What happened
On September 8, 2026 Patch Tuesday, Microsoft fixed 964 CVEs, the largest release on record, beating July, according to Tenable. 104 were critical and 860 important. Elevation of privilege made up 44.7% and remote code execution 26.8%.
The two zero-days
- CVE-2026-81963 (Windows Update Stack): a link-following flaw that lets an attacker elevate to SYSTEM. CVSS 7.8. It is the first Update Stack EoP exploited as a zero-day since 2022.
- CVE-2026-85880 (Windows ALPC): elevation to SYSTEM, CVSS 7.8. The second ALPC zero-day since CVE-2023-21674.
Both need local access, but they are exactly what attackers chain after phishing or initial access.
Other flaws to prioritize
- CVE-2026-69730 (Windows DNS Server): unauthenticated RCE, CVSS 9.8, "exploitation more likely".
- CVE-2026-69525 (Remote Desktop Services): use-after-free RCE, CVSS 9.8.
- CVE-2026-69676 (Kerberos): RCE, CVSS 8.8.
- CVE-2026-69380 (Exchange Server): an authenticated user can access other mailboxes; CVSS 8.1.
What to do now
- Apply September cumulative updates to workstations and servers, starting with machines whose users browse the internet (EoP zero-days).
- Prioritize DNS servers, RDS hosts and domain controllers.
- With nearly a thousand CVEs in a month, automate patching and use CISA's KEV catalog to set the order.