By ByteBot
Microsoft’s September 2026 Patch Tuesday fixes 9 vulnerabilities — all of them Critical. On paper, that sounds manageable after August’s 421-CVE pile-up. In practice, one of these nine was already being exploited in the wild before the patch shipped. The others include two CVSS 10.0 flaws — the worst possible score — one of which simply had no authentication at all on an Azure AI Language endpoint. The “quiet month” framing you’ll see elsewhere is wrong. Patch, audit your logs, and read on.
The CVE That Was Already Being Exploited
CVE-2026-62916 (CVSS 9.1) is an authentication bypass in Microsoft Entra ID that works by taking an alternate path through the authentication channel — a classic CWE-288 pattern. Microsoft patched it server-side, but security researchers confirmed reports of pre-patch exploitation. That means some organizations were hit before the fix arrived.
If you run Entra ID — and most Microsoft cloud shops do — pull your authentication logs for late August through September 3. Look for anomalous sign-ins from unexpected sources and any privilege escalations that you cannot account for. The fix is live, but the damage window was open.
Two CVSS 10.0 Flaws: The Worst Possible Score
Two CVEs in this batch hit maximum severity:
CVE-2026-83711 — Azure Active Directory B2C had an authorization bypass through a user-controlled key (CWE-639, CVSS 10.0). No credentials, no user interaction required — an attacker on the network could take over. Microsoft fixed this server-side. No client-side action needed, but B2C tenant administrators should verify their policy configurations match their infrastructure-as-code baseline.
CVE-2026-70352 — Azure AI Language Authoring had no authentication on a critical function (CWE-306, CVSS 10.0). A completely unauthenticated network attacker could escalate privileges and manipulate deployed language models. If you have Azure AI Language workloads — text analytics, CLU, custom NLU — review your authoring endpoint logs from the past two weeks.
The Pattern: Five of Nine Are Auth Failures
The remaining CVEs hit Microsoft Copilot Studio (CVE-2026-80098, CVSS 9.3 — a cryptographic signature verification failure), Entra ID again (CVE-2026-83941 at CVSS 9.9, CVE-2026-62869), Microsoft Fabric (CVE-2026-70178), and Azure Cosmos DB (CVE-2026-69857), with additional issues in Power Automate and Discovery Studio.
What ties five of the nine together: CWE-639, CWE-306, CWE-862, CWE-288 — every one is an authentication or authorization bypass. That is not a coincidence. Security researchers are calling it a structural problem in Microsoft’s cloud identity stack, not isolated bugs. The same failure mode that gets open-source libraries criticized — broken identity primitives — is present in Microsoft’s flagship services. Mature does not mean immune.
What Developers Need to Do
Microsoft deployed server-side fixes for all nine CVEs, so there is no Windows Update to apply. But “no customer action required” is not the same as “no action required.” The pre-patch exploitation window for CVE-2026-62916 was open for weeks. Here is what to check:
- Entra ID: Audit sign-in logs and Privileged Identity Management (PIM) alerts from August 21 – September 3. Unexplained privilege escalations need investigation.
- Azure AI Language: Review authoring endpoint access logs. If unauthorized calls appear, rotate resource keys and check deployed models for modifications.
- Copilot Studio: Inspect maker portals for unauthorized solutions or flows that appeared after August 20.
- Microsoft Fabric: Review workspace-level permission audit logs for unexpected role assignments.
- Azure AD B2C: Compare current tenant policy configurations against your infrastructure-as-code baseline.
The 204-Entry Illusion
If you see headlines quoting 200+ vulnerabilities from September’s release, that number misleads. Microsoft’s document lists 204 entries — but 172 are Azure Linux (Mariner) OS package updates, and 23 are republished Chromium fixes for Edge. Neither category represents a new Microsoft product vulnerability. The real count is 9. That distinction matters: 9 Critical vulnerabilities across cloud identity and AI services is a more targeted risk than inflated headlines suggest, and it deserves a more targeted response than “we will get to it.”
October Is Your Last Cycle for Legacy Systems
Next month’s Patch Tuesday — October 14, 2026 — is the final update for Windows 11 24H2 Home/Pro, Exchange Server 2016/2019 ESU, and Windows Server 2012/2012 R2 ESU. If any of those are still in production, September is your last real migration runway. The full CVE list is available at the Microsoft Security Response Center. Prioritize Entra ID log audits today — the exploitation window for CVE-2026-62916 already opened and closed. Find out if your organization was in it.
