Microsoft's security release of 8 September 2026
Patch Tuesday, September 2026, page 5
As of , CISA lists two of the 965 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-85880, Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege.
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 401 | CVE-2026-72974Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 402 | CVE-2026-72975Microsoft Office PowerPoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 403 | CVE-2026-72977Microsoft Office PowerPoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 404 | CVE-2026-73029Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 405 | CVE-2026-77896Windows Remote Desktop Client Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 406 | CVE-2026-77911Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 407 | CVE-2026-78441Windows OLE DB Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 408 | CVE-2026-78453Microsoft Windows SCSI Class System File Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 409 | CVE-2026-78502Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 410 | CVE-2026-78503Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 411 | CVE-2026-78515Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 412 | CVE-2026-78520Microsoft Office Outlook Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 413 | CVE-2026-78522Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 414 | CVE-2026-80073Microsoft Office Outlook Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 415 | CVE-2026-80076Microsoft Office Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 416 | CVE-2026-80078Microsoft Office Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 417 | CVE-2026-80079Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 418 | CVE-2026-80082Microsoft Office Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 419 | CVE-2026-80084Microsoft Office Outlook Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 420 | CVE-2026-80086Microsoft Office PowerPoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 421 | CVE-2026-80087Microsoft Office Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 422 | CVE-2026-80088Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 423 | CVE-2026-80089Microsoft Office Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 424 | CVE-2026-80090Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 425 | CVE-2026-80091Microsoft Office Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 426 | CVE-2026-81377Visual Studio Code Tampering | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 427 | CVE-2026-81381GitHub Copilot and Visual Studio Code Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 428 | CVE-2026-69304ASP.NET Core Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 429 | CVE-2026-69803Windows DHCP Server Information Disclosure | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 430 | CVE-2026-69929Windows DHCP Server Information Disclosure | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 431 | CVE-2026-69930Windows DHCP Server Information Disclosure | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 432 | CVE-2026-70091Windows DNS Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 433 | CVE-2026-70124Windows DHCP Server Information Disclosure | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 434 | CVE-2026-72978Active Directory Federation Services (AD FS) Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 435 | CVE-2026-78523Windows DNS Server Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 436 | CVE-2026-68874Windows Program Compatibility Assistant Service Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 437 | CVE-2026-69317Windows Remote Desktop Client Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 438 | CVE-2026-69349Windows Management Instrumentation Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 439 | CVE-2026-69372Windows Network File System Denial of Service | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 440 | CVE-2026-69393Windows Spaceport.sys Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 441 | CVE-2026-69405Windows DHCP Server Denial of Service | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 442 | CVE-2026-69416Windows DHCP Server Denial of Service | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 443 | CVE-2026-69507Microsoft Windows Search Component Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 444 | CVE-2026-69552Windows Print Spooler Components Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 445 | CVE-2026-69569Windows Print Spooler Components Denial of Service | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 446 | CVE-2026-69572Windows SMB Client Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 447 | CVE-2026-69591Windows NTFS Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 448 | CVE-2026-69637Windows DHCP Server Denial of Service | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 449 | CVE-2026-69679Windows DHCP Server Denial of Service | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 450 | CVE-2026-69723Windows Kernel Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 451 | CVE-2026-68831Windows Defender Firewall Service Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 452 | CVE-2026-78506Microsoft Office Word Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 453 | CVE-2026-78513Microsoft Office PowerPoint Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 454 | CVE-2026-81387Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 455 | CVE-2026-81390Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 456 | CVE-2026-81391Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 457 | CVE-2026-81392Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 458 | CVE-2026-81393Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 459 | CVE-2026-81394Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 460 | CVE-2026-81395Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 461 | CVE-2026-81399Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 462 | CVE-2026-81400Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 463 | CVE-2026-81401Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 464 | CVE-2026-81958Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 465 | CVE-2026-83949Microsoft Office Word Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 466 | CVE-2026-83951Microsoft Office Word Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 467 | CVE-2026-85875Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 468 | CVE-2026-70575Windows Schannel Denial of Service | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 469 | CVE-2026-81380GitHub Copilot and Visual Studio Code Information Disclosure | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 470 | CVE-2026-72976Microsoft Office Word Information Disclosure | None | Not on CISA's list | 5.0 Medium | 0.01 |
| 471 | CVE-2026-68785Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 4.9 Medium | 0.01 |
| 472 | CVE-2026-69474Windows Overlay Filter Information Disclosure | None | Not on CISA's list | 4.8 Medium | 0.01 |
| 473 | CVE-2026-72980Windows Hello Security Feature Bypass | None | Not on CISA's list | 4.4 Medium | 0.01 |
| 474 | CVE-2026-73019Windows URL Moniker Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 475 | CVE-2026-78455Xbox Information Disclosure | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 476 | CVE-2026-78516Windows Storage Information Disclosure | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 477 | CVE-2026-69904Microsoft Office SharePoint Information Disclosure | None | Not on CISA's list | 3.5 Low | 0.01 |
| 478 | CVE-2026-69603Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.00 |
| 479 | CVE-2026-69740Windows Hello Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 480 | CVE-2026-69784Windows Hello Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 481 | CVE-2026-80083Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.00 |
| 482 | CVE-2026-81352Web Media Extensions Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.00 |
| 483 | CVE-2026-83996Windows Error Reporting Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 484 | CVE-2026-80097Microsoft Authenticator Elevation of Privilege | None | Not on CISA's list | 8.6 High | 0.00 |
| 485 | CVE-2026-69479Windows NTFS Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 486 | CVE-2026-69638Windows NTFS Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 487 | CVE-2026-77503Windows NTFS Elevation of Privilege | None | Not on CISA's list | 8.4 High | 0.00 |
| 488 | CVE-2026-78510Microsoft Outlook and Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 489 | CVE-2026-69646Skype for Business Spoofing | None | Not on CISA's list | 8.3 High | 0.00 |
| 490 | CVE-2026-69820Windows Hello Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 491 | CVE-2026-69846Windows Secure Kernel Mode Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 492 | CVE-2026-69874Windows ALPC Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 493 | CVE-2026-69906Windows Secure Kernel Mode Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 494 | CVE-2026-72958Windows Credential Guard Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 495 | CVE-2026-72961Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 496 | CVE-2026-72962Windows USB Video Driver Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 497 | CVE-2026-81354Windows Hello Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 498 | CVE-2026-83939Windows Secure Kernel Mode Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 499 | CVE-2026-69680Windows DNS Spoofing | None | Not on CISA's list | 8.1 High | 0.00 |
| 500 | CVE-2026-56172Windows VHD miniport driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |