September 2026 Patch Tuesday: 1021 Patches, 113 Critical, 2 Actively Exploited

By the Numbers

Microsoft's September 2026 Patch Tuesday addresses 1021 vulnerabilities across Windows, Office, SQL Server, Edge, Exchange, Azure, and .NET. Of these, 113 are rated Critical, 862 Important, and 1 Moderate. Two vulnerabilities are confirmed actively exploited in the wild, and four total appear on CISA's Known Exploited Vulnerabilities catalog. The Windows product family dominates this release with 620 patches, followed by Office at 125 and SQL Server at 62. Note: an additional 207 CVEs listed in Microsoft's documentation affect only Azure Linux packages and are excluded from these figures; Linux administrators should consult those updates separately.

Patches to Prioritize

CVE-2026-81963: Windows Update Stack Elevation of Privilege Vulnerability

CVSS 7.8 | Important | Actively Exploited | CISA KEV

This elevation of privilege vulnerability in the Windows Update Stack allows a local attacker with low-privilege access to escalate to SYSTEM-level permissions. Exploitation requires local access and the ability to execute code on the target system; attackers are using this in the wild to gain full control after initial access. The fix corrects improper permission handling in the update service components. Patch immediately on all supported Windows systems.

CVE-2026-85880: Windows ALPC Elevation of Privilege Vulnerability

CVSS 7.8 | Important | Actively Exploited | CISA KEV

The Windows Advanced Local Procedure Call subsystem contains an elevation of privilege flaw that attackers are actively exploiting. A local attacker can abuse this vulnerability to elevate from a standard user account to SYSTEM privileges. The attack vector requires local code execution, making this a post-compromise escalation tool. Microsoft's patch addresses the underlying ALPC message handling issue. Given active exploitation, this should be treated with the same urgency as CVE-2026-81963.

CVE-2026-85046: Chromium Type Confusion in V8

CISA KEV

This Chromium vulnerability, now included in Microsoft Edge, involves type confusion in the V8 JavaScript engine. Successful exploitation allows an attacker to execute arbitrary code within the browser sandbox context via a malicious webpage. Users simply need to visit a crafted site for exploitation. Microsoft has incorporated the upstream Chromium fix into Edge; ensure browser updates are deployed.

CVE-2026-87491: Chromium Out of Bounds Write in V8

CISA KEV

Another V8 engine vulnerability in Chromium, this out-of-bounds write can lead to remote code execution when a user visits a malicious website. The flaw allows attackers to corrupt memory and potentially escape the renderer sandbox. Microsoft's Edge update includes the Chromium patch. Deploy browser updates across all managed endpoints.

Critical Vulnerability Breakdown

CVE-2026-66302: Skype for Business Remote Code Execution Vulnerability

CVSS 9.8 | Critical | Exploitation Less Likely

A network-based remote code execution vulnerability in Skype for Business Server requires no authentication and no user interaction. An attacker can send specially crafted requests to a vulnerable server to execute arbitrary code. Organizations still running Skype for Business on-premises should prioritize this patch.

CVE-2026-65669: Microsoft SQL Server Elevation of Privilege Vulnerability

CVSS 9.6 | Critical | Exploitation Less Likely

This SQL Server vulnerability allows an authenticated attacker to escalate privileges within the database context. The high CVSS reflects the potential for complete database compromise. Affects multiple SQL Server versions.

CVE-2026-62916: Microsoft Entra ID Elevation of Privilege Vulnerability

CVSS 9.1 | Critical

An elevation of privilege flaw in Microsoft Entra ID could allow an attacker to gain elevated permissions within the identity platform. Given the central role of Entra ID in authentication and authorization, this vulnerability poses significant risk to identity infrastructure.

CVE-2026-65772: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

CVSS 8.8 | Critical | Exploitation Less Likely

Remote code execution is possible in Dynamics 365 on-premises deployments. An authenticated attacker can execute code in the context of the service account running Dynamics.

CVE-2026-65818: Power Automate Elevation of Privilege Vulnerability

CVSS 8.5 | Critical

Power Automate contains an elevation of privilege vulnerability that could allow an attacker to gain elevated access within automated workflows, potentially compromising connected systems and data.

CVE-2026-67378: Microsoft SQL Server Remote Code Execution Vulnerability

CVSS 8.5 | Critical | Exploitation Less Likely

A second SQL Server vulnerability this month allows remote code execution. An authenticated user with specific permissions could execute arbitrary code on the database server.

CVE-2026-58599: HEVC Video Extensions Remote Code Execution Vulnerability

CVSS 7.8 | Critical | Exploitation Less Likely

The HEVC Video Extensions codec contains a memory corruption flaw. An attacker can craft a malicious video file that, when opened, executes code in the context of the current user. Requires user interaction.

CVE-2026-62906: Microsoft Discovery Studio Information Disclosure Vulnerability

CVSS 7.4 | Critical

An information disclosure vulnerability in Microsoft Discovery Studio could expose sensitive data to an unauthorized attacker.

By Product Family

Windows (620 patches)

The largest portion of this release addresses Windows components. The two actively exploited vulnerabilities, CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in ALPC, both target core OS subsystems for privilege escalation. Administrators should prioritize these patches on all Windows endpoints and servers. Additional Windows fixes span the kernel, networking stack, print spooler, and various system services.

Office (125 patches)

Office receives 125 security updates this month, addressing vulnerabilities across Word, Excel, Outlook, and shared components. No actively exploited Office vulnerabilities appear in this release, but several memory corruption issues could enable code execution via malicious documents. Standard user training about suspicious attachments remains essential.

SQL Server (62 patches)

SQL Server administrators face a significant update burden this month with 62 patches, including two Critical vulnerabilities: CVE-2026-65669 (elevation of privilege, CVSS 9.6) and CVE-2026-67378 (remote code execution, CVSS 8.5). Production databases should be patched during scheduled maintenance windows, with test environments updated first.

Browser (46 patches)

Microsoft Edge inherits multiple Chromium fixes, including the two V8 vulnerabilities on the CISA KEV list. CVE-2026-85046 and CVE-2026-87491 both enable code execution through malicious websites. Browser updates should deploy automatically, but administrators should verify update policies are functioning.

.NET (22 patches)

The .NET framework and runtime receive 22 patches addressing various security issues. Review release notes for any breaking changes before deploying to production application servers.

Exchange (9 patches)

Exchange Server receives nine patches. While none are rated Critical or actively exploited, Exchange remains a high-value target. Apply updates during the next maintenance window.

Azure (8 patches)

Azure services receive eight patches for various platform components. Cloud administrators should review Azure-specific advisories for service impact details.

Other Products (129 patches)

This category includes Dynamics 365, Power Platform, Skype for Business, and other Microsoft products. CVE-2026-66302 in Skype for Business stands out at CVSS 9.8 for organizations still running that platform.

What to Patch First

1. CVE-2026-81963 and CVE-2026-85880: Both Windows elevation of privilege vulnerabilities are actively exploited. Patch all Windows systems immediately.
2. CVE-2026-85046 and CVE-2026-87491: Chromium V8 vulnerabilities in Edge are on the CISA KEV list. Verify browser updates are deployed across all endpoints.
3. CVE-2026-66302: Skype for Business RCE at CVSS 9.8 requires no authentication. Patch or isolate Skype for Business servers.
4. CVE-2026-65669 and CVE-2026-67378: SQL Server critical vulnerabilities should be addressed in your next database maintenance window.
5. CVE-2026-62916: Entra ID elevation of privilege poses identity infrastructure risk; coordinate with your identity team on remediation.
6. Remaining Critical CVEs: Address CVE-2026-65772, CVE-2026-65818, CVE-2026-58599, and CVE-2026-62906 based on your environment's exposure.
7. Product family rollups: Complete Windows, Office, and remaining updates according to your standard patching schedule.

This is a large Patch Tuesday with two confirmed active exploitations and four CISA KEV entries; prioritize the privilege escalation patches and browser updates before moving through the remaining backlog.