Two exploited Windows flaws lead Microsoft September patch priorities

Microsoft has released its September 2026 security updates across a wide range of client, server and productivity products, including fixes for two Windows privilege-escalation vulnerabilities that the company identifies as exploited. For security teams facing a substantial testing and deployment workload, those two flaws provide the clearest starting point.

The size of the 8 September release is not yet fully reconciled. Forbes and SecPod report 973 vulnerabilities, Tenable counts 964 CVEs, while Rapid7 reports 974 Microsoft own-product vulnerabilities and a total of 999 items when 25 non-Microsoft CVEs are included. The Critical totals also differ: Forbes reports 119, SecPod 113 and Tenable 104. The available research does not establish whether scope, revisions or another counting difference explains the variation. Those figures should not be read as a one-to-one count of customer-installed patches; the full deployment matrix was not extracted, and some cloud or service-side remediations may not require customer action.

Exploited flaws require an existing foothold

The first exploited issue, CVE-2026-81963, is a link-following weakness in the Windows Update Stack. Microsoft rates it Important with a CVSS score of 7.8 and says an authorised local attacker could use it to obtain SYSTEM privileges.

CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call, or ALPC. It carries the same Important rating and 7.8 score, and can also allow an authorised local attacker to reach SYSTEM privileges.

Although they lead to the same privilege outcome, the flaws do not share a root cause. The broader release likewise spans numerous weakness classes and products, rather than one systemic defect.

These are post-compromise opportunities rather than unauthenticated entry points. An attacker would need authorised local access or an existing foothold before attempting to elevate privileges. Even so, Microsoft’s exploitation designation makes them more urgent than their severity labels or CVSS scores alone might suggest.

No independent details were available about the exploitation activity. Microsoft has not publicly attributed it to a named actor or campaign, and the available material does not identify targets, victims, tooling or scale. Public proof-of-concept availability is also unknown.

DNS, Kerberos and Exchange remain high priorities

The confirmed exploitation findings should remain separate from other technically serious vulnerabilities in the release. Tenable, drawing on Microsoft’s advisory, highlighted CVE-2026-69730, a use-after-free flaw in Windows DNS Server through which an unauthenticated remote attacker may achieve code execution. It is rated Critical at 9.8 and reportedly assessed by Microsoft as more likely to be exploited, but exploitation has not been detected.

Tenable also highlighted CVE-2026-69676 in Windows Kerberos. The Critical vulnerability, scored 8.8, involves an authentication-bypass weakness that may permit remote code execution to an attacker with low-level access. It is reportedly assessed as more likely to be exploited, rather than known to be under attack.

Microsoft Exchange Server administrators must also assess CVE-2026-69380, an Important vulnerability with a score of 8.1. Missing authorisation could allow an authenticated, low-privilege mailbox user to access and act through other mailboxes. That describes the flaw’s potential capability, not evidence that mailbox data has been accessed in an incident.

Updates span client, server and productivity estates

Microsoft’s monthly summary assigns a maximum severity of Critical and remote-code-execution impact to Windows 11 v23H2, v24H2, v25H2 and v26H1; Windows Server 2016, 2019, 2022 and 2025; and Microsoft Office. SharePoint and Exchange have a maximum severity of Important and a maximum impact of remote code execution.

Available Windows packages include KB5124012 for Windows 11 v26H1, KB5124008 for v25H2 and v24H2, and KB5122880 for v23H2. Server packages are KB5122871 for Windows Server 2025, KB5122882 for Server 2022, KB5122876 for Server 2019 and KB5123099 for Server 2016.

For Windows 10 21H2 and 22H2, Microsoft published KB5122878, listing OS builds 19044.7725 and 19045.7725. Microsoft’s summary also links product-specific Office, SharePoint and Exchange updates, although exact fixed builds were not established in the available material.

Those package references do not mean every September vulnerability affects every listed product or version. Administrators should use each CVE’s live Microsoft Security Response Center record to establish OS, build and component applicability.

Prioritisation should extend beyond CVSS scores

A defensible deployment order begins with CVE-2026-81963 and CVE-2026-85880 because Microsoft has detected exploitation. Teams can then rank the remaining work according to service exposure, required attacker access, potential privilege, asset value and business criticality. That puts exposed or high-value DNS, Kerberos and Exchange systems near the front of the queue even without reported exploitation.

Organisations can then test and deploy the remaining applicable updates through their normal change-management processes. This risk-based approach avoids allowing the disputed headline count, or a simple sort by CVSS score, to obscure the smaller set of vulnerabilities with the strongest combination of exploitation evidence and operational exposure.

Microsoft said in May that increased reporting, broader researcher participation, maturing automation and AI-assisted analysis were contributing to larger security releases. That is the vendor’s explanation for the trend, rather than independently established proof that any one factor caused the scale of September’s release.

Australian organisations running the affected Microsoft products face the same global remediation workload. No Australia-specific exploitation, victims or government advisory were established, so the local relevance is operational rather than evidence of a domestic incident.

Several points still require confirmation: the latest Microsoft CVE and Critical totals, whether CISA has officially added both exploited flaws to its Known Exploited Vulnerabilities catalogue, and any product-specific deployment issues. Until those gaps are resolved, Microsoft’s live Security Update Guide remains the authoritative source for exact applicability and update selection.

Effective patch triage weighs attacker access, potential privilege and service exposure instead of treating every score or headline total alike. Through The Hack Academy’s online cybersecurity training programme, readers can study cybersecurity fundamentals and networking at their own pace, using practical exercises alongside theory.