September 2026 Patch Tuesday
Microsoft's September 2026 security release, released Sep 8, 2026: every CVE with its severity, CVSS score, fixing KBs and whether it is exploited in the wild, cross-checked against the CISA KEV catalog. Rebuilt from the MSRC API every week, so later revisions show up here too.
- 998Microsoft CVEs
- 2Exploited (MSRC or CISA KEV)
- 0Publicly disclosed
- 132Critical
- 437Chromium CVEs for Edge
Patch these first
Exploited or in CISA KEV, then publicly disclosed, then Critical with CVSS 9 or higher.
| CVE | Vulnerability | Severity | CVSS | Status |
|---|---|---|---|---|
| CVE-2026-81963 | Windows Update Stack Elevation of Privilege Vulnerability | Important | 7.8 | Exploited KEV, due 2026-09-22 |
| CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Important | 7.8 | Exploited KEV, due 2026-09-22 |
| CVE-2026-62874 | Azure Billing Elevation of Privilege Vulnerability | Critical | 10 | |
| CVE-2026-69399 | Azure Arc Elevation of Privilege Vulnerability | Critical | 10 | |
| CVE-2026-69843 | Microsoft Fabric Elevation of Privilege Vulnerability | Critical | 10 | |
| CVE-2026-69865 | Microsoft Container Registry Elevation of Privilege Vulnerability | Critical | 10 | |
| CVE-2026-70200 | Azure Logic Apps Elevation of Privilege Vulnerability | Critical | 10 | |
| CVE-2026-70352 | Azure AI Language Elevation of Privilege Vulnerability | Critical | 10 | |
| CVE-2026-83711 | Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability | Critical | 10 | |
| CVE-2026-83944 | Azure Logic Apps Elevation of Privilege Vulnerability | Critical | 10 | |
| CVE-2026-85889 | Azure AI Foundry Elevation of Privilege Vulnerability | Critical | 10 | |
| CVE-2026-83941 | Entra ID Elevation of Privilege Vulnerability | Critical | 9.9 | |
| CVE-2026-85878 | Azure Database for PostgreSQL Elevation of Privilege Vulnerability | Critical | 9.9 | |
| CVE-2026-85885 | Microsoft 365 Copilot Elevation of Privilege Vulnerability | Critical | 9.9 | |
| CVE-2026-66302 | Skype for Business Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-67631 | Microsoft SQL Server Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-67643 | Microsoft SQL Server Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-69579 | Windows Message Queuing Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-69590 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-69595 | Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability | Critical | 9.8 |
By product
Every CVE
Loading the full list…
| CVE | Vulnerability | Severity | CVSS | Status | KBs |
|---|
About this data
From Microsoft's CVRF document for September 2026 (last revised Oct 18, 2026), rebuilt Oct 20, 2026. KEV status from the CISA catalog as of Oct 20, 2026. Third-party open-source CVEs that ship only in Azure Linux are left out. Always confirm against the MSRC entry before acting. Download the raw JSON.