September 2026 Microsoft Patch Tuesday: What to Prioritize

Microsoft’s September 2026 security release presents defenders with a large triage problem: 973 vulnerabilities across Microsoft products, including 113 classified by Microsoft as critical. Cisco Talos’ analysis identifies two vulnerabilities already exploited in the wild, a further group Microsoft considers more likely to be exploited, and network detection coverage for selected exploitation attempts through Snort.

The volume alone is not a sufficient basis for prioritization. Organizations should first identify whether affected services are deployed, exposed, or business-critical, then combine Microsoft’s exploitation assessments with the consequences of successful exploitation. Internet-facing infrastructure, identity services, remote-access components, and systems that can provide a path to higher privileges deserve particular attention.

Two vulnerabilities are already being exploited

Cisco Talos reports that Microsoft disclosed two vulnerabilities as exploited in the wild. Both are elevation-of-privilege issues with a CVSS base score of 7.8, but their presence in active exploitation places them ahead of vulnerabilities that have only been assessed as potentially attractive to attackers.

• CVE-2026-81963 affects the Windows Update Stack. Microsoft associates it with improper link resolution before file access, also described as link following, and improper access control.
• CVE-2026-85880 affects Windows Advanced Local Procedure Call, or ALPC. The reported weaknesses are a heap-based buffer overflow and use of an uninitialized resource.

The supplied research does not describe the attackers, victims, exploit method, delivery mechanism, or post-exploitation activity associated with either vulnerability. Those details should not be inferred from the fact that exploitation has been observed. For defenders, however, the operational conclusion is clear: determine exposure and complete the relevant Microsoft updates as an urgent task, while monitoring affected systems for suspicious activity that cannot be explained by normal administration.

Remote-code-execution priorities across infrastructure

Microsoft considers several vulnerabilities more likely to be exploited. This is a Microsoft assessment, not a report that exploitation has been confirmed for every listed issue. Even so, the combination of service exposure and potential impact makes several of these flaws especially important for infrastructure teams.

CVE-2026-69730 affects Windows DNS Server and carries a CVSS score of 9.8. DNS servers are commonly central, continuously available infrastructure, so organizations should establish which systems perform DNS service and whether they are reachable from untrusted networks. Cisco Talos also lists two additional Windows DNS Server issues, CVE-2026-69813 and CVE-2026-77505, both remote-code-execution vulnerabilities with CVSS scores of 8.1.

CVE-2026-69852 affects Windows Routing and Remote Access Service and is a heap-based buffer-overflow vulnerability with a CVSS score of 7.5. RRAS systems can occupy a sensitive position at network boundaries. The same service is also affected by CVE-2026-69590, scored 9.8, and CVE-2026-72959, scored 8.8; Microsoft places those two in its less-likely-to-be-exploited category. The difference in assessment should inform urgency, but it should not override actual exposure in an organization’s environment.

CVE-2026-72957 affects Windows Deployment Services and is a heap-based buffer-overflow RCE vulnerability with a CVSS score of 7.8. Cisco Talos also notes CVE-2026-72954 in the same product area, with a CVSS score of 7.5, but Microsoft considers that issue less likely to be exploited.

Other notable vulnerabilities assessed as more likely to be exploited include:

• CVE-2026-69676 in Windows Kerberos, an RCE issue associated with authentication bypass by capture-replay, with a CVSS score of 8.8.
• CVE-2026-70585 in the Windows Services for NFS ONCRPC XDR Driver, a use-after-free RCE vulnerability scored 7.0.
• CVE-2026-69854 in Spring Cloud Azure, an elevation-of-privilege issue associated with improper authentication, scored 9.0.
• CVE-2026-83501 in Windows Virtualization-Based Security, an information-disclosure issue involving an out-of-bounds read, scored 5.5.
• CVE-2026-69857 in Azure Cosmos DB, a spoofing vulnerability involving authorization bypass through a user-controlled key, scored 8.5.

The cloud and identity-related issues require a different exposure assessment from endpoint flaws. Teams should review affected tenants, services, and application configurations rather than assuming that traditional workstation patching will address them.

Critical does not always mean equally urgent

The September release contains 113 critical vulnerabilities, 82 of which are RCE vulnerabilities. Cisco Talos highlights a broad set of additional issues that Microsoft considers less likely to be exploited, including flaws in Windows DHCP Server, Microsoft SQL Server, Windows Imaging Component, Windows Secure Kernel Mode, Windows SSTP, Microsoft Office, Outlook, Word, Excel, Remote Desktop, Failover Cluster, and other components.

Several have high CVSS scores despite the lower exploitation assessment. Examples include the two Windows DHCP Server issues CVE-2026-69845 and CVE-2026-72979, both scored 9.8, and CVE-2026-72983 in Internet Connection Sharing, also scored 9.8. High scores describe severity under the CVSS model; they do not establish active exploitation or indicate that every environment faces the same practical risk.

Microsoft also identifies critical vulnerabilities in Entra ID and other cloud services. These include CVE-2026-62916 and CVE-2026-83941 in Entra ID, CVE-2026-65818 in Power Automate, CVE-2026-80098 in Copilot Studio, CVE-2026-83711 in Azure Active Directory B2C, and CVE-2026-70352 in Azure AI Language. Their reported categories include elevation of privilege, authorization bypass, server-side request forgery, and missing authentication for a critical function. The supplied research does not state whether customer action, service-side remediation, or a particular configuration change is required for each cloud issue. Administrators should therefore consult Microsoft’s update documentation and service-specific guidance before deciding that no action is needed.

Turning Snort coverage into useful detection

Cisco Talos released Snort rules intended to detect attempts to exploit some of the September vulnerabilities. The organization cautions that more rules may be added and that existing coverage may change as further information becomes available. The reported Snort 2 coverage is SIDs 67011–67032 and 67036–67084. Snort 3 coverage is SIDs 301619–301629, 301632–301655, and 67046.

For Cisco Secure Firewall deployments, Talos directs customers to obtain the latest ruleset update through an SRU update. Open-source Snort Subscriber Ruleset users are directed to obtain the latest available rule pack from Snort.org. These statements describe how Talos says its coverage is distributed; they do not mean that every vulnerability in the bulletin is detectable through the listed rules.

Network rules should be treated as one layer of visibility, not as a substitute for remediation. They may identify exploit attempts that traverse monitored network paths, but they cannot reliably expose attacks delivered locally, through encrypted traffic that is not inspected, through unmanaged routes, or against systems outside the sensor’s visibility. Alert context should be correlated with endpoint telemetry, authentication logs, DNS activity, service logs, and asset ownership.

Security teams should first map each SID to the relevant vulnerability and affected product in their own rule-management system. They should then validate that the rules are enabled, receiving events, and generating actionable alerts rather than being silently disabled because of performance or false-positive concerns. Any validation should occur using authorized defensive testing and existing vendor documentation, not by attempting to exploit production systems.

What organizations should do now

1. Identify exposure. Inventory Windows DNS Server, RRAS, Windows Deployment Services, Kerberos-related infrastructure, NFS services, ALPC-relevant endpoints, Windows Update components, and affected cloud services. Include systems managed by subsidiaries, contractors, and MSPs.
2. Prioritize the two exploited vulnerabilities. Confirm the update state for CVE-2026-81963 and CVE-2026-85880. Investigate unusual privilege changes, unexpected administrative activity, and anomalous process or service behavior on systems that remain unpatched.
3. Prioritize exposed and identity-adjacent services. Review internet-facing DNS, RRAS, deployment, remote-access, and authentication infrastructure before applying a simple CVSS-only queue.
4. Deploy and verify updates. Use staged deployment where operational risk requires it, but set a firm completion deadline. Verify installation through the organization’s endpoint and vulnerability-management tooling rather than relying only on change records.
5. Apply temporary controls where patching is delayed. Reduce unnecessary exposure, restrict administrative access, segment infrastructure roles, and disable services that are not required for business operations. These are general defensive measures, not source-reported workarounds for any specific CVE.
6. Operationalize Snort coverage. Update the relevant ruleset, confirm the reported SIDs are active, and route alerts to personnel who can investigate the affected assets. Record which network paths are and are not monitored.
7. Hunt with context. Review endpoint, identity, service, and firewall telemetry for activity around vulnerable systems. Treat the absence of a Snort alert as inconclusive when traffic is encrypted, local, or outside sensor coverage.
8. Coordinate with cloud owners and providers. For Entra ID, Power Automate, Copilot Studio, Azure Active Directory B2C, Azure AI Language, Fabric, Cosmos DB, and other cloud services, confirm the applicable service status and customer responsibilities in Microsoft’s documentation.

Conclusion

September 2026 is a substantial Microsoft update cycle, but its most defensible priority order is not simply “patch the highest CVSS scores first.” The two vulnerabilities reported as exploited in the wild should lead remediation, followed by likely-to-be-exploited flaws affecting exposed infrastructure, identity services, and remote-access components. Snort coverage can improve visibility into selected network-based exploitation attempts, provided teams understand its scope and limitations. The research does not identify specific victims, threat actors, malware, or complete attack chains, so organizations should avoid filling those gaps with assumptions and focus on exposure reduction, verified patching, and evidence-based monitoring.

Sources

Cisco Talos: Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities