The September 2026 Microsoft Patch Tuesday release includes fixes for 973 vulnerabilities, with 113 rated critical. Two vulnerabilities, CVE-2026-81963 and CVE-2026-85880, have confirmed exploitation in the wild and are elevation of privilege issues affecting Windows Update Stack and Windows ALPC respectively. Several remote code execution vulnerabilities with high CVSS scores (up to 9.8) affect Windows Kerberos, DNS Server, DHCP Server, and other components. Additional vulnerabilities include elevation of privilege, information disclosure, and spoofing issues across Windows and Azure services. Microsoft categorizes some vulnerabilities as more likely to be exploited and others as less likely. The update is comprehensive and addresses a wide range of attack vectors. No specific affected versions are detailed in the source. The vendor's monthly update is the official remediation.

The vulnerabilities include critical remote code execution, elevation of privilege, information disclosure, and spoofing flaws affecting core Windows components and cloud services. Exploitation could allow attackers to execute arbitrary code, escalate privileges, bypass authentication, or disclose sensitive information. Two vulnerabilities have been exploited in the wild, indicating active threat. The high number of critical vulnerabilities and multiple high CVSS scores (up to 9.8) reflect a significant security risk if unpatched. The broad product impact includes Windows OS components, Azure services, and Microsoft SQL Server, affecting a wide range of environments.

Microsoft has released an official security update addressing these vulnerabilities as part of the September 2026 Patch Tuesday. Applying this update is the primary and recommended mitigation. No additional vendor advisories indicate that no action is required or that issues are already mitigated. Organizations should prioritize deployment of the update to remediate the critical and actively exploited vulnerabilities.