Report Name: Microsoft Patch Tuesday, September 2026
Generated: 2026-09-08 23:21:21

Product Name	Prevalence	U	C	H	M	L	A	Comment
Windows Container Manager Service	0.9				1		1	Windows component
Windows DNS Server	0.9			9	1		10	Windows component
Windows Kernel	0.9			1	10		11	Windows Kernel
Windows SMB Client	0.9			1	3		4	Windows component
Windows TCP/IP	0.9			1	5		6	Windows component
Windows Win32k	0.9				24		24	The Win32k.sys driver is the kernel side of some core parts of the Windows subsystem. Its main functionality is the GUI of Windows; it's responsible for window management.
ASP.NET Core	0.8				2		2	An open-source, server-side web-application framework designed for web development
Connected User Experiences and Telemetry	0.8				4		4	Windows component
DirectWrite	0.8			2			2	Windows сomponent
Kernel Streaming WOW Thunk Service Driver	0.8				2		2	Windows component
Microsoft COM	0.8				2		2	COM is a platform-independent, distributed, object-oriented system for creating binary software components that can interact
Microsoft Exchange	0.8			2	7		9	Microsoft Exchange Server is a mail server and calendaring server developed by Microsoft
Microsoft Office	0.8			6	9		15	Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer
Microsoft OpenSSH for Windows	0.8			1			1	Windows component
Microsoft PowerShell	0.8				2		2	PowerShell or Microsoft PowerShell (formerly Windows PowerShell) is a task automation and configuration management program from Microsoft, consisting of a command-line shell and the associated scripting language
Microsoft Remote Desktop App for Windows	0.8				1		1	Windows component
Microsoft Windows Media Foundation	0.8			6			6	Windows component
Microsoft Windows PDF	0.8			1			1	Windows component
Microsoft Windows SCSI Class System File	0.8				3		3	Windows component
Microsoft Windows Search Component	0.8				11		11	Windows component
Microsoft Windows Speech	0.8				3		3	Windows component
Role: Windows Fax Service	0.8				3		3	Windows component
Storage Spaces Controller	0.8				1		1	Storage Spaces Controller
Windows AF_UNIX Socket Provider	0.8				1		1	Windows component
Windows ALPC	0.8				2		2	Windows component
Windows Accounts Control	0.8				2		2	Windows component
Windows Active Directory Domain Services	0.8			3	2		5	Windows component
Windows Advanced Local Procedure Call (ALPC)	0.8			1			1	Windows component
Windows Ancillary Function Driver for WinSock	0.8				2		2	Windows component
Windows Audio Service	0.8				8		8	Windows component
Windows Authentication Methods	0.8				1		1	Windows component
Windows Autopilot	0.8				1		1	Windows component
Windows Bind Filter Driver	0.8				1		1	Windows component
Windows Biometric Service	0.8				64		64	Windows component
Windows BitLocker	0.8				2		2	Windows component
Windows Bluetooth Port Driver	0.8				2		2	Windows component
Windows Bluetooth Service	0.8				4		4	Windows component
Windows Boot Manager	0.8				1		1	Windows component
Windows Broadcast DVR User Service	0.8				1		1	Windows component
Windows Broker Infrastructure Service	0.8				1		1	Windows component
Windows CD-ROM Driver	0.8				4		4	Windows component
Windows Camera Frame Server Monitor	0.8				1		1	Windows component
Windows Cloud Files Mini Filter Driver	0.8				3		3	Windows component
Windows Compressed Folder	0.8			1	2		3	Windows component
Windows Connected User Experiences and Telemetry	0.8				1		1	Windows component
Windows Core Messaging	0.8				2		2	Windows component
Windows Credential Guard	0.8				2		2	Windows component
Windows Credential Providers	0.8			1	2		3	Windows component
Windows DCOM Server	0.8				1		1	Windows component
Windows DHCP Client	0.8				2		2	Windows component
Windows DHCP Server	0.8			9	27		36	Windows component
Windows DNS	0.8			1	7		8	Windows component
Windows DWM Core Library	0.8				1		1	Windows component
Windows Defender Firewall Service	0.8				2		2	Windows component
Windows Deployment Services	0.8			4			4	Windows component
Windows Device Association Broker Service	0.8				2		2	Windows component
Windows Device Association Service	0.8				11		11	Windows component
Windows Device Health Attestation (DHA)	0.8				1		1	Windows component
Windows Devices Human Interface	0.8				1		1	Windows component
Windows Direct Show	0.8			1			1	Windows component
Windows Display Enhancement Service	0.8				1		1	Windows component
Windows Distributed File System (DFS)	0.8				2		2	Windows component
Windows Embedded Mode Service	0.8				1		1	Windows component
Windows Encrypting File System (EFS)	0.8				3		3	Windows component
Windows Enterprise App Management	0.8				2		2	Windows component
Windows Error Reporting	0.8				12		12	Windows component
Windows Event Logging Service	0.8			3			3	Windows component
Windows Failover Cluster	0.8				2		2	Windows component
Windows Fast FAT Driver	0.8				2		2	Windows component
Windows File History Service	0.8				3		3	Windows component
Windows GDI	0.8				1		1	Windows component
Windows GDI+	0.8				2		2	Windows component
Windows Graphics Component	0.8			2			2	Windows component
Windows Group Policy	0.8				1		1	Windows component
Windows HTTP Print Provider	0.8			2			2	Windows component
Windows HTTP.sys	0.8				1		1	Windows component
Windows Hello	0.8				9		9	Windows component
Windows Host Guardian Service	0.8				1		1	Windows component
Windows IP Address Management (IPAM) Service	0.8				1		1	Windows component
Windows Image Acquisition	0.8				4		4	Windows component
Windows Imaging Component	0.8			7	1		8	Windows component
Windows Installer	0.8				5		5	Windows component
Windows Internet Connection Sharing (ICS)	0.8				2		2	Windows component
Windows Internet Key Exchange (IKE) Extension	0.8				2		2	Windows component
Windows Internet Key Exchange (IKE) Protocol Extensions	0.8			1			1	Windows component
Windows Kerberos	0.8			1	4		5	Windows component
Windows Kernel-Mode Driver	0.8				1		1	Windows component
Windows Key Distribution Center	0.8			1	1		2	Windows component
Windows LDAP - Lightweight Directory Access Protocol	0.8				1		1	Windows component
Windows License Manager	0.8				2		2	Windows component
Windows Link Layer Topology Discovery Protocol	0.8			1			1	Windows component
Windows MIDI Service Module	0.8				2		2	Windows component
Windows MIDI Service Module	0.8				4		4	Windows component
Windows Management Instrumentation	0.8				4		4	Windows component
Windows Management Services	0.8				1		1	Windows component
Windows Media	0.8				1		1	Windows component
Windows Media Player	0.8			2			2	Windows component
Windows Message Queuing	0.8			2	1		3	Windows component
Windows Message Queuing Queue Manager	0.8				2		2	Windows component
Windows Mobile Broadband	0.8				1		1	Windows component
Windows Modern Device Management (MDM)	0.8				6		6	Windows component
Windows Modern Execution Server	0.8				1		1	Windows component
Windows NDIS	0.8				2		2	Windows component
Windows NFS Portmapper	0.8				1		1	Windows component
Windows NTFS	0.8			6	23		29	The default file system of the Windows NT family
Windows Netlogon	0.8			1	1		2	Windows component
Windows Network Connection Broker	0.8				2		2	Windows component
Windows Network File System	0.8			1	1		2	Windows component
Windows Notification	0.8				1		1	Windows component
Windows OLE DB	0.8			1	1		2	Windows component
Windows Online Certificate Status Protocol (OCSP)	0.8				1		1	Windows component
Windows Overlay Filter	0.8				7		7	Windows component
Windows Paint	0.8			1			1	Windows component
Windows Partition Management Driver	0.8				3		3	Windows component
Windows Performance Monitor	0.8				1		1	Windows component
Windows Power Dependency Coordinator	0.8				2		2	Windows component
Windows Print Spooler	0.8			1			1	Windows component
Windows Print Spooler Components	0.8				11		11	Windows component
Windows PrintWorkflowUserSvc	0.8				1		1	Windows component
Windows Program Compatibility Assistant Service	0.8				6		6	Windows component
Windows Push Notifications	0.8				3		3	Windows component
Windows RNDIS	0.8			1	1		2	Windows component
Windows Registry	0.8				1		1	Windows component
Windows Reliable Multicast Transport Driver (RMCAST)	0.8			3			3	Windows component
Windows Remote Access Connection Manager	0.8			2	5		7	Windows component
Windows Remote Desktop	0.8			1			1	Windows component
Windows Remote Desktop Client	0.8			6	3		9	Remote Desktop Protocol Client
Windows Remote Desktop Licensing Service	0.8				1		1	Windows component
Windows Remote Desktop Protocol	0.8				1		1	Windows component
Windows Remote Desktop Services	0.8				4		4	Remote Desktop Services, known as Terminal Services in Windows Server 2008 and earlier, is one of the components of Microsoft Windows that allow a user to initiate and control an interactive session on a remote computer or virtual machine over a network connection
Windows Resilient File System (ReFS)	0.8				2		2	Windows component
Windows Resilient File System (ReFS) Deduplication Service	0.8				1		1	Windows component
Windows Routing and Remote Access Service (RRAS)	0.8			5	3		8	Windows component
Windows SMB Server	0.8				2		2	Windows component
Windows SMB Server Network Transport Driver (srvnet.sys)	0.8				1		1	Windows component
Windows Schannel	0.8			1	1		2	Windows component
Windows Secure Boot	0.8				1		1	Windows component
Windows Secure Kernel Mode	0.8				4		4	Windows component
Windows Secure Socket Tunneling Protocol (SSTP)	0.8			1	3		4	Windows component
Windows Security Health Service	0.8				1		1	Windows component
Windows Server	0.8				1		1	Windows component
Windows Services for NFS ONCRPC XDR Driver	0.8			2	4		6	Windows component
Windows Setup Files Cleanup	0.8				1		1	Windows component
Windows Shell	0.8			1	5		6	Windows component
Windows Smart Card	0.8				1		1	Windows component
Windows Spaceport.sys	0.8			2	15		17	Windows component
Windows Storage	0.8				2		2	Windows component
Windows Storage Management Provider	0.8				2		2	Windows component
Windows Storage Port Driver	0.8				3		3	Windows component
Windows Storage Spaces Controller	0.8			2	2		4	Windows component
Windows Task Scheduler	0.8				1		1	Windows component
Windows Text Shaping	0.8			1	1		2	Windows component
Windows URL Moniker	0.8			1	1		2	Windows component
Windows USB Audio Class Driver	0.8				1		1	Windows component
Windows USB Audio Class driver (usbaudio.sys)	0.8				8		8	Windows component
Windows USB Driver	0.8				5		5	Windows component
Windows USB Hub Driver	0.8				1		1	Windows component
Windows USB Mass Storage Class Driver	0.8			1	2		3	Windows component
Windows USB Video Driver	0.8				5		5	Windows component
Windows Universal Disk Format File System Driver (UDFS)	0.8				3		3	Windows component
Windows Universal Plug and Play (UPnP) Device Host	0.8				2		2	Windows component
Windows Update Stack	0.8		1				1	Windows component
Windows VHD miniport driver	0.8				1		1	Windows component
Windows VOLSNAP.SYS	0.8			1			1	Windows component
Windows Virtual Trusted Platform Module	0.8				1		1	Windows component
Windows Virtualization-Based Security (VBS)	0.8				1		1	Windows component
Windows Virtualization-Based Security (VBS) Enclave	0.8				1		1	Windows component
Windows Volume Manager Extension Driver	0.8			2	3		5	Windows component
Windows Web Platform Storage	0.8				1		1	Windows component
Windows WebClient Service	0.8				1		1	Windows component
Windows Win32K	0.8				1		1	Windows component
Windows Wireless Networking	0.8				1		1	Windows component
Windows Wireless Wide Area Network Service	0.8				1		1	Windows component
Windows Work Folder Service	0.8			1	1		2	Windows component
Windows Work Folders	0.8				1		1	Windows component
Windows exFAT File System	0.8				1		1	Windows component
Windows iSCSI	0.8			3	1		4	Windows component
Windows iSCSI Target Service	0.8				1		1	Windows component
.NET	0.7				3		3	.NET
.NET and Visual Studio	0.7			2	1		3	.NET and Visual Studio
HEVC Video Extensions	0.7				2		2	HEVC Video Extensions
Raw Image Extension	0.7			1			1	Raw Image Extension
VHD Miniport Driver	0.7				7		7	The Virtual Hard Disk (VHD) Miniport Driver is a Microsoft Windows kernel-mode storage driver that enables the operating system to mount, access, and manage Virtual Hard Disk (VHD and VHDX) files as block storage devices. It is used by Windows virtualization, backup, and virtual disk management features.
Web Media Extensions	0.7			1			1	Web Media Extensions
Windows Security Center	0.7				1		1	Windows Security Center (WSC) is a comprehensive reporting tool that helps users establish and maintain a protective security layer around their computer systems
HEIF Image Extensions	0.6				1		1	The HEIF Image Extension enables Windows 10 devices to read and write files that use the High Efficiency Image File (HEIF) format.
Microsoft Entra ID	0.6			1			1	Microsoft Entra ID is a cloud-based identity and access management solution
Microsoft Excel	0.6				28		28	MS Office product
Microsoft Office Graphics Component	0.6				1		1	Microsoft Office
Microsoft Word	0.6				3		3	Microsoft Word is a widely used commercial word processor developed by Microsoft. It is a component of the Microsoft Office suite of productivity software but can also be purchased as a standalone product.
Skype for Business	0.6				7		7	Skype for Business
Windows Hyper-V	0.6				5		5	Hardware virtualization component of the client editions of Windows NT
Active Directory Certificate Services (AD CS)	0.5				4		4	Active Directory Certificate Services (AD CS)
Active Directory Domain Services	0.5				1		1	Active Directory Domain Services
Active Directory Federation Services (AD FS)	0.5				1		1	Active Directory Federation Services (AD FS)
Audio Video Control Transport Protocol	0.5				1		1	Audio Video Control Transport Protocol
Azure AI Language	0.5			1			1	Azure AI Language
Azure Arc SQL Server Extension	0.5				1		1	Azure Arc SQL Server Extension
Azure Cosmos DB	0.5				1		1	Azure Cosmos DB
Azure CycleCloud	0.5				1		1	Azure CycleCloud
Azure HDInsight Ambari	0.5				1		1	Azure HDInsight Ambari
BranchCache	0.5				1		1	BranchCache
Connected Devices Platform Service (Cdpsvc)	0.5				1		1	Connected Devices Platform Service (Cdpsvc)
Copilot Studio	0.5				1		1	Copilot Studio
Data Sharing Service Client	0.5				1		1	Data Sharing Service Client
Entra ID	0.5				1		1	Entra ID
GitHub Copilot and Visual Studio Code	0.5				2		2	GitHub Copilot and Visual Studio Code
Graphic Fonts	0.5				3		3	Graphic Fonts
Graphics Kernel	0.5				1		1	Graphics Kernel
HID Class Driver	0.5				1		1	HID Class Driver
IP Helper	0.5				1		1	IP Helper
Internet Connection Sharing (ICS)	0.5				1		1	Internet Connection Sharing (ICS)
Internet Storage Name Service	0.5				1		1	Internet Storage Name Service
Microsoft Account	0.5				2		2	Microsoft Account
Microsoft Authentication Library (MSAL) for Node.js	0.5				1		1	Microsoft Authentication Library (MSAL) for Node.js
Microsoft Authenticator	0.5				1		1	Microsoft Authenticator
Microsoft Azure Active Directory B2C	0.5			1			1	Microsoft Azure Active Directory B2C
Microsoft Azure CLI	0.5				1		1	Microsoft Azure CLI
Microsoft DirectMusic	0.5				1		1	Microsoft DirectMusic
Microsoft Discovery Studio	0.5				1		1	Microsoft Discovery Studio
Microsoft Dynamics 365 On-Premises	0.5				2		2	Microsoft Dynamics 365 On-Premises
Microsoft Fabric	0.5				1		1	Microsoft Fabric
Microsoft Failover Cluster	0.5				2		2	Microsoft Failover Cluster
Microsoft Graphics Component	0.5				3		3	Microsoft Graphics Component
Microsoft Install Service	0.5				1		1	Microsoft Install Service
Microsoft JScript	0.5				2		2	Microsoft JScript
Microsoft Local Security Authority (LSA) Server	0.5				3		3	Microsoft Local Security Authority (LSA) Server
Microsoft Office Access	0.5				4		4	Microsoft Office Access
Microsoft Office Excel	0.5				4		4	Microsoft Office Excel
Microsoft Office Outlook	0.5				7		7	Microsoft Office Outlook
Microsoft Office PowerPoint	0.5				10		10	Microsoft Office PowerPoint
Microsoft Office Publisher	0.5				2		2	Microsoft Office Publisher
Microsoft Office SharePoint	0.5				15	1	16	Microsoft Office SharePoint
Microsoft Office Word	0.5				35		35	Microsoft Office Word
Microsoft Power Automate Desktop	0.5				1		1	Microsoft Power Automate Desktop
Microsoft SQL Server	0.5				54		54	Microsoft SQL Server
Microsoft Standard XPS	0.5				18		18	Microsoft Standard XPS
Microsoft Storage Port Driver	0.5				1		1	Microsoft Storage Port Driver
Microsoft Teams for Android	0.5				2		2	Microsoft Teams for Android
Microsoft Trace Data Helper	0.5				1		1	Microsoft Trace Data Helper
Microsoft UxTheme Library (uxtheme.dll)	0.5				1		1	Microsoft UxTheme Library (uxtheme.dll)
Microsoft VOLSNAP.SYS	0.5				2		2	Microsoft VOLSNAP.SYS
Microsoft WDAC OLE DB provider for SQL	0.5				1		1	Microsoft WDAC OLE DB provider for SQL
Microsoft WebP Image Extension	0.5				1		1	Microsoft WebP Image Extension
Power Automate	0.5				1		1	Power Automate
Push Message Routing Service	0.5				1		1	Push Message Routing Service
RPC Runtime Library	0.5				1		1	RPC Runtime Library
Remote Desktop Gateway Service	0.5				2		2	Remote Desktop Gateway Service
Remote Desktop Licensing Service	0.5				1		1	Remote Desktop Licensing Service
Remote Desktop Services Remote Code Execution Vulnerability	0.5				5		5	Remote Desktop Services Remote Code Execution Vulnerability
SQL Server	0.5				7		7	SQL Server
Skype for Business and Lync	0.5				3		3	Skype for Business and Lync
Spring Cloud Azure	0.5				1		1	Spring Cloud Azure
Telnet Client	0.5				1		1	Telnet Client
Volume Manager Driver	0.5				3		3	Volume Manager Driver
Volume Shadow Copy	0.5				1		1	Volume Shadow Copy
Winsock	0.5				1		1	Winsock
Xbox	0.5				1		1	Xbox
Xbox Gaming Services	0.5				1		1	Xbox Gaming Services
Visual Studio	0.3				2		2	Integrated development environment
Visual Studio Code	0.3				9	1	10	Integrated development environment

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0			122	135		257
Security Feature Bypass	0.9			2	16		18
Elevation of Privilege	0.85		1	4	433		438
Information Disclosure	0.83				175		175
Denial of Service	0.7				56		56
Spoofing	0.4				15	1	16
Tampering	0.3				12	1	13

Source	U	C	H	M	L	A
Qualys		1	50	64		115
Tenable		1	3	2		6
Rapid7
ZDI		1	29	18		48

Urgent (0)

Critical (1)

1. Elevation of Privilege - Windows Update Stack (CVE-2026-81963) - Critical [716]

Description: Windows Update Stack Elevation of Privilege Vulnerability

Qualys: CVE-2026-81963: Windows Update Stack Elevation of Privilege Vulnerability  A link following flaw in the Windows Update Stack may allow an authenticated attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CISA added the CVE-2026-81963 to its Known Exploited Vulnerabilities Catalog, urging users to patch it before September 22, 2026.

Tenable: Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Tenable: CVE-2026-81963 | Windows Update Stack elevation of privilege vulnerability

Tenable: CVE-2026-81963 is an EoP vulnerability affecting Windows Update Stack elevation of privilege vulnerability. It received a CVSSv3 score of 7.8 and was rated as important. According to Microsoft, this vulnerability was exploited in the wild as a zero-day.

Tenable: Since 2022, seven Windows Update Stack EoP vulnerabilities have been patched across Patch Tuesday releases, but CVE-2026-81963 is the first to have been exploited in the wild as a zero-day.

ZDI: -              CVE-2026-81963 - Windows Update Stack Elevation of Privilege Vulnerability. This is the first bug being exploited in the wild, but we know little about how broadly that exploitation is. The bug itself is a privilege escalation in the Update Stack, which is worrisome, but I doubt the automatic update process itself is compromised. More likely is that this bug is being combined with a code execution bug to spread malware or ransomware. Patch this one quickly.

High (128)

2. Elevation of Privilege - Windows Advanced Local Procedure Call (ALPC) (CVE-2026-85880) - High [594]

Description: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

Qualys: CVE-2026-85880: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability  The heap-based buffer overflow flaw in Windows ALPC may allow an authenticated attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CISA added the CVE-2026-85880 to its Known Exploited Vulnerabilities Catalog, urging users to patch it before September 22, 2026.

Tenable: Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Tenable: CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) elevation of privilege vulnerability

Tenable: CVE-2026-85880 is a EoP vulnerability affecting Windows Advanced Local Procedure Call (ALPC). It received a CVSSv3 score of 7.8 and is rated as important. According to Microsoft, this vulnerability was exploited in the wild, making it one of two zero-days addressed in the September Patch Tuesday release. Successful exploitation would allow an attacker to gain SYSTEM level privileges.

ZDI: -              CVE-2026-85880 - Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability. This is the other bug currently being exploited, and it is also a privilege escalation bug. These types of bugs must be triggered by the user, but they can hide within documents, PDFs, and other attachments. As with the Update Stack EoP, we don’t know how widespread these exploits may be, so assume they are coming for you and patch quickly.

3. Remote Code Execution - Windows DNS Server (CVE-2026-69730) - High [447]

Description: Windows DNS Server Remote Code Execution Vulnerability

Qualys: CVE-2026-69730, CVE-2026-69813, CVE-2026-69858, & CVE-2026-72987: Windows DNS Server Remote Code Execution Vulnerability  The use-after-free flaw in Windows DNS may allow an unauthenticated attacker to execute code over a network. 

Tenable: CVE-2026-69730 | Windows DNS Server remote code execution vulnerability

Tenable: CVE-2026-69730 is an RCE vulnerability affecting Windows DNS Server. It received a CVSSv3 score of 9.8 and is rated Critical. According to the advisory, an unauthenticated, remote attacker could send a crafted packet to exploit a use-after-free flaw in Windows DNS in order to achieve remote code execution. Microsoft assesses this flaw as “Exploitation More Likely.”

Tenable: Eight additional RCEs in Windows DNS Server were patched this month, however they did not achieve the same exploitability assessment as CVE-2026-69730. These eight are outlined in the table below:

ZDI: CVE-2026-69510 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-69524 – Windows Active Directory Domain Services Remote Code Execution Vulnerability . CVE-2026-69530 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-69579 – Windows Message Queuing Remote Code Execution Vulnerability . CVE-2026-69590 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability . CVE-2026-69595 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability . CVE-2026-69730 – Windows DNS Server Remote Code Execution Vulnerability (SigRed’s spiritual successor) . CVE-2026-69858 – Windows DNS Server Remote Code Execution Vulnerability . CVE-2026-72936 – Windows SMB Client Remote Code Execution Vulnerability . CVE-2026-72979 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-72981 – IP Helper Remote Code Execution Vulnerability . CVE-2026-72982 – Windows Netlogon Remote Code Execution Vulnerability . CVE-2026-72983 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability . CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability . CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability . CVE-2026-73010 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78444 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78449 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-78450 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-83997 – Windows Message Queuing Remote Code Execution Vulnerability . Here’s the full list of CVEs released by Microsoft for September 2026:

4. Remote Code Execution - Windows Kernel (CVE-2026-69669) - High [447]

Description: Windows Kernel Remote Code Execution Vulnerability

5. Remote Code Execution - Windows DNS Server (CVE-2026-69551) - High [435]

Description: Windows DNS Server Remote Code Execution Vulnerability

6. Remote Code Execution - Microsoft Windows Media Foundation (CVE-2026-69408) - High [430]

Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

7. Remote Code Execution - Microsoft Windows PDF (CVE-2026-69586) - High [430]

Description: Microsoft Windows PDF Remote Code Execution Vulnerability

8. Remote Code Execution - Windows Compressed Folder (CVE-2026-69496) - High [430]

Description: Windows Compressed Folder Remote Code Execution Vulnerability

9. Remote Code Execution - Windows DHCP Server (CVE-2026-69845) - High [430]

Description: Windows DHCP Server Remote Code Execution Vulnerability

Qualys: CVE-2026-69845: Windows DHCP Server Remote Code Execution Vulnerability  The heap-based buffer overflow flaw in Windows DHCP Server may allow an unauthenticated attacker to execute code over a network. 

ZDI: Windows DHCP Server: Windows DHCP Server chimes in with 36 bugs: 12 RCE, 18 DoS, five info leaks, and one EoP. Nothing exploited or disclosed, but 22 of the 36 require no authentication. It's the third-largest single-component pile of the month, and it's all one story: someone pointed a (likely AI-assisted) fuzzer at DHCP packet parsing. In addition to the two wormable bugs already mentioned, there are three more that didn’t carry the exact wormable verbiage but look like close cousins: CVE-2026-69845 (9.8, heap overflow), CVE-2026-69266 (8.8, integer overflow), and CVE-2026-69620 (8.1, stack overflow). If you're being generous, that's five wormable-shaped bugs in DHCP Server alone. The remaining seven RCEs need an authorized attacker. CWE spread is pure memory corruption: heap, stack, UAF, integer overflow. There are 18 DoS bugs, and 13 are unauthenticated at a CVSS score of 7.5. Malformed packet in, service crash out. Individually boring, but collectively, an unauthenticated attacker on the network has 13 different ways to take out DHCP, and when DHCP dies, clients stop getting leases and the helpdesk phone starts ringing. Finally, there are a couple of oddballs here: CVE-2026-69297 is an info leak that could expose passwords stored in a recoverable format, which is a configuration-secrets problem rather than a memory bug. The lone EoP is missing authentication on a critical function.

10. Remote Code Execution - Windows DHCP Server (CVE-2026-72979) - High [430]

Description: Windows DHCP Server Remote Code Execution Vulnerability

Qualys: CVE-2026-72979: Windows DHCP Server Remote Code Execution Vulnerability  The use-after-free flaw in Windows DHCP Server may allow an unauthenticated attacker to execute code over a network. 

ZDI: CVE-2026-69510 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-69524 – Windows Active Directory Domain Services Remote Code Execution Vulnerability . CVE-2026-69530 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-69579 – Windows Message Queuing Remote Code Execution Vulnerability . CVE-2026-69590 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability . CVE-2026-69595 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability . CVE-2026-69730 – Windows DNS Server Remote Code Execution Vulnerability (SigRed’s spiritual successor) . CVE-2026-69858 – Windows DNS Server Remote Code Execution Vulnerability . CVE-2026-72936 – Windows SMB Client Remote Code Execution Vulnerability . CVE-2026-72979 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-72981 – IP Helper Remote Code Execution Vulnerability . CVE-2026-72982 – Windows Netlogon Remote Code Execution Vulnerability . CVE-2026-72983 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability . CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability . CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability . CVE-2026-73010 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78444 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78449 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-78450 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-83997 – Windows Message Queuing Remote Code Execution Vulnerability . Here’s the full list of CVEs released by Microsoft for September 2026:

11. Remote Code Execution - Windows Direct Show (CVE-2026-69715) - High [430]

Description: Windows Direct Show Remote Code Execution Vulnerability

12. Remote Code Execution - Windows Event Logging Service (CVE-2026-69493) - High [430]

Description: Windows Event Logging Service Remote Code Execution Vulnerability

13. Remote Code Execution - Windows Graphics Component (CVE-2026-77493) - High [430]

Description: Windows Graphics Component Remote Code Execution Vulnerability

Qualys: CVE-2026-77493: Microsoft Office Outlook Remote Code Execution Vulnerability  A double-free flaw in Microsoft Office Outlook may allow an unauthenticated attacker to execute code over a network. 

14. Remote Code Execution - Windows HTTP Print Provider (CVE-2026-69769) - High [430]

Description: Windows HTTP Print Provider Remote Code Execution Vulnerability

Qualys: CVE-2026-69769: Windows HTTP Print Provider Remote Code Execution Vulnerability  The heap-based buffer overflow flaw in Windows HTTP Print Provider may allow an unauthenticated attacker to execute code over a network. 

15. Remote Code Execution - Windows Imaging Component (CVE-2026-70296) - High [430]

Description: Windows Imaging Component Remote Code Execution Vulnerability

Qualys: CVE-2026-70296: Windows Imaging Component Remote Code Execution Vulnerability  An out-of-bounds write flaw in Windows Imaging Component may allow an unauthenticated attacker to execute code over a network. 

16. Remote Code Execution - Windows Message Queuing (CVE-2026-69579) - High [430]

Description: Windows Message Queuing Remote Code Execution Vulnerability

Qualys: CVE-2026-69579: Windows Message Queuing Remote Code Execution Vulnerability  The use-after-free flaw in Windows Message Queuing may allow an unauthenticated attacker to execute code over a network. 

ZDI: CVE-2026-69510 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-69524 – Windows Active Directory Domain Services Remote Code Execution Vulnerability . CVE-2026-69530 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-69579 – Windows Message Queuing Remote Code Execution Vulnerability . CVE-2026-69590 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability . CVE-2026-69595 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability . CVE-2026-69730 – Windows DNS Server Remote Code Execution Vulnerability (SigRed’s spiritual successor) . CVE-2026-69858 – Windows DNS Server Remote Code Execution Vulnerability . CVE-2026-72936 – Windows SMB Client Remote Code Execution Vulnerability . CVE-2026-72979 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-72981 – IP Helper Remote Code Execution Vulnerability . CVE-2026-72982 – Windows Netlogon Remote Code Execution Vulnerability . CVE-2026-72983 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability . CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability . CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability . CVE-2026-73010 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78444 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78449 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-78450 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-83997 – Windows Message Queuing Remote Code Execution Vulnerability . Here’s the full list of CVEs released by Microsoft for September 2026:

17. Remote Code Execution - Windows NTFS (CVE-2026-69463) - High [430]

Description: Windows NTFS Remote Code Execution Vulnerability

ZDI: Windows NTFS: We have 30 bugs in this component: 16 EoP, 10 RCE, three info leaks, and one link-following oddball. All Important except the two 9.8 Critical RCEs. Like Biometric and DHCP, it's one bug class on repeat: 28 of 30 are memory-safety flaws (heap overflows lead at 12, then out-of-bounds reads). The headliner is CVE-2026-69463; simple heap-overflow RCE at 9.8, unauthenticated, network vector. The FAQ only offers the vague “in-network attacker calling arbitrary endpoints” phrasing, which likely means the remote path is something like SMB-reachable file operations rather than a raw packet, but a 9.8 in the file system driver everyone runs is still a top-tier patch either way. CVE-2026-69461 (8.8, stack overflow, unauth network) rides along just below them. Everything else can be somewhat dismissed as local-only noise, but remember the mount-a-drive trio that where “requires physical access” describes every USB port in the building.

18. Remote Code Execution - Windows Netlogon (CVE-2026-72982) - High [430]

Description: Windows Netlogon Remote Code Execution Vulnerability

Qualys: CVE-2026-72982: Windows Netlogon Remote Code Execution Vulnerability  The stack-based buffer overflow flaw in Windows Netlogon may allow an unauthenticated attacker to execute code over a network. 

ZDI: CVE-2026-69510 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-69524 – Windows Active Directory Domain Services Remote Code Execution Vulnerability . CVE-2026-69530 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-69579 – Windows Message Queuing Remote Code Execution Vulnerability . CVE-2026-69590 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability . CVE-2026-69595 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability . CVE-2026-69730 – Windows DNS Server Remote Code Execution Vulnerability (SigRed’s spiritual successor) . CVE-2026-69858 – Windows DNS Server Remote Code Execution Vulnerability . CVE-2026-72936 – Windows SMB Client Remote Code Execution Vulnerability . CVE-2026-72979 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-72981 – IP Helper Remote Code Execution Vulnerability . CVE-2026-72982 – Windows Netlogon Remote Code Execution Vulnerability . CVE-2026-72983 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability . CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability . CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability . CVE-2026-73010 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78444 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78449 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-78450 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-83997 – Windows Message Queuing Remote Code Execution Vulnerability . Here’s the full list of CVEs released by Microsoft for September 2026:

19. Remote Code Execution - Windows RNDIS (CVE-2026-69768) - High [430]

Description: Windows RNDIS Remote Code Execution Vulnerability

20. Remote Code Execution - Windows Routing and Remote Access Service (RRAS) (CVE-2026-69590) - High [430]

Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Qualys: CVE-2026-69590, CVE-2026-69852, CVE-2026-72950, & CVE-2026-72959: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability  Successful exploitation of the vulnerability may allow an attacker to gain unauthenticated access to the victim’s machine. 

ZDI: CVE-2026-69510 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-69524 – Windows Active Directory Domain Services Remote Code Execution Vulnerability . CVE-2026-69530 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-69579 – Windows Message Queuing Remote Code Execution Vulnerability . CVE-2026-69590 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability . CVE-2026-69595 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability . CVE-2026-69730 – Windows DNS Server Remote Code Execution Vulnerability (SigRed’s spiritual successor) . CVE-2026-69858 – Windows DNS Server Remote Code Execution Vulnerability . CVE-2026-72936 – Windows SMB Client Remote Code Execution Vulnerability . CVE-2026-72979 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-72981 – IP Helper Remote Code Execution Vulnerability . CVE-2026-72982 – Windows Netlogon Remote Code Execution Vulnerability . CVE-2026-72983 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability . CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability . CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability . CVE-2026-73010 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78444 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78449 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-78450 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-83997 – Windows Message Queuing Remote Code Execution Vulnerability . Here’s the full list of CVEs released by Microsoft for September 2026:

21. Remote Code Execution - Windows Secure Socket Tunneling Protocol (SSTP) (CVE-2026-73009) - High [430]

Description: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

Qualys: CVE-2026-73009: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability  The use-after-free flaw in Windows Secure Socket Tunneling Protocol (SSTP) may allow an unauthenticated attacker to execute code over a network. 

ZDI: CVE-2026-69510 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-69524 – Windows Active Directory Domain Services Remote Code Execution Vulnerability . CVE-2026-69530 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-69579 – Windows Message Queuing Remote Code Execution Vulnerability . CVE-2026-69590 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability . CVE-2026-69595 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability . CVE-2026-69730 – Windows DNS Server Remote Code Execution Vulnerability (SigRed’s spiritual successor) . CVE-2026-69858 – Windows DNS Server Remote Code Execution Vulnerability . CVE-2026-72936 – Windows SMB Client Remote Code Execution Vulnerability . CVE-2026-72979 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-72981 – IP Helper Remote Code Execution Vulnerability . CVE-2026-72982 – Windows Netlogon Remote Code Execution Vulnerability . CVE-2026-72983 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability . CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability . CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability . CVE-2026-73010 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78444 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78449 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-78450 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-83997 – Windows Message Queuing Remote Code Execution Vulnerability . Here’s the full list of CVEs released by Microsoft for September 2026:

22. Remote Code Execution - Windows Services for NFS ONCRPC XDR Driver (CVE-2026-69595) - High [430]

Description: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

Qualys: CVE-2026-69595 & CVE-2026-78445: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability The use-after-free flaw in Windows Services for NFS ONCRPC XDR Driver may allow an unauthenticated attacker to execute code over a network.

ZDI: CVE-2026-69510 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-69524 – Windows Active Directory Domain Services Remote Code Execution Vulnerability . CVE-2026-69530 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-69579 – Windows Message Queuing Remote Code Execution Vulnerability . CVE-2026-69590 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability . CVE-2026-69595 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability . CVE-2026-69730 – Windows DNS Server Remote Code Execution Vulnerability (SigRed’s spiritual successor) . CVE-2026-69858 – Windows DNS Server Remote Code Execution Vulnerability . CVE-2026-72936 – Windows SMB Client Remote Code Execution Vulnerability . CVE-2026-72979 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-72981 – IP Helper Remote Code Execution Vulnerability . CVE-2026-72982 – Windows Netlogon Remote Code Execution Vulnerability . CVE-2026-72983 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability . CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability . CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability . CVE-2026-73010 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78444 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78449 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-78450 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-83997 – Windows Message Queuing Remote Code Execution Vulnerability . Here’s the full list of CVEs released by Microsoft for September 2026:

23. Remote Code Execution - Windows Services for NFS ONCRPC XDR Driver (CVE-2026-78445) - High [430]

Description: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

Qualys: CVE-2026-69595 & CVE-2026-78445: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability The use-after-free flaw in Windows Services for NFS ONCRPC XDR Driver may allow an unauthenticated attacker to execute code over a network.

24. Remote Code Execution - Windows Shell (CVE-2026-69829) - High [430]

Description: Windows Shell Remote Code Execution Vulnerability

Qualys: CVE-2026-69829: Windows Shell Remote Code Execution Vulnerability  The heap-based buffer overflow flaw in Windows Shell may allow an unauthenticated attacker to execute code over a network. 

25. Remote Code Execution - Windows USB Mass Storage Class Driver (CVE-2026-68839) - High [430]

Description: Windows USB Mass Storage Class Driver Remote Code Execution Vulnerability

ZDI: The USB Stack: There are 23 bugs impacting the USB stack, but I really only want to talk about one. CVE-2026-68839 (USB Mass Storage Class Driver) with a CVSS of 9.8 and a network vector. The FAQ offers only the generic “in-network attacker calling arbitrary endpoints” boilerplate, which doesn't explain how a USB class driver is network-reachable. Either the metric is scored to worst case or there's a remote path (RDP device redirection would be the plausible one). I'd treat the score skeptically in print but patch like it's real.

26. Remote Code Execution - Windows DNS Server (CVE-2026-69782) - High [423]

Description: Windows DNS Server Remote Code Execution Vulnerability

27. Remote Code Execution - Windows DNS Server (CVE-2026-69813) - High [423]

Description: Windows DNS Server Remote Code Execution Vulnerability

Qualys: CVE-2026-69730, CVE-2026-69813, CVE-2026-69858, & CVE-2026-72987: Windows DNS Server Remote Code Execution Vulnerability  The use-after-free flaw in Windows DNS may allow an unauthenticated attacker to execute code over a network. 

28. Remote Code Execution - Windows DNS Server (CVE-2026-69827) - High [423]

Description: Windows DNS Server Remote Code Execution Vulnerability

Qualys: CVE-2026-69827: Windows DNS Server Remote Code Execution Vulnerability  A race condition flaw in the DNS Server may allow an unauthenticated attacker to execute code over a network.

29. Remote Code Execution - Windows DNS Server (CVE-2026-69858) - High [423]

Description: Windows DNS Server Remote Code Execution Vulnerability

Qualys: CVE-2026-69730, CVE-2026-69813, CVE-2026-69858, & CVE-2026-72987: Windows DNS Server Remote Code Execution Vulnerability  The use-after-free flaw in Windows DNS may allow an unauthenticated attacker to execute code over a network. 

ZDI: CVE-2026-69510 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-69524 – Windows Active Directory Domain Services Remote Code Execution Vulnerability . CVE-2026-69530 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-69579 – Windows Message Queuing Remote Code Execution Vulnerability . CVE-2026-69590 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability . CVE-2026-69595 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability . CVE-2026-69730 – Windows DNS Server Remote Code Execution Vulnerability (SigRed’s spiritual successor) . CVE-2026-69858 – Windows DNS Server Remote Code Execution Vulnerability . CVE-2026-72936 – Windows SMB Client Remote Code Execution Vulnerability . CVE-2026-72979 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-72981 – IP Helper Remote Code Execution Vulnerability . CVE-2026-72982 – Windows Netlogon Remote Code Execution Vulnerability . CVE-2026-72983 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability . CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability . CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability . CVE-2026-73010 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78444 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78449 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-78450 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-83997 – Windows Message Queuing Remote Code Execution Vulnerability . Here’s the full list of CVEs released by Microsoft for September 2026:

30. Remote Code Execution - Windows DNS Server (CVE-2026-69989) - High [423]

Description: Windows DNS Server Remote Code Execution Vulnerability

31. Remote Code Execution - Windows DNS Server (CVE-2026-72928) - High [423]

Description: Windows DNS Server Remote Code Execution Vulnerability

32. Remote Code Execution - Windows DNS Server (CVE-2026-77505) - High [423]

Description: Windows DNS Server Remote Code Execution Vulnerability

Qualys: CVE-2026-77505: Windows DNS Server Remote Code Execution Vulnerability  The use-after-free flaw in the DNS Server may allow an unauthenticated attacker to execute code over a network. 

33. Remote Code Execution - Windows SMB Client (CVE-2026-72936) - High [423]

Description: Windows SMB Client Remote Code Execution Vulnerability

ZDI: CVE-2026-69510 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-69524 – Windows Active Directory Domain Services Remote Code Execution Vulnerability . CVE-2026-69530 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-69579 – Windows Message Queuing Remote Code Execution Vulnerability . CVE-2026-69590 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability . CVE-2026-69595 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability . CVE-2026-69730 – Windows DNS Server Remote Code Execution Vulnerability (SigRed’s spiritual successor) . CVE-2026-69858 – Windows DNS Server Remote Code Execution Vulnerability . CVE-2026-72936 – Windows SMB Client Remote Code Execution Vulnerability . CVE-2026-72979 – Windows DHCP Server Remote Code Execution Vulnerability . CVE-2026-72981 – IP Helper Remote Code Execution Vulnerability . CVE-2026-72982 – Windows Netlogon Remote Code Execution Vulnerability . CVE-2026-72983 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability . CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability . CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability . CVE-2026-73010 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78444 – Microsoft Failover Cluster Remote Code Execution Vulnerability . CVE-2026-78449 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-78450 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability . CVE-2026-83997 – Windows Message Queuing Remote Code Execution Vulnerability . Here’s the full list of CVEs released by Microsoft for September 2026:

34. Remote Code Execution - DirectWrite (CVE-2026-73006) - High [419]

Description: DirectWrite Remote Code Execution Vulnerability

Qualys: CVE-2026-73006 & CVE-2026-78439: Microsoft Office Graphics Component Remote Code Execution Vulnerability  The stack-based buffer overflow flaw in Microsoft Graphics Component may allow an unauthenticated attacker to execute code over a network.

35. Remote Code Execution - DirectWrite (CVE-2026-73016) - High [419]

Description: DirectWrite Remote Code Execution Vulnerability

36. Remote Code Execution - Microsoft Exchange (CVE-2026-69355) - High [419]

Description: Microsoft Exchange Server Remote Code Execution Vulnerability

37. Remote Code Execution - Microsoft Office (CVE-2026-69285) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

Qualys: CVE-2026-69285 & CVE-2026-78505: Microsoft Office Remote Code Execution Vulnerability The heap-based buffer overflow flaw in Microsoft Office may allow an unauthenticated attacker to execute code over a network. 

38. Remote Code Execution - Microsoft Office (CVE-2026-69442) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

39. Remote Code Execution - Microsoft Office (CVE-2026-69632) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

Qualys: CVE-2026-69632, CVE-2026-69678, CVE-2026-69767, & CVE-2026-69797: Microsoft Office PowerPoint Remote Code Execution Vulnerability  The use-after-free flaw in Microsoft Office PowerPoint may allow an unauthenticated attacker to execute code over a network. 

40. Remote Code Execution - Microsoft Office (CVE-2026-78505) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

Qualys: CVE-2026-69285 & CVE-2026-78505: Microsoft Office Remote Code Execution Vulnerability The heap-based buffer overflow flaw in Microsoft Office may allow an unauthenticated attacker to execute code over a network. 

41. Remote Code Execution - Microsoft Office (CVE-2026-78524) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

42. Remote Code Execution - Microsoft Windows Media Foundation (CVE-2026-62706) - High [419]

Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

43. Remote Code Execution - Microsoft Windows Media Foundation (CVE-2026-62744) - High [419]

Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

44. Remote Code Execution - Microsoft Windows Media Foundation (CVE-2026-69386) - High [419]

Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

45. Remote Code Execution - Microsoft Windows Media Foundation (CVE-2026-69511) - High [419]

Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

46. Remote Code Execution - Microsoft Windows Media Foundation (CVE-2026-69601) - High [419]

Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Qualys: CVE-2026-69601: Microsoft Windows Media Foundation Remote Code Execution Vulnerability  The heap-based buffer overflow flaw in Microsoft Windows Media Foundation may allow an unauthenticated attacker to execute code over a network. 

47. Remote Code Execution - Windows Credential Providers (CVE-2026-69729) - High [419]

Description: Windows Credential Providers Remote Code Execution Vulnerability

48. Remote Code Execution - Windows DHCP Server (CVE-2026-69266) - High [419]

Description: Windows DHCP Server Remote Code Execution Vulnerability

ZDI: Windows DHCP Server: Windows DHCP Server chimes in with 36 bugs: 12 RCE, 18 DoS, five info leaks, and one EoP. Nothing exploited or disclosed, but 22 of the 36 require no authentication. It's the third-largest single-component pile of the month, and it's all one story: someone pointed a (likely AI-assisted) fuzzer at DHCP packet parsing. In addition to the two wormable bugs already mentioned, there are three more that didn’t carry the exact wormable verbiage but look like close cousins: CVE-2026-69845 (9.8, heap overflow), CVE-2026-69266 (8.8, integer overflow), and CVE-2026-69620 (8.1, stack overflow). If you're being generous, that's five wormable-shaped bugs in DHCP Server alone. The remaining seven RCEs need an authorized attacker. CWE spread is pure memory corruption: heap, stack, UAF, integer overflow. There are 18 DoS bugs, and 13 are unauthenticated at a CVSS score of 7.5. Malformed packet in, service crash out. Individually boring, but collectively, an unauthenticated attacker on the network has 13 different ways to take out DHCP, and when DHCP dies, clients stop getting leases and the helpdesk phone starts ringing. Finally, there are a couple of oddballs here: CVE-2026-69297 is an info leak that could expose passwords stored in a recoverable format, which is a configuration-secrets problem rather than a memory bug. The lone EoP is missing authentication on a critical function.

49. Remote Code Execution - Windows DHCP Server (CVE-2026-69547) - High [419]

Description: Windows DHCP Server Remote Code Execution Vulnerability

50. Remote Code Execution - Windows Event Logging Service (CVE-2026-69494) - High [419]

Description: Windows Event Logging Service Remote Code Execution Vulnerability

51. Remote Code Execution - Windows Event Logging Service (CVE-2026-69495) - High [419]

Description: Windows Event Logging Service Remote Code Execution Vulnerability

52. Remote Code Execution - Windows Graphics Component (CVE-2026-81955) - High [419]

Description: Windows Graphics Component Remote Code Execution Vulnerability

Qualys: CVE-2026-81955: Windows Graphics Component Remote Code Execution Vulnerability  The heap-based buffer overflow flaw in Microsoft Graphics Component may allow an unauthenticated attacker to execute code over a network. 

53. Remote Code Execution - Windows Imaging Component (CVE-2026-69499) - High [419]

Description: Windows Imaging Component Remote Code Execution Vulnerability

Qualys: CVE-2026-69499: Windows Imaging Component Remote Code Execution Vulnerability  An integer overflow flaw in Windows Imaging Component may allow an unauthenticated attacker to execute code over a network. 

54. Remote Code Execution - Windows Imaging Component (CVE-2026-69860) - High [419]

Description: Windows Imaging Component Remote Code Execution Vulnerability

Qualys: CVE-2026-69860, CVE-2026-73013, CVE-2026-73023, & CVE-2026-77495: Windows Imaging Component Remote Code Execution Vulnerability The heap-based buffer overflow flaw in Windows Imaging Component may allow an unauthenticated attacker to execute code over a network. 

55. Remote Code Execution - Windows Imaging Component (CVE-2026-73013) - High [419]

Description: Windows Imaging Component Remote Code Execution Vulnerability

Qualys: CVE-2026-69860, CVE-2026-73013, CVE-2026-73023, & CVE-2026-77495: Windows Imaging Component Remote Code Execution Vulnerability The heap-based buffer overflow flaw in Windows Imaging Component may allow an unauthenticated attacker to execute code over a network. 

56. Remote Code Execution - Windows Imaging Component (CVE-2026-73023) - High [419]

Description: Windows Imaging Component Remote Code Execution Vulnerability

Qualys: CVE-2026-69860, CVE-2026-73013, CVE-2026-73023, & CVE-2026-77495: Windows Imaging Component Remote Code Execution Vulnerability The heap-based buffer overflow flaw in Windows Imaging Component may allow an unauthenticated attacker to execute code over a network. 

57. Remote Code Execution - Windows Imaging Component (CVE-2026-77495) - High [419]

Description: Windows Imaging Component Remote Code Execution Vulnerability

Qualys: CVE-2026-69860, CVE-2026-73013, CVE-2026-73023, & CVE-2026-77495: Windows Imaging Component Remote Code Execution Vulnerability The heap-based buffer overflow flaw in Windows Imaging Component may allow an unauthenticated attacker to execute code over a network. 

58. Remote Code Execution - Windows Imaging Component (CVE-2026-83992) - High [419]

Description: Windows Imaging Component Remote Code Execution Vulnerability

59. Remote Code Execution - Windows Kerberos (CVE-2026-69676) - High [419]

Description: Windows Kerberos Remote Code Execution Vulnerability

Qualys: CVE-2026-69676: Windows Kerberos Remote Code Execution Vulnerability  An authentication-bypass flaw via capture-replay in Windows Kerberos may allow an authenticated attacker to execute code over a network. 

Tenable: CVE-2026-69676 | Windows Kerberos remote code execution vulnerability

Tenable: CVE-2026-69676 is an RCE vulnerability affecting Windows Kerberos. It received a CVSSv3 score of 8.8 and is rated critical. An attacker with low-level access could exploit this authentication bypass flaw using capture-replay against Windows Kerberos in order to execute arbitrary code. Microsoft assesses this flaw as “Exploitation More Likely.”

ZDI: Kerberos and the KDC: Six different bugs affect these components, but it’s the two Critical rated ones that raised my eyebrows. Six bugs across Kerberos and the KDC — two Critical RCEs, two EoPs, and two DoS. Nothing exploited or disclosed, but one carries the rating that matters. CVE-2026-69676 is an RCE in Kerberos with a CVSS of 8.8 and classified as Exploitation More Likely. An authenticated attacker with low-level access sends a crafted request and executes code on the server, no user interaction. “The server” here means a domain controller, and any authenticated attacker means any domain user. So the realistic read is: one phished workstation account, one crafted request, code execution on the DC. That's a domain-compromise primitive, and Microsoft expects to see it exploited. CVE-2026-69712 is in KDC and reads almost identical to the previous: authenticated, low-level access, crafted request, code on the server, no interaction, but this one's a use-after-free in the KDC itself, the component that mints every ticket in the domain. Its practical impact is identical to 69676; only the exploitability rating separates them.

60. Remote Code Execution - Windows Key Distribution Center (CVE-2026-69712) - High [419]

Description: Windows Key Distribution Center Remote Code Execution Vulnerability

Qualys: CVE-2026-69712: Windows Key Distribution Center Remote Code Execution Vulnerability  The use-after-free flaw in the Windows Key Distribution Center may allow an authenticated attacker to execute code over a network. 

ZDI: Kerberos and the KDC: Six different bugs affect these components, but it’s the two Critical rated ones that raised my eyebrows. Six bugs across Kerberos and the KDC — two Critical RCEs, two EoPs, and two DoS. Nothing exploited or disclosed, but one carries the rating that matters. CVE-2026-69676 is an RCE in Kerberos with a CVSS of 8.8 and classified as Exploitation More Likely. An authenticated attacker with low-level access sends a crafted request and executes code on the server, no user interaction. “The server” here means a domain controller, and any authenticated attacker means any domain user. So the realistic read is: one phished workstation account, one crafted request, code execution on the DC. That's a domain-compromise primitive, and Microsoft expects to see it exploited. CVE-2026-69712 is in KDC and reads almost identical to the previous: authenticated, low-level access, crafted request, code on the server, no interaction, but this one's a use-after-free in the KDC itself, the component that mints every ticket in the domain. Its practical impact is identical to 69676; only the exploitability rating separates them.

61. Remote Code Execution - Windows Media Player (CVE-2026-70203) - High [419]

Description: Windows Media Player Remote Code Execution Vulnerability

Qualys: CVE-2026-70203 & CVE-2026-72960: Windows Media Player Remote Code Execution Vulnerability  The heap-based buffer overflow flaw in Windows Media Player may allow an unauthenticated attacker to execute code over a network. 

62. Remote Code Execution - Windows Media Player (CVE-2026-72960) - High [419]

Description: Windows Media Player Remote Code Execution Vulnerability

Qualys: CVE-2026-70203 & CVE-2026-72960: Windows Media Player Remote Code Execution Vulnerability  The heap-based buffer overflow flaw in Windows Media Player may allow an unauthenticated attacker to execute code over a network. 

63. Remote Code Execution - Windows NTFS (CVE-2026-69461) - High [419]

Description: Windows NTFS Remote Code Execution Vulnerability

ZDI: Windows NTFS: We have 30 bugs in this component: 16 EoP, 10 RCE, three info leaks, and one link-following oddball. All Important except the two 9.8 Critical RCEs. Like Biometric and DHCP, it's one bug class on repeat: 28 of 30 are memory-safety flaws (heap overflows lead at 12, then out-of-bounds reads). The headliner is CVE-2026-69463; simple heap-overflow RCE at 9.8, unauthenticated, network vector. The FAQ only offers the vague “in-network attacker calling arbitrary endpoints” phrasing, which likely means the remote path is something like SMB-reachable file operations rather than a raw packet, but a 9.8 in the file system driver everyone runs is still a top-tier patch either way. CVE-2026-69461 (8.8, stack overflow, unauth network) rides along just below them. Everything else can be somewhat dismissed as local-only noise, but remember the mount-a-drive trio that where “requires physical access” describes every USB port in the building.

64. Remote Code Execution - Windows Network File System (CVE-2026-69772) - High [419]

Description: Windows Network File System Remote Code Execution Vulnerability

65. Remote Code Execution - Windows OLE DB (CVE-2026-78442) - High [419]

Description: Windows OLE DB Remote Code Execution Vulnerability

66. Remote Code Execution - Windows Paint (CVE-2026-70586) - High [419]

Description: Windows Paint Remote Code Execution Vulnerability

Qualys: CVE-2026-70586: Windows Paint Remote Code Execution Vulnerability  The heap-based buffer overflow flaw in Windows Paint may allow an unauthenticated attacker to execute code over a network. 

67. Remote Code Execution - Windows Print Spooler (CVE-2026-85877) - High [419]

Description: Windows Print Spooler Remote Code Execution Vulnerability