September 2026 Patch Tuesday: a record 972 CVEs, two exploited zero-days, and what to fix first
Volume is not the story. Unauthenticated remote code execution in Netlogon, DNS, DHCP and SSTP, preview-pane Office exploits and Hyper-V guest escapes are. A prioritisation guide for a month that overwhelmed most patch teams.
Microsoft's September 2026 security release addressed 972 vulnerabilities, more than double the August total and a record for a single Patch Tuesday, including 113 rated Critical. Two zero-days were confirmed as exploited in the wild. For most organisations the practical question is not how to deploy 972 fixes this week, but which handful of them cannot wait.
The exploited zero-days
- CVE-2026-81963, Windows Update Stack, CVSS 7.8. A local attacker with low privileges can exploit improper link resolution to reach SYSTEM.
- CVE-2026-85880, Windows Advanced Local Procedure Call, CVSS 7.8. A heap-based buffer overflow allows escape from AppContainer sandboxes to SYSTEM.
Both are local privilege escalations. That does not make them minor. Privilege escalation is the step that turns a phishing click or a compromised web application into domain-wide ransomware, and both of these are already in use.
Network services with unauthenticated remote code execution
Five CVSS 9.8 issues affect services that sit on domain controllers and network edges:
- Netlogon, CVE-2026-72982: domain authentication bypass. Any flaw in Netlogon should be treated as a domain compromise risk.
- DNS Server, CVE-2026-69730: DNS commonly runs on domain controllers, so a DNS exploit is a domain controller exploit.
- DHCP Server, CVE-2026-69845 and CVE-2026-72979: infrastructure-level compromise of a service that touches every client on the network.
- Message Queuing, CVE-2026-69579: legacy MSMQ often runs as SYSTEM on servers nobody remembers.
- SSTP VPN, CVE-2026-73009: edge-facing VPN infrastructure, reachable from the internet by design.
Office: 22 Critical remote code execution flaws
Twelve of the Office issues are exploitable through the Preview Pane or Reading Pane, meaning no click is required beyond receiving and previewing a message. The highest-scoring are CVE-2026-77493, CVE-2026-78510 and CVE-2026-78509, each at CVSS 9.8. Preview-pane exploits bypass the user awareness layer entirely and should be patched with the same urgency as internet-facing services.
Hyper-V guest-to-host escapes
CVE-2026-69603 and CVE-2026-80083 allow a compromised guest to escape to the host and inspect or manipulate memory for all co-resident virtual machines. For hosting providers, VDI estates and any environment that runs untrusted or exposed workloads alongside sensitive ones, these are among the most consequential fixes of the month.
A prioritisation order that works
- Exploited zero-days on every Windows endpoint and server, because they are already being used.
- Domain controllers: Netlogon, DNS and Kerberos-related fixes, tested and deployed within days, not weeks.
- Internet-facing services: SSTP VPN and anything else reachable from outside.
- Office with preview-pane triggers on all user endpoints, prioritising executives, finance and helpdesk.
- Hyper-V hosts in multi-tenant or mixed-trust environments.
- DHCP and MSMQ servers, then the remaining Critical issues by exposure.
For teams that cannot keep up
A release of this size is a stress test for vulnerability management. If deployment will take weeks, compensate in the meantime: restrict RPC and DNS exposure of domain controllers to known networks, disable Preview Pane for high-risk user groups through policy, confirm that EDR coverage includes every domain controller and Hyper-V host, and make sure that detections for Netlogon anomalies and privilege escalation are enabled. Document the plan and the compensating controls; it is the record that insurers and regulators will ask for if something goes wrong before the patches land.
