By ByteBot
Microsoft released its September 2026 Patch Tuesday update on September 9, fixing 966 vulnerabilities — the largest single-month security release in the company’s history. That number includes two Windows elevation-of-privilege zero-days that attackers are actively exploiting right now, and a wormable DNS remote code execution flaw that researchers are calling SigRed’s successor. If you run Windows anywhere in your infrastructure, this is not optional reading.
Two Zero-Days: Patch These Today, Not This Week
CISA added both zero-days to its Known Exploited Vulnerabilities catalog on September 8 — one day before the patches were publicly released — setting a September 22 remediation deadline for federal civilian agencies. Private-sector teams should apply the same urgency.
CVE-2026-85880 lives in Windows Advanced Local Procedure Call (ALPC). It is a heap buffer overflow that allows a low-privileged attacker operating inside an AppContainer sandbox to escape that sandbox and obtain SYSTEM privileges. No user interaction required. The attack chain is local, but in a shared environment — a CI runner, a multi-tenant dev box, a containerized build system — “local” is less reassuring than it sounds.
CVE-2026-81963 is a link-following flaw in the Windows Update Stack itself — the components that download, stage, and install updates. An attacker with limited local access can use a symlink or junction to redirect a privileged write operation to an arbitrary location on the filesystem, ultimately gaining SYSTEM. It is darkly ironic: the mechanism you use to stay secure is itself the attack surface.
The Threat Getting Less Attention Than It Deserves
The zero-days are dominating headlines, but the Trend Micro Zero Day Initiative and Tenable both rank CVE-2026-69730 as the most dangerous flaw in this release for infrastructure teams.
CVE-2026-69730 is a use-after-free bug in Windows DNS Server with a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted packet over the network and achieve remote code execution — no credentials, no user interaction, no prior foothold required. Microsoft has not observed active exploitation yet but assesses it as likely. The security community is already calling it SigRed’s successor, a reference to CVE-2020-1350, the DNS Server flaw that required an emergency out-of-band patch in 2020 because of its self-propagating potential.
CVE-2026-69730 is one of 20 wormable vulnerabilities in this release. The others span DHCP, MSMQ, NFS, and SSTP VPN — all network services, all reachable without authentication. A single unpatched host exposed to a compromised segment of your network is enough.
Why Are There 966 CVEs in One Month?
Microsoft’s monthly CVE count averaged around 175 before 2026. September’s 966 is 5.6 times that baseline. The explanation Microsoft offers: their internal AI-powered vulnerability scanning has dramatically accelerated the rate at which they discover their own bugs. The fixes are good news. The implication is more unsettling — the backlog of vulnerabilities in mature software is far larger than the industry assumed, and AI is the thing surfacing it now.
Developers and security teams are not scaling at the same rate. A 966-CVE Patch Tuesday is not a patch list — it is a triage problem.
What Developers Specifically Need to Know
Beyond the Windows-level fixes, this release addresses 22 vulnerabilities in developer tools, 62 in SQL Server (including CVE-2026-65669, CVSS 9.6, an injection flaw enabling remote privilege escalation), and 9 in Exchange Server (including CVE-2026-55007, CVSS 8.1, a double-free RCE). Azure-based services — AI Language, Cosmos DB, Copilot Studio, Entra ID, Microsoft Fabric — received 204 additional patches earlier in September, separate from today’s release. Full details are available in Tenable’s analysis.
Patch in This Order
Given the volume, prioritization matters more than completeness. BleepingComputer’s full breakdown lists all 966 CVEs. Apply updates in this sequence:
- CVE-2026-85880 and CVE-2026-81963 — both actively exploited; apply immediately via Windows Update (KB5124008 for Windows 11 24H2/25H2)
- CVE-2026-69730 — if you run Windows DNS Server, treat this as a zero-day even though it is not one yet
- Exchange Server and SQL Server — high CVSS scores, significant blast radius in enterprise environments
- Full cumulative update — KB5124008 (Windows 11 24H2/25H2) or KB5122880 (older supported builds)
For enterprise deployments: search KB5124008 in SCCM or configure an expedite policy in Intune targeting Windows 11 devices. The Microsoft Update Catalog has all packages for manual download. The CISA September 22 deadline applies to federal agencies by mandate. Everyone else should treat it as a reasonable target, not a distant ceiling.
Read Help Net Security’s coverage for the full SigRed comparison and infrastructure team guidance.
