windows Update and gets missed for that reason. Update Visual Studio Code for the security feature bypass set, led by CVE-2026-81376 at 9.6, patch the Azure CLI for CVE-2026-83948 on build agents, and bump application dependencies for CVE-2026-69854 (Spring Cloud Azure, 9.0) and CVE-2026-84003 (MSAL for Node.js). Nobody reboots these for you.

Where you cannot patch a host this cycle, reduce what a local escalation can reach. Remove standard users from local administrator groups, restrict which accounts can log on interactively to management hosts, and block outbound traffic from those hosts except to known destinations. That does not fix the flaw, and it does shorten the path an attacker has after gaining SYSTEM.

For detection, pull Sysmon process-creation and file-creation telemetry and look for symbolic link or junction creation followed by writes into system directories, which is the pattern behind improper link resolution abuse, and for SYSTEM-level child processes spawned by low-privilege parents. On the identity side, the Entra ID escalation flaws (CVE-2026-83941, CVE-2026-62916) matter because tenant-level privilege changes are quiet. In environments Capstone manages, Adlumin flags anomalous role assignments and authentication patterns that indicate a compromised account has gained rights it did not have last week.

Confirm deployment with Get-HotFix or your update reporting, and track restart compliance separately from install status. The kernel and driver fixes in this cycle are inactive until the machine reboots.

Closing the Cycle: The One Patch to Move First

The practical takeaway from a release this large is that ordering decides your outcome. You are not going to deploy 999 fixes in a week, so the value comes from picking the right first move and then proving it landed.

That first move is validating and deploying the CVE-2026-58611 fix on your most exposed assets. Test it in your pilot ring, confirm the Gaming Services component updates cleanly, and push it to the endpoints where an unprivileged foothold is most plausible before you touch the rest of the estate. A single patch you can confirm is worth more than a broad push you cannot verify.

Once that is deployed, the work shifts to coverage. Check the machines that miss deployment windows for ordinary reasons: laptops that were offline, hosts under change freeze, devices in remote sites with metered links, and any system your patch tooling reports as unknown rather than compliant. Those gaps are usually operational, and they are the ones that quietly persist.

Where you cannot patch, write the exception down with an owner, the reason, and a review date. An undocumented exception looks identical to an oversight three months later, and you will not remember which one it was.

Then re-check before the next Patch Tuesday. Pull a fresh compliance report, reconcile it against your exception list, and close whatever has since become patchable. Doing that on a fixed cadence keeps this month's deferrals from accumulating into next month's backlog, which is the real risk when monthly volumes stay at this level.