September 2026 Patch Tuesday fixes a record 974 CVEs including 2 exploited zero-days, 20 wormable bugs, and a critical Exchange RCE via Visio email.

Microsoft’s September 2026 Patch Tuesday set a new record. Depending on how researchers count external and Chromium bugs, Microsoft fixed between 966 and 997 CVEs in this update. The company also fixed another 204 vulnerabilities earlier in September across Azure, Entra ID, Edge, and other services. This means the total number of September fixes is already much higher than the headline figure.

“It’s a new record release from Microsoft, but, again, that seems to be the new normal. As always, counting this beast is tricky, but I see 972 new CVEs rolling out from Redmond this month.” reads the report published by ZDI. “On the one hand, congrats to the security gnomes at Microsoft for being able to patch bugs at this rate. On the other hand, AI-assisted vulnerability discovery shows no signs of slowing down. However, we have not seen a correlating spike in active exploits – yet.”

The number of addressed issues skyrockets due to the use of AI for code auditing in the monthly counts, it has been climbing steadily through 2026. What hasn’t arrived yet, and ZDI notes the absence explicitly, is a corresponding spike in active exploits, though 58 of this month’s fixes are rated by Microsoft as more likely to be exploited.

The two vulnerabilities already under attack both allow attackers to gain higher privileges. CVE-2026-85880 (CVSS score of 7.8) is a heap buffer overflow in Windows Advanced Local Procedure Call (ALPC). It lets a local attacker gain SYSTEM-level privileges, and the researchers note it is only the second ALPC zero-day Microsoft has patched since January 2023.

CVE-2026-81963 (CVSS score of 7.8) flaw resides in the Windows Update Stack. It lets an attacker follow a malicious link and escalate privileges. It is the first Update Stack vulnerability that Microsoft has confirmed attackers actively exploiting. Both flaws require local access and user-level privileges, so attackers would likely use them after gaining an initial foothold and then use them to gain higher privileges.

The Exchange Server situation this month is more pressing than either zero-day. CVE-2026-55007 is a remote code execution vulnerability that deserves immediate attention.

“An unauthenticated attacker could send a specially crafted Visio attachment to an affected Exchange server. The server could process the attachment during content indexing, and successful exploitation could allow the attacker to execute code on the server. User interaction is not required.” reads the advisory. “Successful exploitation requires the target system to be under sustained low-memory (memory pressure) conditions, which are not commonly present in normal operation. This makes the vulnerability difficult to reliably trigger, as the attacker must first induce or wait for a constrained memory state before exploitation becomes possible.”

Microsoft rates the exploit as unreliable, but an attacker trying repeatedly only needs to succeed once. A second Exchange bug, CVE-2026-69380 (CVSS 8.1), is also a priority: it lets a low-privileged authenticated attacker impersonate any user in the organization and hijack every mailbox. If your Exchange servers face the internet, test and deploy these patches immediately.

Remote Desktop Services adds another urgent item: CVE-2026-69525 (CVSS score of 9.8) is a use-after-free bug that lets an unauthenticated in-network attacker execute arbitrary code. Microsoft specifies an “in-network” requirement, but the CVSS network vector score suggests any network path could be relevant. RDP is everywhere in enterprise environments, and that CVSS score combined with the unauthenticated attack path makes this one worth treating as urgent regardless of the technical qualifier.

Microsoft also fixed 20 wormable vulnerabilities. These flaws let remote, unauthenticated attackers execute code without any user interaction, creating the kind of conditions that can help malware spread from system to system. The affected components include DHCP Server, Active Directory, Windows DNS Server, SMB Client, Netlogon, NFS, RRAS, IP Helper, Message Queuing, and others. One DNS flaw, CVE-2026-69730, has a CVSS score of 9.8. ZDI calls it a “SigRed’s spiritual successor,” referring to the critical DNS flaw exploited in 2020. Fixing 20 wormable bugs in one Patch Tuesday is an unusually high number.

Microsoft also patched 17 SharePoint flaws, including four that allow remote code execution, and more than 60 SQL Server vulnerabilities. One SQL Server flaw affects SQL Copilot in SQL Server Management Studio. Microsoft also fixed an Android Microsoft Authenticator flaw that can let a malicious app gain valid access tokens after the user completes an authentication step. Teams should prioritize these fixes based on their own environments, but they should not ignore any of them.

The full list of vulnerabilities addressed by Microsoft this month is available here.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Patch Tuesday)

Patch Tuesday: Microsoft fixes a record 621 CVEs, including 2 exploited zero-days and critical flaws affecting SharePoint, RDP, Hyper-V, and AD FS.

Microsoft’s July 2026 Patch Tuesday is, by a significant margin, the largest single-month security release in the company’s history. The Zero Day Initiative counted 621 new Microsoft CVEs for the month, and the year-to-date total already exceeds every other full-year total in the last two decades. That’s before counting the roughly 480 additional bugs in Chromium and Microsoft Edge that ZDI didn’t cover separately. Of the Microsoft-specific fixes, 63 are rated Critical, six Moderate, one Low, and the rest Important. The IT giant labeled two issues as “under active exploitation,” and one more is publicly known.

The product scope is equally remarkable. Patches this month cover Windows and Windows components, Office, Microsoft Edge, Azure, .NET, Visual Studio, GitHub Copilot, Defender, Exchange Server, Hyper-V, and, at the more unexpected end of the list, Ages of Empire II and Minecraft Server. Eight of the bugs came through ZDI’s own submission program.

“The CVE count year-to-date exceeds all other years’ totals. How to count this mess is anyone’s guess.” states the report published by ZDI.

The following two bugs are being actively exploited:

• CVE-2026-56155 is an elevation of privilege flaw in Active Directory Federation Services. It requires local access and low privileges to start, which sounds like a limited threat until you remember that AD FS is identity infrastructure, and attackers who are already inside a network use exactly this kind of bug to move sideways and upward. ZDI notes it can be paired with a remote code execution vulnerability, the combination frequently seen in ransomware incidents. Patch it fast.
• CVE-2026-56164 is a SharePoint Server elevation of privilege vulnerability rated only CVSS 5.3, which is Moderate, and that score has probably caused some organizations to deprioritize it. That would be a mistake. A missing-authentication flaw allows unauthenticated remote attacks without user interaction. Active exploitation makes immediate patching essential, regardless of CVSS score.

The highest-severity bug this month is a critical Microsoft Windows VMSwitch Elevation of Privilege Vulnerability tracked as CVE-2026-57092, which received a CVSS score of 9.9. It is a use-after-free vulnerability that lets a low-privileged attacker escalate all the way to full host compromise across a virtual machine boundary, meaning an attacker inside a VM can reach the host running it. If your Hyper-V deployments use VMSwitch, which they almost certainly do, this is an immediate priority.

Below are other interesting issues addressed by Microsoft this month:

• CVE-2026-50522 and CVE-2026-58644 are a matched pair of SharePoint remote code execution bugs, both scored CVSS 9.8, both reachable without authentication or user interaction, both stemming from the deserialization of untrusted data. CVE-2026-50522 was demonstrated live at Pwn2Own Berlin, meaning a working exploit was handed to Microsoft. Despite that, the advisory lists exploit maturity as unknown.
• CVE-2026-56190 is an unauthenticated remote code execution bug in RDP Server, requiring no user interaction, rooted in use of an uninitialized resource. Specially crafted RDP traffic can interact with memory that was never properly set up, giving an attacker a path to corrupt memory and control code execution. RDP servers are a perennial favorite target. Audit which of yours face the internet and start there.
• CVE-2026-55008 in Exchange Server is listed as a spoofing vulnerability, but ZDI recommends treating it as what it actually is: a stored cross-site scripting flaw in Outlook Web Access with a CVSS of 9.6. A crafted email opened in Outlook Web Access can execute JavaScript in the victim’s browser session without attachments or user interaction beyond viewing it. Patch urgently.
• CVE-2026-50518 covers a heap-based buffer overflow in Windows DHCP Server, scored CVSS 9.8, unauthenticated and network-reachable. A second DHCP RCE is also in this release with some caveats, but this one has none. DHCP servers shouldn’t be internet-facing, but if yours somehow are, these jump to the very top of the list.

The full list of vulnerabilities addressed by Microsoft in July 2026 is available here

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Patch Tuesday)