Microsoft's security release of 8 September 2026
Patch Tuesday, September 2026
As of , CISA lists two of the 965 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-85880, Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2026-85880Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege. Listed by CISA on 8 September 2026, release day
- CVE-2026-81963Windows Update Stack Elevation of Privilege. Listed by CISA on 8 September 2026, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 965 CVEs |
| On CISA's list of exploited vulnerabilities | 2 CVEs |
| CISA's SSVC exploitation: active | 2 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 963 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 43 CVEs |
| EPSS 0.10 or more | none |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2026-85880Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.04 |
| 2 | CVE-2026-81963Windows Update Stack Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.00 |
| 3 | CVE-2026-69694Windows IP Address Management (IPAM) Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.03 |
| 4 | CVE-2026-65772Microsoft Dynamics 365 On-Premises Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 5 | CVE-2026-77484Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 6 | CVE-2026-83941Entra ID Elevation of Privilege | None | Not on CISA's list | 9.9 Critical | 0.01 |
| 7 | CVE-2026-66302Skype for Business Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 8 | CVE-2026-67631Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 9 | CVE-2026-67643Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 10 | CVE-2026-68839Windows USB Mass Storage Class Driver Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 11 | CVE-2026-69276Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 12 | CVE-2026-69408Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 13 | CVE-2026-69431Telnet Client Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 14 | CVE-2026-69463Windows NTFS Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 15 | CVE-2026-69491Microsoft DirectMusic Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 16 | CVE-2026-69493Windows Event Logging Service Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 17 | CVE-2026-69496Windows Compressed Folder Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 18 | CVE-2026-69525Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 19 | CVE-2026-69579Windows Message Queuing Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 20 | CVE-2026-69586Microsoft Windows PDF Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 21 | CVE-2026-69590Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 22 | CVE-2026-69595Windows Services for NFS ONCRPC XDR Driver Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 23 | CVE-2026-69715Windows Direct Show Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 24 | CVE-2026-69730Windows DNS Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 25 | CVE-2026-69768Windows RNDIS Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 26 | CVE-2026-69769Windows HTTP Print Provider Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 27 | CVE-2026-69819RPC Runtime Library Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 28 | CVE-2026-69824Microsoft Standard XPS Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 29 | CVE-2026-69829Windows Shell Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 30 | CVE-2026-69845Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 31 | CVE-2026-69910Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 32 | CVE-2026-70296Windows Imaging Component Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 33 | CVE-2026-72979Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 34 | CVE-2026-72982Windows Netlogon Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 35 | CVE-2026-72983Internet Connection Sharing (ICS) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 36 | CVE-2026-73009Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 37 | CVE-2026-73010Microsoft Failover Cluster Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 38 | CVE-2026-73025Windows iSCSI Security Feature Bypass | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 39 | CVE-2026-77493Windows Graphics Component Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 40 | CVE-2026-78445Windows Services for NFS ONCRPC XDR Driver Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 41 | CVE-2026-78509Microsoft Office Outlook Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 42 | CVE-2026-65669Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 9.6 Critical | 0.01 |
| 43 | CVE-2026-81376Visual Studio Code Security Feature Bypass | None | Not on CISA's list | 9.6 Critical | 0.01 |
| 44 | CVE-2026-69356Microsoft Exchange Server Spoofing | None | Not on CISA's list | 9.3 Critical | 0.01 |
| 45 | CVE-2026-69641Microsoft Exchange Server Elevation of Privilege | None | Not on CISA's list | 9.1 Critical | 0.01 |
| 46 | CVE-2026-67378Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 9.0 Critical | 0.01 |
| 47 | CVE-2026-67636Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 9.0 Critical | 0.01 |
| 48 | CVE-2026-69854Spring Cloud Azure Elevation of Privilege | None | Not on CISA's list | 9.0 Critical | 0.01 |
| 49 | CVE-2026-62706Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 50 | CVE-2026-62744Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 51 | CVE-2026-62895Azure Arc SQL Server Extension Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 52 | CVE-2026-66814Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 53 | CVE-2026-66818Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 54 | CVE-2026-66819Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 55 | CVE-2026-66820SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 56 | CVE-2026-67368Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 57 | CVE-2026-67370Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 58 | CVE-2026-67373Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 59 | CVE-2026-67380Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 60 | CVE-2026-67381Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 61 | CVE-2026-67384Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 62 | CVE-2026-67385Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 63 | CVE-2026-67388Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 64 | CVE-2026-67638Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 65 | CVE-2026-67639Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 66 | CVE-2026-67642Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 67 | CVE-2026-68775Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 68 | CVE-2026-68786Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 69 | CVE-2026-68828Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 70 | CVE-2026-69266Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 71 | CVE-2026-69268Microsoft Office SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 72 | CVE-2026-69273Microsoft Office SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 73 | CVE-2026-69282Microsoft Office SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 74 | CVE-2026-69285Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 75 | CVE-2026-69291Windows Volume Manager Extension Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 76 | CVE-2026-69334Windows Volume Manager Extension Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 77 | CVE-2026-69355Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 78 | CVE-2026-69360Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 79 | CVE-2026-69386Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 80 | CVE-2026-69434Windows URL Moniker Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 81 | CVE-2026-69439.NET and Visual Studio Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 82 | CVE-2026-69442Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 83 | CVE-2026-69461Windows NTFS Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 84 | CVE-2026-69464Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 85 | CVE-2026-69465Microsoft Office SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 86 | CVE-2026-69485Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 87 | CVE-2026-69494Windows Event Logging Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 88 | CVE-2026-69495Windows Event Logging Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 89 | CVE-2026-69499Windows Imaging Component Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 90 | CVE-2026-69511Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 91 | CVE-2026-69518Windows Remote Desktop Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 92 | CVE-2026-69522.NET and Visual Studio Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 93 | CVE-2026-69529Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 94 | CVE-2026-69547Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 95 | CVE-2026-69551Windows DNS Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 96 | CVE-2026-69556Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 97 | CVE-2026-69598Windows iSCSI Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 98 | CVE-2026-69601Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 99 | CVE-2026-69614Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 100 | CVE-2026-69628Windows iSCSI Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 8 September 2026, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.