Microsoft's September 2026 security update addresses 1170 vulnerabilities: 119 rated Critical, 910 Important. 2 are already exploited in the wild and 0 were publicly disclosed before today.

1,170 patches this month — one of the largest Patch Tuesdays on record — but the number that actually matters is 2: two Windows elevation-of-privilege bugs are being exploited in the wild right now and are already in CISA's KEV catalog. Neither was publicly disclosed ahead of the patch, which means Microsoft caught these through incident telemetry, not researcher disclosure — a sign attackers found them first. Beyond the two urgent items, this is a heavy RCE month for core Windows networking and identity components (RDS, DNS, Kerberos, SMB Client, Schannel), plus a notable cluster of cloud-service fixes in Azure and Spring Cloud Azure that admins managing hybrid environments shouldn't skip just because they're not Windows patches.

CVE-2026-81963 is a link-following flaw in the Windows Update Stack that lets an authorized local attacker escalate privileges. Because it targets the update mechanism itself, any endpoint with local code execution — including low-privilege malware footholds — can use this to jump to higher privileges. It's confirmed exploited and KEV-listed, so treat it as a live threat, not theoretical risk.

CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC, also enabling local privilege escalation and also confirmed under active exploitation and KEV-listed. ALPC is a core inter-process communication mechanism used constantly across Windows, so a working exploit here is a reliable post-compromise escalation tool regardless of what got the attacker onto the box in the first place. Both of these should be at the top of your deployment queue today, especially on any system where initial-access controls might already be imperfect.

On the RCE side, CVE-2026-69525 (Windows Remote Desktop Services) and CVE-2026-69730 (Windows DNS) both carry a 9.8 and require no authentication — RDS is a classic externally-facing target, and Windows DNS servers are core infrastructure, so both deserve fast attention even without confirmed exploitation.

CVE-2026-69676 (Windows Kerberos) is a capture-replay authentication bypass that leads to code execution, which is particularly nasty in any environment relying on Kerberos for domain authentication.

Rounding out the Windows RCE list, CVE-2026-72940 (Schannel), CVE-2026-72936 (SMB Client), CVE-2026-69623 (HTTP Print Provider), CVE-2026-72957 (Deployment Services), CVE-2026-69852 (RRAS), and CVE-2026-70585 (NFS ONCRPC XDR Driver) span TLS, file sharing, printing, imaging, routing, and NFS services — a reminder of how much attack surface sits inside default Windows roles and features.

On the privilege-escalation side, CVE-2026-68880 and CVE-2026-69301 (both Win32K), CVE-2026-70342 (Ancillary Function Driver for WinSock), CVE-2026-68876 (Program Compatibility Assistant Service), CVE-2026-69714 (Device Association Service), and CVE-2026-69777 (DHCP Client, adjacent-network) all give an attacker with some foothold a path to higher privileges — worth prioritizing on any multi-user or shared system.

CVE-2026-83501 (Windows VBS Enclave) is a lower-severity information disclosure bug but relevant if you're relying on virtualization-based security for secrets isolation. Outside Windows proper, CVE-2026-69854 (Spring Cloud Azure) allows authentication bypass leading to privilege escalation over the network, and CVE-2026-69857 (Azure Cosmos DB) allows spoofing via a user-controlled key issue — both matter for anyone running Azure-integrated services, since these are cloud-side components you can't patch on your own schedule and should verify with your Azure tooling.

With two actively exploited, KEV-listed local privilege escalation bugs (CVE-2026-81963 and CVE-2026-85880) confirmed in Windows this month, those two patches go first, full stop — they're already being used in the wild. After that, work through the critical RCEs in RDS, DNS, and Kerberos given their network-reachable, no-auth profiles, then clear the rest of this unusually large batch on your normal cycle.

If you run Azure-integrated services, don't treat the Spring Cloud Azure and Cosmos DB items as someone else's problem — confirm your environment has picked up the fix.

Source: Microsoft Security Update Guide and the CISA KEV catalog.