September 2026 Patch Tuesday Roundup
Microsoft’s September 2026 Patch Tuesday landed on September 8, and it’s the biggest one yet — 966 CVEs fixed in a single release, on top of 204 more patched earlier in the month. Microsoft is crediting its newer AI-assisted vulnerability discovery for finding a lot more of these before attackers do, which is good news long-term, but it also means this month’s roundup has more ground to cover than usual.
Here’s the breakdown: 105 Critical vulnerabilities, 438 elevation of privilege bugs, 258 remote code execution flaws, 173 information disclosure issues, 56 denial of service, 19 security feature bypass, and 16 spoofing vulnerabilities. Two of those were zero-days already being exploited in the wild, and three days after release Microsoft had to ship an out-of-band update to fix regressions the patches themselves introduced. We’ll cover both below.
Zero-Day Vulnerabilities
CVE-2026-81963 — An elevation of privilege flaw in the Windows Update Stack. Improper link resolution lets an attacker gain SYSTEM-level privileges before a file is accessed. Actively exploited in the wild, so this one should be near the top of your patch list.
CVE-2026-85880 — A heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component. Also actively exploited, and also leads to local privilege escalation to SYSTEM. Between this and CVE-2026-81963, both zero-days this month give an attacker who’s already on a box a path straight to full control — patch these first.
Beyond the zero-days, a few other Criticals worth flagging: remote code execution bugs in graphics fonts (CVE-2026-72986, CVE-2026-73018), an IP Helper RCE (CVE-2026-72981), and a batch of Azure vulnerabilities touching AI Language, Cosmos DB, Copilot Studio, and Entra ID.
Out-of-Band Release
Six days after Patch Tuesday, on September 14, Microsoft pushed out eleven separate out-of-band updates covering every supported version of Windows — clients and servers, all the way back to Server 2012. Here’s why:
The original September 8 cumulative update caused three separate regressions serious enough to need an emergency fix rather than waiting for October:
Remote Desktop Services instability — This was the big one. Organizations running RDS saw connections fail after a few minutes, sign-in failures, and in some cases servers hanging entirely at the configuration screen. Management Console and File Explorer would hang along with it. For any business running RDS for remote access, this wasn’t a minor inconvenience — it was an operational outage.
Hyper-V Plan9 share breakage — Linux VMs running on Hyper-V lost access to shared folders on the Windows host through the Plan9 protocol. Shares that were working fine before the update simply stopped appearing, or stopped being accessible, inside the guest.
USB Audio Class 1.0 compatibility issues — Multichannel audio (8-channel, 3D audio modes) started failing on USB audio devices that worked fine in plain stereo, throwing Code 10 errors or producing no output at all.
The RDS and Hyper-V issues are marked Resolved by these out-of-band patches. The audio issue is only marked Mitigated — some multichannel modes are still not fully restored, so if you’re relying on those, don’t assume this update makes you whole.
If you deferred the September 8 update because of the RDS problems, this is the one to deploy instead — it carries both the original security fixes and the regression fixes together. The KB numbers vary by OS version (KB5129194 for Windows 11 26H1, KB5129195 for 24H2/25H2, and so on down through the server versions) — check which build you’re running before you push it out.
Bottom Line
Patch the two zero-days first if you haven’t already — both hand SYSTEM access to anyone already on the box. If you’re running RDS anywhere in your environment, skip straight to the September 14 out-of-band update rather than the original Patch Tuesday release. And if audio quality on USB devices matters to your setup, keep an eye out for a further fix — this one isn’t fully resolved yet.
Sources:
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days — BleepingComputer
KB5129194 (OS Build 28000.2956) Out-of-band — Microsoft Support
Microsoft’s September 2026 Out-of-Band Update — Senserva