Microsoft's September 2026 Patch Tuesday release included a record number of fixes, addressing two zero-day vulnerabilities that have been actively exploited in the wild. The update also contained patches for several other critical issues, including a cluster of 20 "wormable" bugs and a DNS flaw described as a successor to SigRed.
One of the exploited zero-days, CVE-2026-81963, is a privilege escalation vulnerability in the Windows Update Stack, impacting various versions of Windows 11 and Windows Server 2025. This flaw, caused by improper link resolution and access control, allows authenticated, low-privilege attackers to gain SYSTEM privileges. While the Windows Update Stack has seen seven privilege escalation flaws since 2022, this is the first to be exploited as a zero-day. Microsoft's Threat Intelligence Centre (MSTIC) reported the vulnerability, but details regarding its exploitation remain undisclosed. Experts suggest it is likely combined with a code execution bug to facilitate malware or ransomware deployment rather than compromising the automatic update process itself.
The second zero-day, CVE-2026-85880, is another privilege escalation bug (to SYSTEM) found in the Windows Advanced Local Procedure Call. This vulnerability affects Windows 10 and older Windows Server versions (2012, 2016, 2019, and 2022). Proofpoint threat researchers reported this flaw, but the extent of its exploitation is not publicly known. Both exploited vulnerabilities are considered critical, as this class of flaw is frequently used in post-compromise tooling by both commodity malware and targeted intrusion operators to achieve kernel-mode control.
Beyond the zero-days, Microsoft addressed a group of 20 "wormable" vulnerabilities affecting most supported Windows versions. These bugs could allow remote, unauthenticated attackers to execute arbitrary code without user interaction. Among these, CVE-2026-69730, a DNS flaw, is highlighted as a potential successor to SigRed, raising concerns about the possibility of a global worm.
Another significant vulnerability is CVE-2026-69676, an authentication bypass flaw in Kerberos that could lead to remote code execution. Microsoft classifies this as "Exploitation More Likely." An authenticated attacker with low-level access can send a crafted request to a domain controller and execute code, effectively leading to a domain compromise.
Organizations are also advised to prioritize patching CVE-2026-80093, a privilege escalation vulnerability in the Windows Cloud Files Mini Filter Driver. Although successful exploitation requires winning a race condition, technical details for this flaw are already public.
In addition to Windows updates, Microsoft also released patches for Microsoft Exchange Server, addressing an RCE flaw (CVE-2026-55007) that can be triggered by processing an email with a malicious Visio attachment. Updates for Microsoft SharePoint Server were also included to fix various bugs.
All actively exploited flaws and other critical vulnerabilities are bundled into cumulative security updates and monthly rollups for various Windows versions, simplifying the patching process. Despite the increasing number of patched vulnerabilities, experts emphasize that the number of issues truly impacting most organizations remains relatively low. The rise in CVE counts is attributed to AI-assisted vulnerability discovery, which creates larger datasets but doesn't necessarily find more "needles." Prioritization based on risk context, considering whether vulnerabilities are reachable and exploitable, is crucial for effective remediation.
A new development observed is the rapid release of proof-of-concept exploits by an anonymous security researcher, Nightmare Eclipse, shortly after Microsoft's Patch Tuesday. This month's exploit, "ShieldCrash," reportedly bypasses the patch for CVE-2026-69414 (ShieldBreak), a privilege escalation bug in Microsoft Defender (Microsoft Malware Protection Engine).
