Microsoft's September 2026 Patch Tuesday delivers fixes for 966 vulnerabilities, including two Windows elevation-of-privilege zero-days seen in active exploitation that can lead to SYSTEM privileges. The package includes 105 issues rated Critical and is the largest monthly security release from the vendor to date, a volume attributed to AI-assisted discovery. Administrators should prioritize CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC, while tracking a broad set of coincident releases from other suppliers.

Scale and severity breakdown

The September 2026 Patch Tuesday total covers 966 flaws handled on the day itself. Within that set, 105 carry a Critical rating, divided into 81 remote code execution cases, 20 elevation of privilege cases, 2 information disclosure cases, and 1 security feature bypass.

Totals by weakness type were reported as:

  • 438 Elevation of Privilege Vulnerabilities
  • 19 Security Feature Bypass Vulnerabilities
  • 258 Remote Code Execution Vulnerabilities
  • 173 Information Disclosure Vulnerabilities

Counting for this event follows Patch Tuesday-day disclosures only. It therefore omits 204 flaws addressed earlier in the month across Azure AI Language, Azure Cosmos DB, Copilot Studio, Entra ID, Mariner, Microsoft Azure Active Directory B2C, Microsoft Discovery Studio, Microsoft Edge (Chromium-based), Microsoft Fabric, and Power Automate.

The volume exceeds the 570 security flaws fixed in July and the 400 fixed in August, making this the biggest update so far. Microsoft links the growth to use of an AI-powered vulnerability discovery system to locate additional defects across its products.

Non-security changes shipped separately, including the Windows 11 KB5124008 & KB5122880 cumulative updates and the Windows 10 KB5122878 extended security update.

Zero-days seen in attacks

Microsoft treats as a zero-day any defect that was disclosed publicly or observed being abused before a formal fix was ready. Two such actively exploited issues were closed in this cycle, both requiring a locally authorized attacker and both enabling a move to SYSTEM.

CVE-2026-81963 – Windows Update Stack Elevation of Privilege Vulnerability

This defect affects the Windows Update Stack and permits local privilege escalation to SYSTEM. The underlying weakness is mishandled resolution of filesystem links ahead of file access, described in authoritative records as link following. Details of in-the-wild use have not been made public.

Credit was assigned to Romain Deperne and the Microsoft Threat Intelligence Centre (MSTIC).

References:

The CISA catalog entry from 2026/09/08 lists CVE-2026-81963 as a Microsoft Windows Link Following Vulnerability, alongside CVE-2026-75650 described as an Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability.

CVE-2026-85880 – Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

This defect affects Windows Advanced Local Procedure Call (ALPC) and was abused to obtain SYSTEM privileges. The root cause is a heap-based buffer overflow reachable by a locally authorized caller. No specifics about the observed exploitation method were released.

The finding was attributed to Volexity and Mark Kelly, David Galazin, Jeremy Hedges with Proofpoint.

Reference:

No proof-of-concept, packet capture, file path, hash, IP, or domain specific to these two Windows exploits was supplied in the source material.

Detection and mitigation

Apply the September 2026 Windows security updates promptly, giving precedence to internet-facing and privileged-administrator workstations and servers because both zero-days are already exploited and yield SYSTEM. Verify installation of the relevant cumulative or extended-security rollup, such as Windows 11 KB5124008 & KB5122880 and Windows 10 KB5122878, through normal update compliance tooling and reboot as required.

General hardening remains relevant: limit local administrative and standard interactive logons, audit privileged service and scheduled-task creation, and monitor for unexpected child processes spawning from Windows Update components or abnormal ALPC server crashes followed by privilege changes. No vendor detection query or IOC list for these CVEs was included in the supplied material.

Other vendors active in the cycle

Other vendors who released updates or advisories in August 2026 include:

Technical background — general concepts only

This section explains the vulnerability classes in general terms from public knowledge. It is not a reproduction of the exploits for CVE-2026-81963 or CVE-2026-85880, for which no code or step-by-step was supplied.

Link-following flaws arise when a privileged process opens a file path without safely resolving symbolic links or junctions first, allowing a locally authorized user who can write to an intermediate directory to redirect the operation to a protected location. Heap-based overflows in local interprocess mechanisms such as ALPC arise when message data is copied into a heap buffer without adequate length validation, potentially corrupting adjacent heap metadata and altering execution flow to gain higher privileges.

Generic illustrative pattern only:


# Generic illustration - not the exploit for this incident
import os
# Defenders audit for unexpected reparse points in writable service directories
# Example: list junctions/symlinks, then verify final targets before patching
print("Illustrative check: enumerate links and validate canonical paths")

Defensive practice for these classes generally includes applying vendor patches, restricting write access to directories used by privileged services, auditing link creation, and monitoring for local privilege-escalation behavior such as anomalous SYSTEM child processes.