Microsoft's security release of 8 September 2026
Patch Tuesday, September 2026, page 4
As of , CISA lists two of the 965 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-85880, Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege.
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 301 | CVE-2026-77498Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 302 | CVE-2026-77499Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 303 | CVE-2026-77501Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 304 | CVE-2026-77502Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 305 | CVE-2026-77886Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 306 | CVE-2026-77888Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 307 | CVE-2026-77889Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 308 | CVE-2026-77890Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 309 | CVE-2026-77893Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 310 | CVE-2026-77895Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 311 | CVE-2026-77898Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 312 | CVE-2026-83989Windows Services for NFS ONCRPC XDR Driver Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 313 | CVE-2026-84001Windows Key Distribution Center Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 314 | CVE-2026-78461Visual Studio Code Security Feature Bypass | None | Not on CISA's list | 7.4 High | 0.01 |
| 315 | CVE-2026-81383Visual Studio Code Information Disclosure | None | Not on CISA's list | 7.4 High | 0.01 |
| 316 | CVE-2026-84003Microsoft Authentication Library (MSAL) for Node.js Spoofing | None | Not on CISA's list | 7.4 High | 0.01 |
| 317 | CVE-2026-81349Azure HDInsight Ambari Elevation of Privilege | None | Not on CISA's list | 7.2 High | 0.01 |
| 318 | CVE-2026-66305Skype for Business Spoofing | None | Not on CISA's list | 7.1 High | 0.01 |
| 319 | CVE-2026-68835Windows Print Spooler Components Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 320 | CVE-2026-68846Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 321 | CVE-2026-68889Microsoft Standard XPS Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 322 | CVE-2026-68893Remote Desktop Licensing Service Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 323 | CVE-2026-69272Microsoft Standard XPS Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 324 | CVE-2026-69274Windows Win32k Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 325 | CVE-2026-69296Windows Device Association Service Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 326 | CVE-2026-69305Microsoft Windows Search Component Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 327 | CVE-2026-69313Microsoft Standard XPS Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 328 | CVE-2026-69314Windows Device Association Broker Service Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 329 | CVE-2026-69336Microsoft Standard XPS Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 330 | CVE-2026-69337Windows Registry Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 331 | CVE-2026-69338Remote Desktop Gateway Service Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 332 | CVE-2026-69340Windows NTFS Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 333 | CVE-2026-69357Windows NDIS Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 334 | CVE-2026-69358Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.1 High | 0.01 |
| 335 | CVE-2026-69366Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 336 | CVE-2026-69396Windows NDIS Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 337 | CVE-2026-69451Windows Management Instrumentation Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 338 | CVE-2026-69460Windows Modern Device Management (MDM) Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 339 | CVE-2026-69536Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 7.1 High | 0.01 |
| 340 | CVE-2026-69597Windows HTTP.sys Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 341 | CVE-2026-69602Windows PrintWorkflowUserSvc Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 342 | CVE-2026-69688Windows Encrypting File System (EFS) Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 343 | CVE-2026-69706Windows Win32k Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 344 | CVE-2026-69757Windows TCP/IP Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 345 | CVE-2026-69761Windows TCP/IP Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 346 | CVE-2026-69775Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 347 | CVE-2026-69806.NET Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 348 | CVE-2026-65812Microsoft Teams for Android Information Disclosure | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 349 | CVE-2026-69415Windows DHCP Server Elevation of Privilege | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 350 | CVE-2026-62762Windows Active Directory Domain Services Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 351 | CVE-2026-62801Microsoft PowerShell Security Feature Bypass | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 352 | CVE-2026-63523Skype for Business Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 353 | CVE-2026-64918Microsoft Office Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 354 | CVE-2026-66303Skype for Business and Lync Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 355 | CVE-2026-66306Skype for Business Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 356 | CVE-2026-66308Skype for Business and Lync Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 357 | CVE-2026-66816Microsoft SQL Server Security Feature Bypass | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 358 | CVE-2026-67369Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 359 | CVE-2026-67383Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 360 | CVE-2026-67386Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 361 | CVE-2026-67389Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 362 | CVE-2026-67390Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 363 | CVE-2026-67393Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 364 | CVE-2026-67624Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 365 | CVE-2026-67629Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 366 | CVE-2026-67630Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 367 | CVE-2026-67633Microsoft SQL Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 368 | CVE-2026-67641Microsoft SQL Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 369 | CVE-2026-67645Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 370 | CVE-2026-67648Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 371 | CVE-2026-68776Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 372 | CVE-2026-68777Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 373 | CVE-2026-68778Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 374 | CVE-2026-68779Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 375 | CVE-2026-68780Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 376 | CVE-2026-68781Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 377 | CVE-2026-68784Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 378 | CVE-2026-68898Windows iSCSI Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 379 | CVE-2026-69297Windows DHCP Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 380 | CVE-2026-69361Microsoft Exchange Server Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 381 | CVE-2026-69374Windows SMB Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 382 | CVE-2026-69375Microsoft Exchange Server Tampering | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 383 | CVE-2026-69395Active Directory Certificate Services (AD CS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 384 | CVE-2026-69409Microsoft Office SharePoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 385 | CVE-2026-69497Windows DHCP Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 386 | CVE-2026-69562Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 387 | CVE-2026-69624Active Directory Certificate Services (AD CS) Tampering | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 388 | CVE-2026-69626Microsoft Office Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 389 | CVE-2026-69636Microsoft Office SharePoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 390 | CVE-2026-69683Microsoft Office SharePoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 391 | CVE-2026-69719Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 392 | CVE-2026-69734Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 393 | CVE-2026-69739Microsoft Office Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 394 | CVE-2026-69781Windows DHCP Client Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 395 | CVE-2026-69839Windows iSCSI Target Service Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 396 | CVE-2026-70019Windows Compressed Folder Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 397 | CVE-2026-72938Microsoft Office PowerPoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 398 | CVE-2026-72939Windows Routing and Remote Access Service (RRAS) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 399 | CVE-2026-72942Windows Spaceport.sys Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 400 | CVE-2026-72956Microsoft Office PowerPoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |