On September 8, Microsoft released its September 2026 Patch Tuesday release which patched 964 CVEs with 104 rated critical and 860 rated as important. This update includes patches for two zero-days that were exploited in the wild. To date, this is the largest Patch Tuesday release ever, crushing the previous record from July’s 569 CVEs.

CVE-2026-81963 is an elevation of privilege vulnerability affecting Windows Update Stack elevation of privilege vulnerability. It received a CVSSv3 score of 7.8 and was rated as important. According to Microsoft, this vulnerability was exploited in the wild as a zero-day.

CVE-2026-85880 is a elevation of privilege vulnerability affecting Windows Advanced Local Procedure Call (ALPC). It received a CVSSv3 score of 7.8 and is rated as important. According to Microsoft, this vulnerability was exploited in the wild, making it the one of two zero-days addressed in the September Patch Tuesday release. Successful exploitation would allow an attacker to gain SYSTEM level privileges.

This month’s update includes patches for:

• .NET
• .NET and Visual Studio
• ASP.NET Core
• Active Directory Certificate Services (AD CS)
• Active Directory Domain Services
• Active Directory Federation Services (AD FS)
• Audio Video Control Transport Protocol
• Azure Arc
• Azure CycleCloud
• Azure HDInsights
• BranchCache
• Connected Devices Platform Service (Cdpsvc)
• Data Sharing Service Client
• GitHub Copilot and Visual Studio Code
• Graphic Fonts
• HID class driver
• IP Helper
• Internet Storage Name Service
• Kernel Streaming WOW Thunk Service Driver
• Microsoft Account
• Microsoft Authenticator
• Microsoft Azure Attestation service and Device Health Attestation Service
• Microsoft Azure CLI
• Microsoft COM for Windows
• Microsoft Dynamics 365
• Microsoft Exchange Server
• Microsoft Graphics Component
• Microsoft Install Service
• Microsoft JScript
• Microsoft Local Security Authority Server (lsasrv)
• Microsoft Office
• Microsoft Office Access
• Microsoft Office Excel
• Microsoft Office Outlook
• Microsoft Office PowerPoint
• Microsoft Office Publisher
• Microsoft Office SharePoint
• Microsoft Office Word
• Microsoft Standard XPS
• Microsoft Teams for Android
• Microsoft Trace Data Helper
• Microsoft UxTheme Library (uxtheme.dll)
• Microsoft WDAC OLE DB provider for SQL
• Microsoft WebP Image Extension
• Microsoft Windows Codecs Library
• Microsoft Windows Media Foundation
• Microsoft Windows PDF
• Microsoft Windows SCSI Class System File
• Microsoft Windows Search Component
• Microsoft Windows Speech
• OpenSSH for Windows
• Power Automate
• Push Message Routing Service
• RPC Runtime
• Reliable Multicast Transport Driver (RMCAST)
• Remote Desktop Client
• Remote Desktop Gateway Service
• Role: DNS Server
• Role: Windows Fax Service
• SQL Server
• Skype for Business
• Spring Cloud Azure
• Storage Port Driver
• Telnet Client
• Virtual Hard Disk (VHD) Miniport Driver
• Visual Studio
• Visual Studio Code
• Volume Manager Driver
• Windows AF_UNIX Socket Provider
• Windows ALPC
• Windows Accounts Control
• Windows Ancillary Function Driver for WinSock
• Windows Audio Service
• Windows Authentication Methods
• Windows Autopilot
• Windows Bind Filter Driver
• Windows Biometric Service
• Windows BitLocker
• Windows Bluetooth Port Driver
• Windows Bluetooth Service
• Windows Boot Manager
• Windows Broadcast DVR User Service
• Windows Broker Infrastructure Service
• Windows CD-ROM Driver
• Windows Camera Frame Server Monitor
• Windows Cloud Files Mini Filter Driver
• Windows Compressed Folder
• Windows Connected User Experiences and Telemetry
• Windows Container Manager Service
• Windows Core Messaging
• Windows Credential Guard
• Windows Credential Providers
• Windows DCOM Server
• Windows DHCP Client
• Windows DHCP Server
• Windows DNS
• Windows DWM Core Library
• Windows Defender Firewall Service
• Windows Deployment Services
• Windows Device Association Broker service
• Windows Device Association Service
• Windows Devices Human Interface
• Windows Direct Show
• Windows Display Enhancement Service
• Windows Distributed File System (DFS)
• Windows Embedded Mode Service
• Windows Encrypting File System (EFS)
• Windows Enterprise App Management
• Windows Error Reporting
• Windows Event Logging Service
• Windows Failover Cluster
• Windows Fast FAT Driver
• Windows File History Service
• Windows GDI
• Windows GDI+
• Windows Graphics Kernel
• Windows Group Policy
• Windows HTTP Print Provider
• Windows HTTP.sys
• Windows Hello
• Windows Host Guardian Service
• Windows Hyper-V
• Windows IKE Extension
• Windows IP Address Management (IPAM) Service
• Windows Image Acquisition
• Windows Imaging Component
• Windows Installer
• Windows Internet Connection Sharing (ICS)
• Windows Kerberos
• Windows Kernel
• Windows Kernel Mode Driver
• Windows Key Distribution Center
• Windows LDAP - Lightweight Directory Access Protocol
• Windows License Manager
• Windows Link Layer Topology Discovery Protocol
• Windows MIDI Service Module
• Windows Management Instrumentation
• Windows Management Services
• Windows Media
• Windows Media Player
• Windows Message Queuing
• Windows Message Queuing Queue Manager
• Windows Microsoft DirectMusic
• Windows Mobile Broadband
• Windows Modern Device Management (MDM)
• Windows Modern Execution Server
• Windows NDIS
• Windows NFS Portmapper
• Windows NTFS
• Windows Netlogon
• Windows Network Connection Broker
• Windows Network File System
• Windows Notification
• Windows OLE DB
• Windows Online Certificate Status Protocol (OCSP)
• Windows Overlay Filter
• Windows Paint
• Windows Partition Management Driver
• Windows Performance Monitor
• Windows Power Dependency Coordinator
• Windows PowerShell
• Windows Print Spooler Components
• Windows PrintWorkflowUserSvc
• Windows Program Compatibility Assistant Service
• Windows Push Notifications
• Windows RDP Client
• Windows RNDIS
• Windows Raw Image Extension
• Windows Registry
• Windows Remote Access Connection Manager
• Windows Remote Desktop
• Windows Remote Desktop Licensing Service
• Windows Remote Desktop Protocol
• Windows Remote Desktop Services
• Windows Resilient File System (ReFS)
• Windows Resilient File System (ReFS) Deduplication Service
• Windows Routing and Remote Access Service (RRAS)
• Windows SMB Client
• Windows SMB Server
• Windows SMB Server Network Transport Driver (srvnet.sys)
• Windows Schannel
• Windows Secure Boot
• Windows Secure Kernel Mode
• Windows Secure Socket Tunneling Protocol (SSTP)
• Windows Security Center
• Windows Security Health Service
• Windows Server
• Windows Services for NFS ONCRPC XDR Driver
• Windows Setup Files Cleanup
• Windows Shell
• Windows Smart Card
• Windows Spaceport.sys
• Windows Storage
• Windows Storage Management Provider
• Windows Storage Port Driver
• Windows Storage Spaces Controller
• Windows TCP/IP
• Windows Task Scheduler
• Windows Text Shaping
• Windows URL Moniker
• Windows USB Audio Class driver (usbaudio.sys)
• Windows USB Driver
• Windows USB Hub Driver
• Windows USB Mass Storage Class Driver
• Windows USB Video Driver
• Windows Universal Disk Format File System Driver (UDFS)
• Windows Universal Plug and Play (UPnP) Device Host
• Windows Update Stack
• Windows VHD miniport driver
• Windows VOLSNAP.SYS
• Windows Virtual Trusted Platform Module
• Windows Volume Manager Extension Driver
• Windows Volume Shadow Copy
• Windows Web Platform Storage
• Windows WebClient Service
• Windows Win32 Kernel Subsystem
• Windows Win32K
• Windows Wireless Networking
• Windows Wireless Wide Area Network Service
• Windows Work Folder Service
• Windows Work Folders
• Windows exFAT File System
• Windows iSCSI
• Windows iSCSI Target Service
• Winsock
• XBox Gaming Services
• Xbox

For more information, please visit our blog.