Microsoft Patch Tuesday – September 2026

⚡ TL;DR | Go Straight to the September 2026 Patch Tuesday Audit Report

Patch Tuesday is once again upon us. As always, our team has put together the monthly Patch Tuesday Report to help you manage your update progress. The audit report gives you a quick and clear overview of your Windows machines and their patching status. The September 2026 edition of Patch Tuesday brings us 973 fixes, with 113 rated as critical. We’ve listed the most important changes below.

Windows Update Stack Privilege Escalation Vulnerability

CVE-2026-81963 is an elevation of privilege flaw in the Windows Update Stack, caused by improper link resolution before file access combined with weak access control. In practice that means the update stack follows a symbolic link or junction it should have refused, and writes where the attacker wants it to write rather than where Windows intended.

Exploitation happens locally and requires an attacker who already holds low privileges on the device, with no user interaction needed. The payoff is high confidentiality, integrity and availability impact, which puts it at CVSS 7.8. Microsoft has confirmed active exploitation in the wild, so treat it as post-compromise privilege escalation that attackers are already chaining onto whatever initial foothold they have.

Windows ALPC Privilege Escalation Vulnerability

CVE-2026-85880 is the second flaw Microsoft flags as actively exploited this month. It sits in Windows Advanced Local Procedure Call, the internal messaging layer that Windows components use to talk to each other, and stems from a heap-based buffer overflow alongside use of an uninitialized resource.

An authorized attacker with low privileges can trigger the overflow locally and escalate, again with no user interaction required and again scoring CVSS 7.8. ALPC is a long standing favorite for local escalation because so much of the operating system talks through it, and this one affects a broad set of supported versions rather than a single edition. Combined with the Windows Update Stack flaw above, September gives attackers two confirmed working routes from a low privileged user to full control of the host.

Windows DNS Server Remote Code Execution Vulnerability

CVE-2026-69730 is a critical use after free condition in Windows DNS that allows an unauthenticated attacker to execute code over the network. There are no privileges required, no user interaction, and low attack complexity, which lands it at CVSS 9.8 and earns Microsoft’s “Exploitation More Likely” assessment.

The reason to prioritize this one above the other 9.8s in the list is where it lives. A DNS server is reachable by design, usually sits on a domain controller, and answering untrusted queries is its entire job. Code execution in that context is code execution in the middle of your identity infrastructure. Nothing is confirmed exploited yet, but a network reachable pre-authentication RCE in DNS is exactly the shape of bug that gets weaponized quickly, so patch domain controllers and any internet facing resolvers first.

Run the Patch Tuesday September 2026 Audit

To help manage your update progress, we’ve created the Patch Tuesday Audit that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.

The Lansweeper Patch Tuesday dashboard is available in our marketplace and is automatically kept up-to-date. Lansweeper Sites is included in all our licenses without any additional cost and allows you to federate all your installations into one single view so all you need to do is look at one dashboard, automatically updated.

Patch Tuesday September 2026 CVE Codes & Titles