Microsoft has released its monthly security updates for September 2026, addressing a total of 973 vulnerabilities across its product line. Among these, 113 were classified as "critical." The company confirmed that two of these vulnerabilities have already been exploited in the wild.
The actively exploited vulnerabilities include CVE-2026-81963, an elevation of privilege flaw impacting Windows Update Stack, which carries a CVSS base score of 7.8. This vulnerability is linked to improper link resolution before file access and improper access control. The second, CVE-2026-85880, also an elevation of privilege vulnerability, affects Windows Advanced Local Procedure Call (ALPC) and has a CVSS base score of 7.8. It is associated with a heap-based buffer overflow and the use of an uninitialized resource.
Of the 113 critical vulnerabilities, 82 are remote code execution (RCE) flaws. Microsoft has identified several vulnerabilities that it considers more likely to be exploited. These include CVE-2026-69676, an RCE vulnerability in Windows Kerberos with a CVSS score of 8.8, related to authentication bypass by capture-replay. Windows Routing and Remote Access Service (RRAS) is affected by CVE-2026-69852, an RCE vulnerability stemming from a heap-based buffer overflow, rated 7.5. CVE-2026-72957, another RCE vulnerability with a CVSS score of 7.8, impacts Windows Deployment Services due to a heap-based buffer overflow.
Other vulnerabilities deemed more likely to be exploited include CVE-2026-69854, an elevation of privilege flaw in Spring Cloud Azure with a critical CVSS score of 9.0, caused by improper authentication. Windows Virtualization-Based Security (VBS) has an information disclosure vulnerability, CVE-2026-83501, with a CVSS score of 5.5, due to an out-of-bounds read. Windows Services for NFS ONCRPC XDR Driver is affected by CVE-2026-70585, an RCE vulnerability with a CVSS score of 7.0, linked to a use-after-free error. A severe RCE vulnerability, CVE-2026-69730, is present in Windows DNS Server, scoring 9.8, also due to a use-after-free issue. Azure Cosmos DB has a spoofing vulnerability, CVE-2026-69857, with a CVSS score of 8.5, related to authorization bypass through a user-controlled key.
Microsoft also listed several vulnerabilities considered less likely to be exploited, though many still carry high severity scores. Windows DHCP Server is affected by two RCE vulnerabilities: CVE-2026-69845 (CVSS 9.8), involving a heap-based buffer overflow and improper input validation, and CVE-2026-72979 (CVSS 9.8), a use-after-free flaw. HEVC Video Extensions has an RCE vulnerability, CVE-2026-58599 (CVSS 7.8), due to a heap-based buffer overflow. Microsoft Dynamics 365 On-Premises is vulnerable to RCE via CVE-2026-65772 (CVSS 8.8), caused by deserialization of untrusted data. Skype for Business has an RCE vulnerability, CVE-2026-66302 (CVSS 9.8), related to external control of file name or path.
Multiple vulnerabilities were found in Microsoft SQL Server, including RCE flaws CVE-2026-67631 (CVSS 8.8) and CVE-2026-67378 (CVSS 8.5), and an elevation of privilege vulnerability CVE-2026-65669 (CVSS 9.6). Windows Imaging Component is impacted by five RCE vulnerabilities, with CVSS scores ranging from 8.8 to 9.8, stemming from issues like integer overflow, out-of-bounds write, and heap-based buffer overflows. Windows Secure Kernel Mode has four elevation of privilege vulnerabilities, with CVSS scores between 7.0 and 8.2, involving untrusted pointer dereference and integer overflow.
Additional RCE vulnerabilities were patched in Windows Routing and Remote Access Service (RRAS) (CVE-2026-69590, CVE-2026-72959), Microsoft Windows Media Foundation (CVE-2026-69601), IP Helper (CVE-2026-72981), DirectWrite (CVE-2026-73006), Windows Secure Socket Tunneling Protocol (SSTP) (CVE-2026-73009), Microsoft Failover Cluster (CVE-2026-73010, CVE-2026-78444), Graphics Kernel (CVE-2026-73017), Windows Graphics Component (CVE-2026-77493), and Windows Reliable Multicast Transport Driver (RMCAST) (CVE-2026-69530, CVE-2026-78449, CVE-2026-78450). An elevation of privilege vulnerability, CVE-2026-83498, was also addressed in Windows Virtualization-Based Security (VBS) Enclave.
