Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Summary: Microsoft's September 2026 security update covers 973 vulnerabilities across its products, 113 of which it rated critical, with 82 of those critical flaws being remote code execution. Microsoft reports two vulnerabilities exploited in the wild this month: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call, both elevation of privilege flaws with a CVSS base score of 7.8.
Key Takeaway: Two flaws are already being exploited in the wild, and among the flaws Microsoft flags as more likely to be exploited are a Windows DNS Server RCE at CVSS 9.8 (CVE-2026-69730) and a Spring Cloud Azure elevation of privilege at 9.0 (CVE-2026-69854) - a patch backlog this size leaves little room for triage by score alone.

Read the original at Cisco Talos ↗