)
)
Labor Day celebrates work by not doing any. Microsoft marked the holiday by unloading 973 CVEs the next morning, the largest Patch Tuesday on record, with nearly as many as July and August combined. Of those, 113 are Critical, 58 carry the Exploitation More Likely assessment, and two are confirmed exploited. So much for the long weekend.
To put the number in context, July's 576 CVEs was the all-time record. August's 428 CVEs took second place and confirmed July was a baseline, not a spike. September makes both look modest.
The last three releases are now the three largest Microsoft has ever shipped, and none of this one is padding: every entry is a 2026 CVE, with no republished older bugs inflating the count.
For the full breakdown, listen to Patch [FIX] Tuesday podcast.
CVE-2026-81963 [Exploited]
Windows Update Stack elevation of privilege vulnerability
CVE-2026-81963 (CVSS 7.8/10) tops the list for one reason: Microsoft confirms it's being exploited. On paper it's a 7.8 rated Important, a local bug that needs a low-privilege foothold. The score measures impact. Exploitation Detected measures probability, and that's the number that sets the order.
The flaw is improper link resolution before file access, or link following, plus improper access control in the Windows Update Stack. An authenticated attacker with local access abuses how the update stack follows links and ends up with SYSTEM privileges.
Local privilege escalation is easy to underrate because the attacker has to be on the box already. But that's the wrong way to read it. Bugs like this are step two in a ransomware chain: phish one user, escalate to SYSTEM, then move. The component makes it worse. An attacker who owns the update stack owns the thing you'd use to evict them.
How attackers may exploit this vulnerability
An attacker with a local foothold abuses the update stack's link resolution or access-control handling.
Successful exploitation hands them SYSTEM on the endpoint, and from there the rest of the network is a lateral-movement problem.
What to look out for
Endpoints whose Windows update status is unknown or stale. If you can't say when the update stack last ran, you can't say whether it's patched.
Unexpected SYSTEM-level processes spawned from a standard user's session, especially anything touching update directories or services.
Mitigation guidance
Put this advisory at the front of the queue. The Windows Update Stack entry lists Windows 11 versions 23H2, 24H2, 25H2, and 26H1, plus Windows Server 2025, including Server Core. Windows 10 and older servers aren't affected by this one.
Don't let the 7.8 slow you down. Exploited outranks the score.
CVE-2026-69730 [Critical]
Windows DNS Server remote code execution vulnerability
CVE-2026-69730 (CVSS 9.8/10) is the cleanest network bug in the release. Unauthenticated, no user interaction, Exploitation More Likely, and a use-after-free in Windows DNS Server. No file to open, no prompt to approve. The packet arrives and the code runs.
Where that host sits is what matters. Microsoft installs DNS on every domain controller by default and recommends keeping it there, so for most on-premises shops this is code execution on the box that answers name lookups and hands out authentication tickets.
Microsoft lists Windows Server 2012 through 2025, including Server Core, plus Windows 10 versions 1607 and 1809. Windows 11 isn't on the list.
CVE-2026-69676, an 8.8 Critical Kerberos remote code execution rated Exploitation More Likely, ships in the same release. It needs an authenticated low-privilege attacker, and Microsoft doesn't chain it to the DNS bug. It's still a second reason to patch your domain controllers this week.
How attackers may exploit this vulnerability
An unauthenticated attacker sends a crafted packet to any Windows DNS server it can reach and gets code execution on it.
What to look out for
Windows DNS servers that share a host with Active Directory. They're the highest-value targets in the release.
DNS servers reachable from user networks, remote-access networks, or the public internet. Check what can actually talk to port 53, not what the diagram says.
Mitigation guidance
Patch DNS servers that also run Active Directory first. Pull the maintenance window forward if you have to.
Restrict who can reach DNS while the update rolls out. Network restrictions narrow the blast radius. Only the patch removes the bug.
Include internal DNS servers in the same verification pass as public-facing ones.
CVE-2026-69525 [Important]
Remote Desktop Services remote code execution vulnerability
CVE-2026-69525 is a 9.8 rated Important. No privileges, no user interaction, use after free, Exploitation More Likely. Microsoft describes this vulnerability an in-network attacker calling arbitrary service endpoints to achieve remote code execution.
How attackers may exploit this vulnerability
An attacker who can reach Remote Desktop Services on the network sends crafted requests to its endpoints.
Successful exploitation is code execution on the host with no authentication and no one clicking anything.
What to look out for
Remote Desktop Services exposed to networks that have no business connecting to it. Scan from the inside as well as the outside. The VLAN diagram is a statement of intent, not a finding.
Windows endpoints that missed this update because their Important-rated patches sit in a slower ring.
Mitigation guidance
Sort by who can reach the service. A host any workstation can hit gets patched tonight. One locked to admin jump boxes can wait for the window.
Limit RDP to approved paths and accounts while the patch rolls out, and audit the VPN accounts that would get an attacker inside.
Verify update status on workstations and servers both. This is a client bug as much as a server bug.
CVE-2026-65669 [Critical]
Microsoft SQL Server elevation of privilege vulnerability
CVE-2026-65669 (CVSS 9.6/10) is the month's AI security story. The bug lives in SQL Copilot inside SQL Server Management Studio 22. An attacker convinces a user to submit crafted instructions to the assistant.
The assistant bypasses its read-only restrictions, and database data gets read or modified with the connected user's permissions. User interaction is required, and Microsoft rates exploitation as less likely.
The flaw doesn't grant new permissions. It exposes the ones the connected account already has. If you sign in with an account that can write and expect Copilot to only read, the assistant's guardrail is the only thing between a pasted prompt and a write.
That's a prompt-injection problem wearing a CVE number.
How attackers may exploit this vulnerability
An attacker gets a user to submit crafted instructions to SQL Copilot in Management Studio.
The assistant bypasses its read-only restrictions and reads or modifies data with whatever permissions the connected account holds.
What to look out for
Copilot sessions running under accounts with more database access than the task needs.
Writes or other unexpected actions in audit records during work that was supposed to be read-only.
Mitigation guidance
Inventory Management Studio 22 separately. It's the affected product, not the database engine, and a patched SQL Server says nothing about the build on an analyst's laptop.
Give the accounts used with Copilot read-only database permissions.
CVE-2026-78509 [Critical]
Microsoft Office Outlook remote code execution vulnerability
CVE-2026-78509 (CVSS 9.8/10) fires when Outlook displays a crafted email in the Reading Pane. The recipient doesn't open the message and doesn't click anything in it. Microsoft calls it a heap-based buffer overflow and rates exploitation as less likely. The advisory doesn't explain the rating, and with a zero-interaction trigger, "less likely" is not a reason to wait.
The everyday version of this attack is unpleasant. Some Outlook views load the top message in the Reading Pane the moment the client opens. If the crafted email lands in the inbox instead of junk, the user's first action of the morning is the exploit. The affected list is Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021 and 2024, Word 2016, and Office for Mac, both the Microsoft 365 build and LTSC 2021 and 2024. Microsoft says the LTSC for Mac fixes aren't available yet and will arrive as a revision to the advisory, so Mac fleets on LTSC are waiting on Microsoft. The first entry is the one to notice.
A Microsoft 365 subscription doesn't mean the fix happens on Microsoft's servers. These are installed applications with their own update state, and the advisory marks customer action as required.
Microsoft 365 Apps updates don't ship through Windows Update. They arrive as new builds from the Office CDN on the schedule your update channel sets, and the installer can't apply one while an Office program is open. A downloaded update sits idle until Outlook closes. Downloaded isn't patched.
How attackers may exploit this vulnerability
An attacker sends a crafted email to a user running an affected Outlook build.
Outlook renders the message in the Reading Pane and the buffer overflow executes code. No open, no click, no attachment.
What to look out for
Office installations that lag the current security build while the same endpoints report as fully patched on Windows.
Downloaded Office updates waiting on an application close. That state can persist for days on a machine that never restarts.
Mitigation guidance
Verify the installed Microsoft 365 Apps build directly. Windows patch status doesn't report it.
Set an update deadline in your Office update policy. Past the deadline, Office closes open programs and applies the update, and users get notified in advance.
macOS: image processing, kernel, and WebKit fixes
Apple released macOS Tahoe 26.6.2 on August 17. The fixes cover ImageIO, the kernel, and WebKit. The impacts include code execution from a crafted image, kernel memory disclosure and corruption, and memory corruption from crafted web content. Apple credits OpenAI Codex Security on a run of the WebKit entries.
Push 26.6.2 across the Mac fleet, and for fleets on more than one macOS line, Apple's security release list is the index by version.
Patch regularly, patch often
Start with your inventory, not the list. 973 CVEs only matter where the affected software runs, so find out what you actually have.
A month like this is what full-flex endpoint management is for. Automox defines it in three verbs: it ingests, it commands, it fixes. Ingest means one inventory that already knows what's installed on every endpoint, across operating systems and the applications that update on their own schedule, so the questions above have answers before you ask them. Command means your patch order becomes policy, with restarts enforced and deadlines set, whether the instruction comes from the console or from your AI assistant through the MCP server. Fix means one agent covers Windows, macOS, and Linux without on-premises infrastructure, and Worklets close the gap when a patch isn't there yet. Automox customers can employ Worklets in the catalog for that; everyone else can run the Automox Community Worklets without a subscription.
Patch the two exploited bugs first. Then work down your list, not Microsoft's.
Sources
Microsoft Security Response Center – September 2026 Security Updates – Full list of September 2026 Patch Tuesday advisories, CVSS scores, and exploitation status
CISA – Known Exploited Vulnerabilities Catalog – Authoritative tracker for actively exploited CVEs
Microsoft – Overview of the update process for Microsoft 365 Apps – Office CDN delivery, update channels, application closures, and installation deadlines
Apple – About the security content of macOS Tahoe 26.6.2 – August 17 release, affected components, and researcher acknowledgements
Apple – Apple security releases – Index of published security updates by OS version
)
)