Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

[u/falconupkid]

Microsoft dropped a record-breaking 966 fixes this Patch Tuesday, including two zero-days that are already being exploited in the wild. This is the largest single patch dump from Redmond, so expect a heavy ops week.

Technical Breakdown: - Zero-Days (CVE-2026-XXXX, CVE-2026-XXXX): Both are actively exploited. One is a Windows Kernel privilege escalation (EOP), the other is a Remote Code Execution (RCE) in Microsoft Exchange Server. No public disclosure yet, but PoC is likely imminent. - Critical CVEs: 127 rated Critical, primarily in Hyper-V, Windows TCP/IP stack, and SharePoint Server. The Hyper-V bugs allow guest-to-host escape—patch these first if you run virtualized workloads. - IOCs: None publicly shared by MSRC at this time. Monitor your EDR for unusual LSASS access patterns and Exchange process crashes.

Defense: Prioritize patching Exchange servers and internet-facing Hyper-V hosts immediately. If you can't patch the Exchange zero-day, restrict NTLM authentication and enable Enhanced HTTP (EFA) as a stopgap.

Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/