When Patch Volume Becomes a Security Risk
Microsoft’s September 2026 Patch Tuesday is not an ordinary monthly security update.
Released on September 8, Microsoft addressed 974 vulnerabilities across its product ecosystem, making this the largest Patch Tuesday release in Microsoft’s history. The Windows product family alone accounts for more than 700 vulnerabilities.
But the number 974 is not the real story.
The real story is that two vulnerabilities are already being actively exploited, while dozens of others are considered more likely to be exploited.
For security teams, September is therefore less about counting vulnerabilities and more about answering a much more important question:
How quickly can we identify, prioritize and close the vulnerabilities that intersect with our actual attack surface?
The Two Vulnerabilities That Demand Immediate Attention
The most important vulnerabilities in this month’s release are CVE-2026-81963 and CVE-2026-85880.
Both are elevation-of-privilege vulnerabilities and both are being actively exploited.
CVE-2026-81963 — Windows Update Stack
CVE-2026-81963 is an elevation-of-privilege vulnerability in the Windows Update Stack.
It has a CVSS score of 7.8 and can allow an attacker who already has local access to elevate privileges to SYSTEM.
At first glance, a local privilege-escalation vulnerability may appear less dangerous than a remotely exploitable 9.8 vulnerability.
That would be the wrong conclusion.
Modern attacks rarely depend on a single vulnerability.
An attacker may first obtain a foothold through phishing, a malicious document, a vulnerable application or stolen credentials. Once inside the endpoint, an elevation-of-privilege vulnerability can turn limited access into SYSTEM-level control.
That changes the attack completely.
The sequence becomes:
Initial access → Local foothold → Privilege escalation → SYSTEM → Credential access → Lateral movement
That is why an actively exploited 7.8 vulnerability can be more urgent than an unexploited 9.8 vulnerability.
CVE-2026-85880 — Windows ALPC
The second actively exploited vulnerability is CVE-2026-85880, affecting Windows Advanced Local Procedure Call, or ALPC.
This is another elevation-of-privilege vulnerability with a CVSS score of 7.8.
The interesting aspect of this vulnerability is the security boundary it attacks.
ALPC is part of Windows’ inter-process communication architecture. Exploitation can allow a low-privileged attacker operating within an AppContainer to escape that restricted environment and obtain higher privileges.
In other words, a security mechanism designed to contain an application can itself become part of the attack path.
For organizations using application sandboxing as a defensive control, this deserves particular attention.
Why These Two Vulnerabilities Matter More Than Their CVSS Scores
This month’s biggest lesson is simple:
CVSS does not equal business risk.
A vulnerability with a CVSS score of 7.8 that is actively exploited on a privileged workstation can be more dangerous than a theoretical 9.8 vulnerability on an isolated system.
For September, the prioritization logic should therefore be:
Exploit status → Asset criticality → Exposure → Attack path → Privilege impact → CVSS
rather than simply:
CVSS → Severity → Patch SLA
That distinction is particularly important for the two actively exploited Windows vulnerabilities.
The DNS Vulnerability That Should Not Be Ignored
Another vulnerability that deserves immediate attention is CVE-2026-69730, a critical remote-code-execution vulnerability affecting Windows DNS Server.
It carries a CVSS score of 9.8 and can be exploited remotely.
DNS is not just another infrastructure service.
In many Windows environments, DNS is deeply connected to Active Directory, authentication, service discovery and enterprise application connectivity.
When DNS and Domain Controller roles coexist, the security impact becomes even more significant.
A compromise of DNS infrastructure can potentially become a stepping stone toward much broader enterprise compromise.
For that reason, organizations should immediately identify:
- Internet-facing DNS servers
- Internal Windows DNS servers
- DNS services running on Domain Controllers
- Servers reachable from untrusted network segments
Network segmentation can reduce exposure, but it should be considered a compensating control—not a replacement for patching.
Kerberos Brings Identity Infrastructure Into the Picture
September also includes CVE-2026-69676, a critical vulnerability affecting Windows Kerberos.
Kerberos sits at the heart of Windows authentication.
That means vulnerabilities affecting Kerberos deserve a different level of attention from vulnerabilities affecting ordinary endpoints.
The security team should specifically identify whether affected systems include:
Domain Controllers, authentication infrastructure and other systems participating in enterprise identity services.
The combination of DNS, Kerberos and privilege-escalation vulnerabilities makes this month’s release particularly relevant to Active Directory security.
Remote Desktop Services
Another vulnerability worth accelerating is CVE-2026-69525, affecting Remote Desktop Services.
It carries a CVSS score of 9.8 and allows remote code execution.
The most important question here is not simply whether RDP is enabled.
The important question is:
Who can reach the vulnerable service?
An RDP vulnerability on an isolated administrative server is very different from the same vulnerability on an Internet-accessible system.
Organizations should therefore review:
- Internet exposure
- VPN access
- administrative network access
- jump servers
- firewall restrictions
- segmentation between user and server networks
Exposure should determine urgency.
Exchange Server Remains a High-Value Target
Microsoft’s September updates also address multiple Exchange Server vulnerabilities.
One of the notable vulnerabilities is CVE-2026-55007, a remote-code-execution vulnerability with a CVSS score of 8.1.
Exchange deserves special treatment because it is both an enterprise application and an externally exposed attack surface in many organizations.
It also contains highly valuable information, including:
- Attachments
- User identities
- Contacts
- Business communications
- Authentication-related information
Therefore, Exchange should not disappear into the normal server-patching queue.
Internet-facing Exchange should be treated as a priority remediation asset.
Outlook and Office: The Endpoint Attack Surface
September is also significant for Microsoft Office.
The release contains a substantial number of Office vulnerabilities, including critical remote-code-execution issues affecting products such as Word, Outlook and PowerPoint.
One particularly important example is CVE-2026-78509, affecting Microsoft Outlook.
The concern with vulnerabilities that can be triggered through message rendering or the Reading Pane is that they can reduce the traditional dependency on a user opening a malicious attachment.
That changes the defensive assumption.
The old model was:
Malicious email → User opens attachment → Exploitation
The more dangerous model is:
Malicious email → Application processes content → Exploitation
This is why endpoint patching cannot stop at the Windows operating-system update.
A machine can have the latest Windows cumulative update and still remain vulnerable through Office or Outlook.
SharePoint: Don’t Treat Authentication Requirements as Safety
September also contains multiple SharePoint Server vulnerabilities.
Some require authentication, but that does not automatically make them low risk.
In an enterprise environment, authenticated attackers may include:
- Compromised employees
- Stolen accounts
- Contractors
- Service accounts
- Attackers who have already compromised another system
This is another example of why vulnerability prioritization needs to consider the attacker’s position within the environment.
A vulnerability requiring authentication can still become extremely valuable after initial compromise.
SQL Server and the Emerging AI Security Question
One of the more interesting vulnerabilities in this month’s release is CVE-2026-65669, associated with SQL Server Management Studio and its Copilot functionality.
This is interesting for a different reason.
Traditional vulnerability management has focused heavily on memory corruption, authentication bypasses, privilege escalation and injection vulnerabilities.
AI-assisted enterprise applications introduce another dimension:
Can an AI assistant be manipulated into performing an action that the underlying application is supposed to prevent?
That brings authorization boundaries, prompt handling and AI-generated actions into the security conversation.
The security model for AI-enabled enterprise tools therefore needs to evolve beyond traditional application security.
The Real Problem With 974 Vulnerabilities
The obvious reaction to 974 vulnerabilities is:
“How are we going to patch all of these?”
That is the wrong first question.
The first question should be:
“Which of these 974 vulnerabilities intersect with our environment and our attack paths?”
A vulnerability on a retired server is not the same risk as the same vulnerability on a Domain Controller.
A vulnerability on an isolated workstation is not the same risk as one on an Internet-facing Exchange server.
A theoretical RCE is not the same risk as an actively exploited EoP vulnerability.
The objective should therefore be to reduce risk exposure, not simply reduce the number of outstanding CVEs.
How I Would Prioritize September
I would divide the September remediation effort into four practical waves.
Wave 1 — Emergency
Immediately address the two actively exploited vulnerabilities:
CVE-2026-81963
CVE-2026-85880
These should be treated as emergency remediation regardless of their Microsoft severity classification.
Wave 2 — Critical Infrastructure
Next, prioritize vulnerable systems supporting:
DNS, Active Directory, Kerberos, Exchange, Remote Desktop and other externally or broadly reachable infrastructure.
The focus should be on exposure and business criticality.
Wave 3 — Endpoints
Accelerate Windows and Office remediation across:
Outlook, Word, Excel, PowerPoint and other commonly targeted applications.
Privileged-user workstations should receive additional priority because compromise of these systems can provide attackers with access to sensitive credentials and administrative sessions.
Wave 4 — Remaining Applications
Complete remediation across:
SharePoint, SQL Server, Developer Tools, Azure components and remaining Windows vulnerabilities.
This should be followed by verification rather than simply closing tickets.
Patch Deployment Is Not the Same as Risk Closure
One of the most common weaknesses in vulnerability management is treating successful patch deployment as the end of the process.
It isn’t.
The process should be:
Identify → Prioritize → Patch → Verify → Hunt → Reassess
After deployment, security teams should confirm that:
- The correct update was installed
- The system reached the expected build
- Reboots were completed where required
- Office applications were updated
- Vulnerable services are running the remediated version
- No compensating control was accidentally removed
Then comes the part that is often missed:
Threat hunting.
For actively exploited vulnerabilities, organizations should investigate whether exploitation occurred before the patch was deployed.
Threat Hunting Should Accompany the Patch
For the two exploited EoP vulnerabilities, security teams should review endpoint telemetry for suspicious privilege escalation activity.
Look for:
- Unexpected SYSTEM processes
- Abnormal parent-child process relationships
- Suspicious service creation
- Unexpected application-container behavior
- Unusual activity around Windows Update
- Privilege escalation followed by credential-access activity
For DNS and Exchange systems, review unusual process creation, abnormal outbound connections and suspicious service behavior.
The goal is not simply to prove that the patch was installed.
The goal is to answer:
“Were we already compromised before we patched?”
The Bigger CISO Message
The September 2026 release demonstrates something much bigger than Microsoft’s vulnerability count.
The vulnerability-discovery cycle is accelerating.
Security researchers are finding vulnerabilities faster.
AI-assisted research is increasing the scale of vulnerability discovery.
Attackers are becoming faster at turning publicly available technical information into operational exploitation.
But enterprise remediation processes often remain tied to monthly cycles, manual validation and ticket-driven workflows.
That creates what I would call the Patch Gap.
Vulnerability discovered
↓
Patch released
↓
Organization identifies exposure
↓
Testing begins
↓
Patch deployment
↓
Validation
The longer this chain takes, the larger the window available to attackers.
The New Vulnerability Management Model
The old model was:
Scan → Score → Patch
That model is no longer sufficient.
A modern enterprise should operate closer to:
Discover → Contextualize → Prioritize → Remediate → Validate → Hunt → Measure Residual Risk
This is the difference between vulnerability management and risk-based exposure management.
The objective isn’t to eliminate every CVE immediately.
The objective is to eliminate the vulnerabilities that can realistically become an enterprise-level attack path.
CISO Perspective
If I were presenting September Patch Tuesday to an executive committee, I would not lead with 974.
I would say:
“Microsoft released an unprecedented number of security fixes this month. Two vulnerabilities are already being actively exploited. Several others affect critical enterprise infrastructure including DNS, Kerberos, Remote Desktop, Exchange and Office. Our immediate priority is to identify where these vulnerabilities intersect with our attack surface, remediate those systems rapidly and verify that there is no evidence of prior exploitation.”
That is a much more useful executive message than a spreadsheet containing hundreds of CVEs.
Final Takeaway
September 2026 is not simply another large Patch Tuesday.
It represents a change in the economics of vulnerability management.
The challenge is no longer just the number of vulnerabilities discovered.
The challenge is how quickly defenders can separate signal from noise and convert vulnerability intelligence into risk reduction.
The two actively exploited Windows vulnerabilities should be treated as emergency items.
DNS, Kerberos, Remote Desktop and Exchange should receive accelerated attention.
Office and Outlook should be treated as a separate endpoint attack surface.
And the remaining vulnerabilities should be prioritized according to exposure, exploitability, asset criticality and attack-path relevance.
Because in the end, the question isn’t:
“How many vulnerabilities did Microsoft patch?”
The better question is:
“How many attack paths did we actually close?”
That is the metric that matters.
