September 2026 Microsoft Patch Tuesday

This month, Microsoft released patches for a record-breaking 973 vulnerabilities, including 113 rated critical. It is by far the largest Patch Tuesday to date, well ahead of the previous high of 664 set in July 2026. Two vulnerabilities are listed as exploited in the wild, while none were publicly disclosed before Patch Tuesday. Notable fixes include Windows privilege escalation and critical RCEs in Skype for Business, MSMQ and RRAS.

A few vulnerabilities worth mentioning:

Windows Update Stack Elevation of Privilege Vulnerability (CVE-2026-81963)
Microsoft reports that CVE-2026-81963 is being exploited, though it was not publicly disclosed before Patch Tuesday. This Important-severity Windows Update Stack elevation of privilege vulnerability has a CVSS score of 7.8 and affects Windows 11 and Windows Server 2025 systems. The flaw involves improper link resolution before file access, allowing a local, authenticated attacker with low privileges to abuse link-following behavior and elevate to SYSTEM privileges. Administrators should prioritize applying the Windows security updates for affected Windows 11 and Windows Server 2025 systems, including Server Core installations.

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (CVE-2026-85880)
Microsoft lists CVE-2026-85880 as exploited in the wild, although it was not publicly disclosed before Patch Tuesday and is not currently in CISA’s Known Exploited Vulnerabilities catalogue. This Important-severity Windows ALPC elevation of privilege vulnerability has a CVSS score of 7.8 and affects Windows 10 and multiple Windows Server releases, including Server 2012, 2016, 2019, and 2022. The flaw is a heap-based buffer overflow that can be exploited locally by an attacker who can run code in a low-privilege AppContainer; no user interaction is required. Successful exploitation allows the attacker to escape the sandbox and gain SYSTEM privileges on the affected host. Given Microsoft’s exploited-in-the-wild assessment, prioritize deployment of the applicable Windows security updates, especially on multi-user systems, exposed workstations, and servers where local code execution paths are available.

Skype for Business Remote Code Execution Vulnerability (CVE-2026-66302)
Microsoft reports that CVE-2026-66302 is not being exploited in the wild and was not publicly disclosed before Patch Tuesday. This is a Critical remote code execution vulnerability in Skype for Business Server with a CVSS score of 9.8, affecting Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8, and Skype for Business Server Subscription Edition CU1. The flaw involves external control of a file name or path, allowing an unauthenticated attacker to send a specially crafted network request that writes an attacker-controlled file to an arbitrary location on the affected server; successful exploitation could allow code execution on the target server without authentication or user interaction. Administrators should prioritize applying Microsoft’s updates for affected Skype for Business Server installations and review exposed deployments, logging, and access controls for signs of suspicious file writes or unexpected server-side code execution.

Windows Message Queuing Remote Code Execution Vulnerability (CVE-2026-69579)
Microsoft reports that CVE-2026-69579 is not known to be exploited in the wild and was not publicly disclosed before Patch Tuesday. This Critical remote code execution vulnerability carries a CVSS score of 9.8 and is a use-after-free flaw in Windows Message Queuing affecting supported Windows client and server releases. An unauthenticated attacker could exploit it remotely by sending a specially crafted packet to an affected Message Queuing service, with no user interaction required, potentially allowing code execution on the target system with high impact to confidentiality, integrity, and availability. Systems running MSMQ should be prioritized for patching; where Message Queuing is not needed, disabling the service or restricting network access to it, including limiting exposure of MSMQ traffic such as TCP port 1801, can reduce risk until updates are applied.

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVE-2026-69590)
CVE-2026-69590 is not listed by Microsoft as exploited in the wild and has not been publicly disclosed; it is a Critical remote code execution vulnerability in Windows RRAS with a CVSS score of 9.8. An unauthenticated remote attacker could exploit the flaw by sending a specially crafted packet to an affected RRAS service over the network, with no user interaction required, potentially allowing code execution on the target system with serious confidentiality, integrity, and availability impact. Affected platforms include supported Windows 10, Windows 11, and Windows Server releases. Organizations should apply the Microsoft security update promptly, especially on systems running RRAS, and reduce exposure by disabling RRAS where it is not needed, restricting network access to the service with firewalls or VPN controls, and monitoring for unexpected traffic to RRAS-enabled hosts.

This was a summary of Microsoft’s monthly updates highlighting key vulnerabilities. Prioritize the exploited Important Windows EOP flaws, CVE-2026-81963 and CVE-2026-85880, then patch exposed Skype for Business, MSMQ, and RRAS systems vulnerable to Critical unauthenticated RCE.

A detailed list of this month's vulnerabilities follows below. To search and filter them, visit my dashboard: https://patchlens.io

[Article truncated — read full content at source]