September 2026 Patch Tuesday: 966 Fixes, 2 Zero-Days, and What a Small Business Needs to Do

Microsoft shipped its monthly security updates today at 10 AM Pacific, and this is the largest Patch Tuesday that has ever shipped, by a wide margin, per BleepingComputer's September 2026 roundup. Two of the flaws are already being used by attackers. Here is what is in the release, why the honest story this month is not the number, and how a small business should sequence the work.

What Patch Tuesday is and how it works

On the second Tuesday of every month, Microsoft releases fixes for security flaws found in Windows, Office, and its server products. A security flaw, also called a vulnerability, is a mistake in software that an attacker can use to do something the software never intended, like reading your files or taking control of the machine. The fix for a flaw is called a patch, and the industry has called this monthly event Patch Tuesday for over twenty years.

Why batch them into one day a month instead of releasing each fix immediately? Predictability. IT teams can plan testing and deployment around a known date, and businesses are not rebooting machines at random all month. Microsoft holds everything except emergency out-of-band fixes for the monthly release, then publishes the details of what was fixed the same day.

How a patch reaches your PC depends on who manages it. A home computer gets updates directly from Microsoft through Windows Update, whenever Windows decides to install them. A managed business computer gets them through an RMM, short for remote monitoring and management, which is the software an IT provider uses to watch, update, and support every machine in your fleet from one place. That central control is what lets updates deploy on a schedule, with per-machine verification that the patch installed and the reboot completed, instead of hoping each PC got around to it.

Why 2026 broke the model

Until this year, Microsoft had never fixed more than about 200 flaws in a single month. Then AI-assisted tools for finding software bugs came of age, and researchers on every side started using them, a dynamic we covered when an AI model found 271 vulnerabilities in Firefox. June 2026 set a record near 200, July shattered it with 570, August landed at 400, and September has now nearly doubled the old record in a single step.

The mechanism has not changed since July, it has just compounded. Automated discovery finds bugs faster than humans ever did, Microsoft triages and fixes them in bulk, and the same tooling helps attackers turn a published patch into a working exploit faster than ever. Microsoft has responded by rewriting its own deployment guidance: quality update deferral periods under three days, deadlines of zero or one day, and a grace period of no more than two. Some outlets have started calling this the patch apocalypse. The practical translation for a small business is duller and more useful. Monthly patching is now a process with an owner and a verification step, not a checkbox someone gets to when there is time.

September 2026 by the numbers

This month's release fixes 966 vulnerabilities by BleepingComputer's count, which we use because they count only the CVEs Microsoft published on release day. Other outlets report anywhere from 972 to 995, because Microsoft's Security Update Guide changed format in July 2026 and no longer publishes one simple list, so each outlet counts differently. The Zero Day Initiative tallies 972 new CVEs with 114 Critical by its own severity math, SecurityWeek reports 974, several outlets land on 973 with 113 Critical, and Action1 counts 995 with 121 Critical by folding in fixes Microsoft published outside the release-day list. A CVE, for reference, is the industry's tracking number for a single vulnerability. Whichever number you use, it is the biggest release on record, and every source agrees on that.

That 966 also excludes 204 more flaws Microsoft fixed earlier this month in cloud services, including Azure AI Language, Azure Cosmos DB, Copilot Studio, and Entra ID. Those are handled server-side and require nothing from you.

By Microsoft's ratings, 105 are Critical: 81 remote code execution, 20 elevation of privilege, 2 information disclosure, and 1 security feature bypass. By class, the whole release breaks down as:

• 438 elevation-of-privilege flaws. These let an attacker who already has a foothold on a machine promote themselves to administrator or SYSTEM. Rarely the way in, almost always the next step, and this month both exploited zero-days are in this category.
• 258 remote-code-execution flaws. The dangerous class: an attacker runs their own code on your systems, sometimes with no user interaction at all. 81 of the 105 Critical fixes are RCEs, and the Zero Day Initiative flags 20 of them as potentially wormable, meaning unauthenticated remote code execution with no user interaction, the kind malware can use to spread from machine to machine with no human involvement.
• The rest: 173 information-disclosure flaws, 56 denial-of-service, 19 security-feature bypasses, and 16 spoofing flaws.

By product, per Microsoft's release notes as tallied by SecurityWeek: 723 in Windows, 222 across the Office family with 111 in Office 2016 alone, 62 in SQL Server, 22 in developer tools, 16 in SharePoint Server, 12 in Azure, 10 in Skype for Business, and 9 in Exchange Server.

Both zero-days are the quiet kind, and that is the story

A record-breaking release with two actively exploited zero-days reads like a five-alarm month. Read the two flaws themselves and the picture changes. Neither is remote code execution. Both are local elevation of privilege, both are CVSS 7.8, and Microsoft rates both Important rather than Critical. Microsoft's Security Update Guide marks both as exploited and neither as publicly disclosed, so the exploit details are not sitting in a public write-up yet.

• CVE-2026-85880: a heap buffer overflow in Windows Advanced Local Procedure Call. ALPC is the internal messaging plumbing that Windows components use to talk to each other. Microsoft's write-up is specific about the payoff: an attacker who can already execute code inside a low-privilege AppContainer sandbox can use this to escape the sandbox and elevate to SYSTEM, the highest privilege level in Windows, with no user interaction. It was reported by researchers at Volexity and Proofpoint. Tenable's Satnam Narang notes that Microsoft has not patched an ALPC flaw at all since April 2023, and that this is only the second ALPC zero-day in nearly four years, after CVE-2023-21674 in January 2023. A component that quiet suddenly turning up under active exploitation is worth noticing.
• CVE-2026-81963: improper link resolution in the Windows Update Stack. This is a link-following flaw, the same class as the LegacyHive bug patched in August: by abusing how a privileged service resolves a link before it touches a file, a local user tricks that service into acting on a file it should never touch, and ends up at SYSTEM. The affected component is the machinery that installs Windows updates, which runs with the highest privileges on the box by design. Credited to Romain Deperne and the Microsoft Threat Intelligence Center, with Microsoft's exploitability assessment listed as functional, meaning a working exploit exists.

So what should a small business take from that? Not that these are harmless. Take the opposite lesson: this is what the second half of an attack looks like, and it is the half that decides how bad the incident gets. Nobody exploits a local privilege escalation bug from the internet. They exploit it after a user typed credentials into a convincing fake login page, after a malicious document ran a macro, after a stolen session token got replayed. Once an attacker has any code running as a normal user, an escalation zero-day is the step that turns a contained problem into a full one: SYSTEM privileges are what let them disable security tooling, read every share, and push ransomware everywhere at once.

That framing changes what you do beyond installing the patch. It puts the weight on identity and on privilege. Phishing-resistant multi-factor authentication is what stops the foothold, and we covered how to set that up in the identity hardening post. Not running as a local administrator all day is what limits what a foothold can reach, and the privileged access post lays out how to separate daily accounts from admin accounts without making anyone's job harder. Managed detection and response with a 24/7 SOC is what catches the escalation attempt itself, which is exactly the behavior antivirus alone tends to miss, a distinction covered in the EDR versus antivirus post. The same escalation argument ran through the LegacyHive post in July, and it has not aged.

The PowerPoint bug is the one where a person's behavior changes the outcome

CVE-2026-69678 is a use-after-free flaw in PowerPoint, rated Critical at CVSS 8.8. A use-after-free is what it sounds like: the program frees a chunk of memory and then keeps using it, and an attacker who controls what lands in that memory gets to control what the program does next. In this case that means running their code with the privileges of whoever opened the file.

The detail worth your attention is in Microsoft's own advisory FAQ, which answers plainly that yes, the preview pane is an attack vector. That means a crafted presentation attached to an email can trigger the flaw when the preview pane renders it. Nobody has to double-click the attachment. The safety advice most people have internalized, do not open attachments from strangers, does not fully cover this case, which is precisely why it is worth telling your team about rather than quietly patching in the background.

Two practical notes. First, Office updates do not ride the Windows cumulative update. They ship on their own Click-to-Run release channel, so a machine can be fully current on Windows and still be running vulnerable Office. Verify Office build versions separately. Second, until Office is current everywhere, turning off the reading pane for external mail is a reasonable short-term control, and it is a setting you can push centrally rather than asking each person to change. This one belongs in your next security awareness session too, alongside the rest of the basics. It was neither exploited nor publicly disclosed at release, which is a good reason to patch before that changes.

The server side: DNS, Remote Desktop, Hyper-V, Exchange, SharePoint

If you run anything on-premises, this is the part of the release that should set your maintenance window.

• CVE-2026-69730: Windows DNS Server RCE, CVSS 9.8, Critical. A use-after-free reachable by an unauthenticated attacker sending a crafted packet, with no user interaction, and Microsoft rates exploitation more likely. The Zero Day Initiative calls it the spiritual successor to SigRed, the 2020 wormable DNS flaw. On most small networks the DNS role runs on the domain controller, so this is a patch-the-DC-now item.
• CVE-2026-69525: Remote Desktop Services RCE, CVSS 9.8. Another use-after-free, also unauthenticated with no user interaction, also rated exploitation more likely. Microsoft labels it Important despite the score, which is a good reminder that the severity label and the CVSS number are two different judgments and you should read both. If you have Remote Desktop reachable from the internet, this is your emergency, and the reason we keep arguing against that setup in the exposed RDP post.
• CVE-2026-80083: Hyper-V guest-to-host RCE, CVSS 8.8, Critical. An untrusted pointer dereference that lets code running inside a Hyper-V guest virtual machine execute on the host operating system. If you run several servers as virtual machines on one physical host, a compromise of the least important guest becomes a compromise of the box everything else lives on. Microsoft rates exploitation unlikely, which is a reason to schedule it rather than to skip it.
• CVE-2026-66302: Skype for Business Server RCE, CVSS 9.8, Critical. An unauthenticated attacker can send a specially crafted request that writes an attacker-controlled file to an arbitrary location on the server, with no authentication and no user interaction required. Most small businesses retired this years ago. If you still have a Skype for Business Server sitting in a rack because nobody ever turned it off, this month is the reason to finish that project.
• Exchange and SharePoint. On-premises Exchange gets CVE-2026-55007 (CVSS 8.1), a double-free an unauthenticated attacker can reach by mailing a crafted Visio attachment that the server processes during content indexing, though Microsoft rates exploitation less likely because it needs the server to be under sustained memory pressure. SharePoint Server gets CVE-2026-69465 (CVSS 8.8), which needs an authenticated user with page-edit permissions, so it is an insider or stolen-credential path rather than a front-door one. Sixteen SharePoint Server CVEs and nine Exchange CVEs land this month in total. SharePoint Online and Exchange Online through Microsoft 365 are patched server-side by Microsoft; the case against self-hosting either is in the May SharePoint post.
• The two perfect tens. CVE-2026-70352 in Azure AI Language and CVE-2026-83711 in Azure AD B2C are both CVSS 10.0 and both Critical, and they will show up in any headline that sorts by score. Both were mitigated by Microsoft service-side and require no customer action. They are worth knowing about because someone will forward you an article about them, not because there is anything to install.

KB numbers, builds, and the Windows 10 question

The numbers to verify after deployment, per Microsoft's update history pages. Windows 11 24H2 and 25H2 take KB5124008 (builds 26100.9445 and 26200.9445, with servicing stack update KB5124007). Windows 11 23H2 takes KB5122880 (Microsoft lists OS build 22621.7582, with servicing stack update KB5122879), and Windows 11 26H1 takes KB5124012 (build 28000.2954). On the server side, Windows Server 2025 takes KB5122871 (build 26100.33438, with servicing stack update KB5122870), Windows Server 2022 takes KB5122882 (build 20348.5622), and Windows Server 2019 takes KB5122876 (build 17763.9245).

Microsoft lists no known issues against the Windows 11 and Windows 10 packages at release, which is not something every month can say. Windows Server 2025 still carries the pre-existing issue where Windows Server Update Services does not display synchronization error details, a side effect of a mitigation Microsoft shipped last year, so that one is not new this month.

Windows 10 21H2 and 22H2 take KB5122878 (builds 19045.7725 and 19044.7725), and only on devices enrolled in Extended Security Updates, the paid program that is now the only way a Windows 10 machine gets patched at all. This is the ninth ESU release. Besides the security content, it fixes an issue that could force devices with an unrecommended BitLocker Group Policy configuration to enter their BitLocker recovery key, which is the kind of bug that turns a Tuesday into a very long Tuesday if it hits a laptop fleet, and an issue where Remote Desktop audio redirection would not play a remote session's audio on the local computer.

The enrollment window moved in your favor: Microsoft has extended Windows 10 ESU enrollment through October 12, 2027. That is a real reprieve, and it is also a trap if you treat it as a plan. A Windows 10 machine outside ESU got nothing from this release, both exploited zero-days included, and falls further behind every month. Know which of your machines are enrolled and which are not, this week. The Windows 10 end-of-life post lays out the exit paths.

Secure Boot: the certificate clock is still running

This month's update widens automatic Secure Boot certificate targeting to more eligible devices, continuing a rollout that has been running all year. The deadline behind it has not moved: the Microsoft Windows Production PCA 2011 certificate, which signs the Windows bootloader itself, expires October 19, 2026. The Microsoft Corporation UEFI CA 2011 already expired June 27, 2026, and the KEK CA 2011 expired June 24, 2026.

Nothing dramatic happens on expiry day. Machines still boot and people still work. What you lose is the ability to receive new boot-path security mitigations, which means a device frozen on 2011 certificates is stuck with whatever boot protections it had and cannot get new ones. The fix is to let the certificate updates deploy, which for managed machines means letting this month's update install and then verifying the certificate status afterward rather than assuming it took. We walked through the mechanics in the June post.

Two other clocks are worth putting on a calendar while you are here. October's Patch Tuesday brings the final Extended Security Updates for Windows Server 2012 and 2012 R2, and the final ESU for Exchange Server 2016 and 2019. Windows Server 2022 also leaves mainstream support on October 13, 2026, moving to extended support with monthly security updates through October 2031. If any of those are still running in your environment, the runway is now measured in weeks.

How a managed deployment actually works

We do not push a release like this to production machines on Tuesday afternoon, and that is deliberate. Patches occasionally break things, and when they do, the industry finds out within the first day or two as millions of machines install them and telemetry rolls in. That instinct matters more at 966 CVEs than at 400, because a release this large touches more of the operating system and gives a regression more places to hide. A roughly 48-hour soak costs attackers little of the window that matters and has saved our clients from more than one bad patch that Microsoft had to pull and reissue.

So the updates go out in rings, which just means groups in a planned order. Our own machines and a small test group take the release first. Client workstations follow in an after-hours window once telemetry is clean, so nobody's workday is interrupted by an installing-updates screen. Servers deploy separately in a maintenance window, when a reboot cannot take down file shares or a line-of-business app in the middle of an invoice run. Two actively exploited zero-days can compress that timeline: the soak is a default, not a dogma, and a month like this one is exactly when the judgment call gets made rather than deferred.

Reboots are the unglamorous half of patching, and they matter more than people think. A patch that has been downloaded but not rebooted into place is not protecting anything. Reboots are scheduled for early morning hours, and afterward the RMM verifies per machine that the update applied, the build number moved, and the machine came back healthy. That verification step is the difference between patching as a policy and patching as a hope, the same discipline covered in the patch management post. Ghosxt clients get the specifics of each month's deployment windows by email, so none of the above requires anything from them.

How to prioritize this week

If you run your own patching, in order:

• Install and reboot, everywhere. The cumulative update covers both exploited zero-days at once. Confirm automatic updates are actually on, and confirm the reboot happened, not just the download.
• DNS servers and Remote Desktop Services hosts next. CVE-2026-69730 and CVE-2026-69525 are both unauthenticated CVSS 9.8 remote code execution with no user interaction, and Microsoft rates both exploitation more likely. On a small network the DNS role usually lives on the domain controller, so that box goes first.
• Hyper-V hosts after that. CVE-2026-80083 lets a compromised guest reach the host, which collapses whatever separation you thought you had between virtual machines.
• Then on-premises Exchange and SharePoint. Nine Exchange CVEs and sixteen SharePoint Server CVEs land this month. If either server is reachable from the internet, move it up the list.
• Then Office clients, specifically for the PowerPoint flaw. Office updates ride their own release channel, so a fully patched Windows machine can still be running vulnerable Office. Check build versions, do not assume.
• Audit Windows 10 ESU enrollment. Either a machine is enrolled and took KB5122878, or it is unprotected against everything in this release. Make the list this week.
• Then do the non-patch item. Check who has local administrator rights on their everyday account, and take those rights off the accounts that do not need them daily. Both zero-days this month exist to escalate privilege. Starting from fewer privileges is the control that keeps working after the next one drops.
• Verify, do not assume. Spot-check build numbers (26100.9445 or 26200.9445 on Windows 11, 19045.7725 on ESU Windows 10) rather than trusting the green checkmark in Windows Update.

Where this fits

• The August 2026 Patch Tuesday post, the July post, and the June post, for the three previous releases and the patch-cadence habit.
• The AI-found Firefox flaws post, for the AI-driven discovery wave behind 2026's record volumes.
• The LegacyHive post, for the same privilege-escalation argument applied to July's disclosure.
• The privileged access post and the identity hardening post, for the two controls that matter most against an escalation zero-day.
• The EDR versus antivirus post and the managed detection and response page, for catching the escalation attempt itself.
• The exposed RDP post, for why this month's Remote Desktop Services flaw is worse for some networks than others.
• The May SharePoint post, for why self-hosted SharePoint keeps showing up in these roundups.
• The Windows 10 end-of-life post, for the machines this release skipped entirely.
• The patch management post, for the cadence and ownership structure that makes months like this one routine instead of a scramble.
• The 10 essentials and the cybersecurity page, for where patching sits in the full defense.
• The managed IT page and the pricing page, for patch management that is verified across every device and what it costs.

We run monthly patch management for small businesses across Salinas, Monterey, Santa Cruz, Watsonville, and San Jose, and the rest of the Central Coast. This is the kind of thing we watch so you do not have to.

FAQs about the September 2026 Patch Tuesday

How many vulnerabilities did the September 2026 Patch Tuesday fix?

Microsoft's September 8, 2026 release fixes 966 vulnerabilities by BleepingComputer's count, which tallies only the CVEs Microsoft published on release day. That makes it the largest Patch Tuesday on record, roughly 2.4 times August's 400 and well past July's previous record of 570. By class the release breaks down as 438 elevation-of-privilege, 258 remote-code-execution, 173 information-disclosure, 56 denial-of-service, 19 security-feature-bypass, and 16 spoofing flaws, with 105 rated Critical: 81 remote code execution, 20 elevation of privilege, 2 information disclosure, and 1 security feature bypass. Other outlets report totals anywhere from 972 to 995 because Microsoft's Security Update Guide changed format in July 2026 and each outlet counts differently. The Zero Day Initiative tallies 972 new CVEs with 114 Critical by its own severity math, SecurityWeek reports 974, several outlets land on 973 with 113 Critical, and Action1 counts 995 with 121 Critical by folding in fixes Microsoft published outside the release-day list. The total also excludes 204 cloud-service flaws Microsoft fixed earlier in the month.

What are the two zero-days in the September 2026 Patch Tuesday, and how worried should a small business be?

Both are local elevation-of-privilege flaws, both are CVSS 7.8, both are rated Important rather than Critical, and Microsoft confirms both are being exploited in the wild while listing neither as publicly disclosed. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call that lets code running in a low-privilege AppContainer sandbox escape to SYSTEM with no user interaction, reported by researchers at Volexity and Proofpoint. CVE-2026-81963 is an improper link resolution (link following) flaw in the Windows Update Stack that also elevates a local user to SYSTEM, credited to Romain Deperne and the Microsoft Threat Intelligence Center, with Microsoft's exploitability assessment listed as functional. Neither gives an attacker a way into your network. Both are what an attacker uses after they are already on a machine, which is why installing the cumulative update and rebooting is the fix, and why identity hygiene and endpoint detection are what stop the step before it.

Why does a privilege escalation flaw matter if the attacker already needs access?

Because getting a foothold is the easy part of a modern attack, and it usually comes from a phished password, a malicious document, or a stolen session token rather than from a remote exploit. What separates a contained incident from a business-ending one is whether the attacker can promote that foothold to SYSTEM or domain administrator, because that is the privilege level needed to disable security tooling, reach every file share, and deploy ransomware across the network. A privilege escalation zero-day removes the hardest step in that chain, which is why two of them under active exploitation in one month is worth more attention than the headline vulnerability count. The defenses that matter alongside the patch are the ones that make the first step and the escalation step harder: phishing-resistant multi-factor authentication, no day-to-day local administrator rights on user accounts, and managed detection and response with a 24/7 SOC watching for the escalation attempt itself.

What is the PowerPoint vulnerability, and can the Outlook preview pane trigger it?

CVE-2026-69678 is a use-after-free flaw in Microsoft PowerPoint rated Critical at CVSS 8.8. Microsoft's own advisory FAQ confirms that the Preview Pane is an attack vector, which means a specially crafted presentation can trigger code execution when it is rendered in the preview pane, without anyone opening the attachment. It was not exploited or publicly disclosed at release, but it is the one item in this month's release where what a person does or does not click changes the outcome, so it is worth raising with your team rather than patching silently. Office updates ship on their own Click-to-Run release channel rather than through the Windows cumulative update, so verify that Office is current on every machine separately from Windows Update, and consider disabling the reading pane for external mail as a short-term control while patches roll out.

We still have Windows 10 machines. Did we get any of these fixes?

Only if those machines are enrolled in Extended Security Updates. This month's Windows 10 fix, KB5122878 (builds 19045.7725 for 22H2 and 19044.7725 for 21H2), is the ninth ESU release and shipped only to enrolled devices. It also fixes an issue that could force a BitLocker recovery key prompt on devices with an unrecommended BitLocker Group Policy configuration, and an issue where Remote Desktop audio redirection failed to play a remote session's audio on the local computer. Microsoft lists no known issues against the package at release. A Windows 10 machine without ESU received nothing from this release, both exploited zero-days included, and keeps falling further behind every month. Microsoft has extended ESU enrollment through October 12, 2027, so enrollment is still available as a bridge, but it is a bridge, not a destination.

What order should a small business patch in this month?

Install this month's cumulative update and reboot everywhere first, because that single step covers both exploited zero-days. If some machines have to queue: Windows servers running the DNS role or Remote Desktop Services next (CVE-2026-69730 and CVE-2026-69525 are both unauthenticated CVSS 9.8 remote code execution with no user interaction), then Hyper-V hosts (CVE-2026-80083 is a guest-to-host escape), then on-premises Exchange and SharePoint, then Office clients for the PowerPoint preview-pane flaw, then audit which Windows 10 machines are enrolled in Extended Security Updates. Verify build numbers afterward rather than trusting the green checkmark: Windows 11 24H2 and 25H2 should land on 26100.9445 or 26200.9445, and ESU-enrolled Windows 10 on 19045.7725, because an installed-but-not-rebooted patch protects nothing.

Sources: BleepingComputer · Zero Day Initiative · SecurityWeek · Action1 · KB5124008 · KB5122878 · KB5122871 · Microsoft Secure Boot certificate expiration

Prefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.