Microsoft’s September 2026 Patch Tuesday, released on September 8, is an unusually large release. It includes two zero-days that attackers are already exploiting, and a long list of critical remote code execution bugs in the services Windows Server runs: DNS, DHCP, RRAS, Netlogon, Kerberos, Failover Clustering and SQL Server. If you run Windows servers, this is a month to plan carefully rather than approve everything at once.
The scope of September 2026 Patch Tuesday
Microsoft lists 999 CVEs in its September 2026 release notes. That figure includes cloud-service, Edge and Copilot CVEs added later in the month. Of the Microsoft CVEs published on Patch Tuesday itself, 973 shipped on September 8, and 113 of those are rated Critical. Third-party trackers report between 964 and 974, depending on what they include.
- Elevation of privilege: 438 CVEs
- Remote code execution: 259 CVEs
- Information disclosure: 173 CVEs
- Server-heavy components: SQL Server (61 CVEs), Windows DHCP Server (36), SharePoint (16), Windows DNS (14), Exchange Server (9), Remote Desktop Services (9) and Active Directory Domain Services (6)
Exploited and publicly disclosed vulnerabilities
Microsoft marked two vulnerabilities as “Exploitation Detected.” Neither was publicly disclosed before release. CISA added both to its Known Exploited Vulnerabilities (KEV) catalog on September 8, with a federal remediation deadline of September 22, 2026.
- CVE-2026-81963: Windows Update Stack elevation of privilege (CVSS 7.8). A link-following flaw lets a local, authorized attacker gain SYSTEM privileges. Among server versions, Microsoft lists Windows Server 2025 as affected.
- CVE-2026-85880: Windows ALPC elevation of privilege (CVSS 7.8). This heap-based buffer overflow lets code running in a low-privilege AppContainer escape the sandbox and gain SYSTEM. Affected server versions include Windows Server 2012 through Windows Server 2022.
Both bugs need local access, so attackers use them after they get in, to turn a foothold into full control. On servers, that makes them a priority for any host that runs untrusted code or many interactive users, such as Remote Desktop session hosts, jump boxes and build servers.
Key CVEs for Windows server teams
Many of this month’s highest-scoring bugs are network-reachable and need no authentication or user interaction. These are the ones to watch on servers:
| CVE | Component | Severity / CVSS | Why it matters |
|---|---|---|---|
| CVE-2026-69730 | Windows DNS Server RCE | Critical / 9.8 | Unauthenticated attack using crafted packets; rated Exploitation More Likely |
| CVE-2026-69525 | Remote Desktop Services RCE | Important / 9.8 | No authentication needed; rated Exploitation More Likely |
| CVE-2026-72982 | Windows Netlogon RCE | Critical / 9.8 | Affects domain controllers |
| CVE-2026-69845, CVE-2026-72979 | Windows DHCP Server RCE | Critical / 9.8 | Infrastructure servers |
| CVE-2026-69590 | RRAS RCE | Critical / 9.8 | VPN and edge servers |
| CVE-2026-69579 | Windows Message Queuing RCE | Critical / 9.8 | Only where MSMQ is enabled |
| CVE-2026-73010 | Failover Cluster RCE | Critical / 9.8 | Clustered SQL and file servers |
| CVE-2026-67631, CVE-2026-67643 | SQL Server RCE | Critical / 9.8 | Separate SQL Server GDR/CU packages |
| CVE-2026-69910 | Hyper-V RCE | Important / 9.8 | Virtualization hosts |
| CVE-2026-69676 | Windows Kerberos RCE | Critical / 8.8 | Needs low privileges; rated Exploitation More Likely |
Exchange and SharePoint need their own updates. CVE-2026-55007 lets an unauthenticated attacker send a crafted Visio attachment that Exchange processes during content indexing. Microsoft rates it Important and says exploitation requires sustained low-memory conditions. CVE-2026-69380 is an Exchange elevation of privilege (CVSS 8.1). SharePoint Server receives fixes for 16 CVEs, including several 8.8 remote code execution bugs such as CVE-2026-69268. Active Directory Domain Services also has remote code execution fixes, including CVE-2026-69546.
Servicing stack. The zero-day CVE-2026-81963 is in the Windows Update stack itself. Microsoft’s release notes repeat that the latest servicing stack update matters and point to ADV990001 for the current list. For Windows Server 2016, the September data names KB5122874 as a servicing stack update. Before you deploy the cumulative update, check that the servicing stack prerequisites are in place.
Patching priorities for Windows servers
With nearly a thousand CVEs, the order you patch in matters more than the total. A practical order of operations:
- Exploited first. Deploy the cumulative update that fixes CVE-2026-81963 and CVE-2026-85880. Start with RDS session hosts, jump servers and multi-user systems.
- Exposed network services. Next patch DNS, DHCP, RRAS and VPN servers, internet-facing RDS gateways, and any host with MSMQ or NFS enabled.
- Identity tier. Patch domain controllers for the Netlogon, Kerberos, KDC and AD DS fixes. Do it in waves so that at least one healthy DC stays up in each site.
- Application and data tier. SQL Server, Exchange and SharePoint have their own packages. Schedule them separately from the OS update, and patch cluster nodes one at a time.
- Hyper-V hosts and the rest. Drain and patch virtualization hosts, then patch the remaining server fleet.
Test groups. Keep a small, representative test group for each role: a DC, a DNS/DHCP server, a SQL node, an RDS host and a Hyper-V host. Give it 24–72 hours before broad rollout. Watch for authentication, name-resolution and cluster failover problems. Maintenance windows. Assign every group a window, stagger redundant pairs so that both halves are never down at once, and keep an emergency window ready for zero-days.
Air-gapped and isolated servers
Isolated networks still need this month’s fixes, and copying files across by hand is slow and error-prone. With JetPatch Offline Windows Patching, the JetPatch Manager is the only component that ever reaches Microsoft. Updates are digital-fingerprint verified against Microsoft’s own catalog, and any file that fails verification is quarantined. Isolated servers then patch from a local store without any internet access, and are re-scanned afterwards to confirm the update is installed.
What this means for WSUS
Microsoft has deprecated WSUS. It still ships with Windows Server and still delivers this month’s updates, but it gets no new features. JetPatch works with your existing WSUS, including primary and replica servers and bidirectional group sync. When you are ready, you can patch Windows Server from the JetPatch repository instead and retire the WSUS server on your own schedule. See your WSUS options.
How JetPatch helps
JetPatch Windows patch management runs a month like September from a single console. You can group servers by role, assign maintenance windows and schedules, and validate endpoint readiness before deployment: WUA communication, WSUS connectivity, PowerShell policy, connector health and repository configuration. You can manage exemptions for sensitive hosts and produce compliance reports that show which servers have the September fixes. The same console covers third-party Windows applications, Linux and Unix.
FAQ
How many vulnerabilities did Microsoft fix in September 2026?
Microsoft lists 999 CVEs in its September 2026 release notes. Of those, 973 were published on September 8 and 113 of those are rated Critical. Third-party totals vary between 964 and 974 because each tracker counts differently.
Which September 2026 vulnerabilities are being exploited?
Two: CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows ALPC). Both are elevation of privilege bugs, and CISA added both to the KEV catalog on September 8, 2026.
Which servers should I patch first?
Start with multi-user hosts exposed to the two zero-days. Then patch DNS, DHCP, RRAS and RDS servers, followed by domain controllers. After that, patch SQL Server, Exchange and SharePoint, and finally Hyper-V hosts and the rest of the fleet.
Can I still use WSUS for these updates?
Yes. WSUS is deprecated but still delivers updates. JetPatch can manage patching through your existing WSUS, or patch from the JetPatch repository when you decide to move off it.
Ready to make next Patch Tuesday routine? Request a JetPatch evaluation and see how your Windows servers, connected or air-gapped, can be patched on schedule.
