Microsoft Patch Tuesday, September 2026: two exploited Windows flaws lead 938 fixes

The release at a glance

Microsoft's September 2026 Patch Tuesday release covers 938 CVEs in scope for our readers. The severity split is 41 critical, 659 high, 236 medium and 2 low. Two vulnerabilities are already listed in CISA's Known Exploited Vulnerabilities catalog and are being treated as exploited: CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call, and CVE-2026-81963, an improper link resolution issue in the Windows Update Stack. CISA set a due date of 22 September 2026 for both.

Beyond those two, the release carries a large set of critical-rated remote code execution issues, including in Skype for Business Server, SQL Server and several Windows components, as well as a high-severity Outlook remote code execution flaw. The remaining items span Windows, Microsoft 365 Apps, Exchange Server, SharePoint Server, Edge and other products.

What matters most

Two Windows privilege-escalation flaws need attention first. CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC that lets an authorised attacker elevate privileges locally. CVE-2026-81963 is an improper link resolution issue in the Windows Update Stack with the same local privilege-escalation result. Both are in CISA KEV and are marked by Microsoft as exploited, with CISA SSVC showing active exploitation. CISA's due date was 22 September 2026. CVE-2026-85880 affects Windows 10 and Windows Server versions; CVE-2026-81963 affects Windows 11 version 23H2 and later, plus Windows Server 2025.

Microsoft Office Outlook has CVE-2026-70125, a network-accessible remote code execution flaw rated 8.8 high. It requires user interaction, is not in KEV and is not marked exploited. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.

Skype for Business Server has CVE-2026-66302, a critical 9.8 remote code execution flaw caused by external control of a file name or path. It is reachable over a network with no credentials and no user interaction, but is not exploited at present. Affected versions include Skype for Business Server 2015 CU13, 2019 CU8 and Subscription Edition CU1.

SQL Server has two critical 9.8 heap-based buffer overflow remote code execution flaws. CVE-2026-67631 affects SQL Server 2017, 2019, 2022 and 2025 across CU and GDR channels. CVE-2026-67643 affects SQL Server 2022 and 2025. Neither is listed as exploited.

Windows components also carry critical network-accessible issues. CVE-2026-68839 is a heap-based buffer overflow in the USB Mass Storage Class Driver rated 9.8. CVE-2026-69276 is an integer underflow in the UxTheme library rated 9.8. Neither is listed as exploited.

Patch in this order

1. Apply the exploited Windows fixes first: CVE-2026-85880 and CVE-2026-81963. Both carry a CISA KEV due date of 22 September 2026 and are marked exploited by Microsoft and CISA SSVC. For CVE-2026-81963, apply Windows 11 build 10.0.22631.7582 (23H2), 10.0.26100.9445 (24H2), 10.0.26200.9445 (25H2), 10.0.28000.2954 (26H1) or Windows Server 2025 10.0.26100.33438. For CVE-2026-85880, use the corresponding Windows servicing update; fixed builds include Windows 10 22H2 10.0.19045.7725 and Windows Server 2022 10.0.20348.5622.

1. Patch Skype for Business Server next: CVE-2026-66302 is a 9.8 critical network RCE with no authentication or user interaction. Fixed builds are 6.0.9319.885 (2015 CU13), 7.0.2046.569 (2019 CU8) and 7.0.2046.879 (Subscription Edition CU1).

1. Patch SQL Server. CVE-2026-67631 and CVE-2026-67643 are both 9.8 critical RCEs. For CVE-2026-67631, fixed builds include SQL Server 2017 CU 31 14.0.3550.4 or GDR 14.0.2130.4; 2019 CU 32 15.0.4490.9 or GDR 15.0.2190.7; 2022 CU 26 16.0.4275.2 or GDR 16.0.1200.5; 2025 CU8 17.0.4085.5 or GDR 17.0.1135.8. For CVE-2026-67643, fixed builds are SQL Server 2022 CU 26 16.0.4275.2 or GDR 16.0.1200.5; and SQL Server 2025 CU8 17.0.4085.5 or GDR 17.0.1135.8.

1. Apply Windows component fixes: CVE-2026-68839 and CVE-2026-69276 are 9.8 critical network RCEs in the USB Mass Storage Class Driver and UxTheme Library. Use the Windows servicing update matching your build, such as Windows 11 24H2 10.0.26100.9445 or Windows Server 2025 10.0.26100.33438.

1. Patch Microsoft Office Outlook: CVE-2026-70125 is an 8.8 high RCE requiring user interaction. Apply the update from the Office Security Releases page for Microsoft 365 Apps, Office LTSC 2021 or Office LTSC 2024.

1. Then complete the remaining September updates for the rest of the release, prioritising internet-facing and high-severity systems.

Beyond the patch

This kind of release is manageable if you separate the two exploited Windows flaws from the wider set of network-accessible critical issues. Managed Detection & Response (MDR) gives you detection and response coverage for the exploited Windows ALPC and Update Stack activity, while Virtual CISO Services (vCISO) helps you find and close the exposed services that the Skype for Business and SQL Server issues depend on.