We are late with this one, and in hindsight that turned out to be useful. Writing about September a month after the fact means writing about what actually happened after the release, not just what was in it. In September those were two different stories.
The release itself landed on the 8th with a new record: Tenable counted 964 CVEs, 104 rated Critical and 860 Important, which beats July's record by a wide margin. BleepingComputer counted 966, Computerworld 963 requiring customer action, and Action1 995 once republished third-party CVEs are folded in. Windows alone accounted for 723 of them, followed by Office at 111, SQL Server at 62, SharePoint Server at 16, and Exchange Server at 9. Elevation of privilege made up nearly 45 percent of the total and remote code execution about 27 percent.
We said in July that the volume was the story and in August that it was not. September is a third case: the volume matters less than where two of the flaws sat, and what the update did to the machines that installed it.
A zero-day in the thing that installs the fixes
CVE-2026-81963 is a link-following flaw in the Windows Update Stack. A local attacker abuses it to reach SYSTEM. It scored 7.8 and was rated Important. Since 2022 there have been seven Windows Update Stack elevation of privilege bugs patched on Patch Tuesday, and this is the first one confirmed exploited in the wild before a fix existed.
The second zero-day, CVE-2026-85880, is a buffer overflow in Advanced Local Procedure Call, also 7.8, also Important, also SYSTEM. ALPC has seen 16 patched vulnerabilities since 2022, but this is the first ALPC fix to ship on a Patch Tuesday since April 2023, and only the second exploited as a zero-day since CVE-2023-21674 in January of that year. Microsoft has not published details on who is using either one.
Both were privilege escalation, both scored below 8.0, and both were Important rather than Critical, which repeats the lesson from August's afd.sys zero-day: the flaws that get exploited are frequently the ones a severity filter puts at the back of the queue.
The Update Stack one deserves more than that, though. The update agent is the component every remediation workflow trusts implicitly. It runs as SYSTEM on every Windows machine you own, it reaches out on a schedule, it writes to protected locations, and it is exactly the service an attacker wants to be indistinguishable from. A flaw there is not only a path to SYSTEM. It is a path to SYSTEM inside the process your security tooling is least likely to second-guess. It is the same category of problem we wrote about in our WSUS deep-dive: the patching infrastructure is a higher-value target than the things it patches.
Then the patch broke Remote Desktop
Within days of the release, Remote Desktop Services hosts that had taken the September cumulative update started failing. RDP connections dropped after a few minutes, sign-ins failed, and some servers hung during Remote Desktop configuration. Microsoft acknowledged the issue on September 11 and quietly published a Known Issue Rollback to be deployed through Group Policy. On September 14 it shipped around ten out-of-band updates across Windows 11, Windows 10, and Windows Server to fix it, along with broken Hyper-V Plan9 folder sharing for Linux guests and USB Audio Class 1.0 devices that stopped producing sound.
Here is the part that matters. A cumulative update cannot be partially uninstalled. Every RDS administrator who rolled back the September update to get their farm working again also removed the fixes for both exploited zero-days, including the one in Windows Update itself. For somewhere between three and six days, depending on how quickly each shop moved, a meaningful slice of the RDS estate was knowingly running without fixes for two flaws under active attack, because the alternative was an outage.
That was a rational decision for most of the people who made it. It is also a decision that most patch reporting cannot see. A machine that installed the September update and then uninstalled it looks, to a lot of tooling, like a machine that "had September," because the install event happened. The question that mattered between the 11th and the 14th was not whether the update was deployed. It was which build is running right now, and whether anything was removed after the fact.
The fix that shipped late
There is a smaller oddity buried in the out-of-band release. KB5129195 also carries the fix for CVE-2026-62721, an elevation of privilege flaw in the Windows User-Mode Power Service. As far as anyone has been able to tell, that fix was supposed to be in the September Windows 11 update and was not. A security fix arriving in an emergency stability patch, six days after the release it belonged to, is easy to miss, and it means an environment that installed September and skipped the out-of-band update on the grounds that it did not run RDS was still exposed to something it believed was fixed.
The criticals, by role
As in August, the Critical remote code execution cluster lives in server roles rather than the general OS surface, and more than twenty entries this month were assessed as potentially wormable. The standouts:
CVE-2026-69730 in DNS Server, 9.8, an unauthenticated use-after-free reachable with a crafted packet, assessed as Exploitation More Likely. Eight more DNS Server RCEs shipped alongside it. CVE-2026-69676, a Critical Kerberos RCE at 8.8 built on a capture-replay authentication bypass, also Exploitation More Likely. DHCP Server, Netlogon, RRAS, SSTP, SMB, Message Queuing, Failover Clustering, NFS, and the RMCAST driver all carried server-side entries. Domain controllers, resolvers, and DHCP servers are the first place to look.
One worth flagging for the severity point above: CVE-2026-69525 in Remote Desktop Services is a 9.8 use-after-free assessed Exploitation More Likely, and Microsoft rated it Important, not Critical.
On the client side, CVE-2026-78510 in Word and CVE-2026-78509 in Outlook are both Critical 9.8 RCEs in rendering paths that fire on preview or open. Skype for Business Server took ten entries, led by CVE-2026-66302 at 9.8. Exchange took CVE-2026-69380, an 8.1 missing-authorization flaw that lets a low-privilege mailbox user read and send as other users.
Deployment notes
KB5124008 covers Windows 11 25H2 and 24H2, producing builds 26200.9445 and 26100.9445. 23H2 received KB5122880 and 26H1 received KB5124012. Windows Server 2025 took KB5122871. The out-of-band replacements from September 14 are KB5129195 for 25H2 and 24H2 (builds .9457), KB5129194 for 26H1, KB5129235 for Server 2025, and KB5129236 for Windows 10. They are cumulative, so a machine that rolled back September can go straight to the out-of-band build.
Two issues outlived the out-of-band fix. File History backups stopped working after September, resolved in the September 22 preview KB5124010 and later. Sporadic explorer.exe crashes were left for a future update, and the USB audio fix was only partial. Windows 11 26H2 also reached general availability on September 29 through an enablement package.
Everything else in September
Adobe shipped an emergency hotfix the day before Patch Tuesday for CVE-2026-75650, an arbitrary code execution flaw in Adobe Commerce and Magento Open Source that Adobe confirmed was being exploited in the wild, then followed with a large batch of bulletins on the 8th spanning ColdFusion, Acrobat Reader, Commerce, and Experience Manager.
SAP released 19 new security notes. The top one, CVE-2026-44756, is a memory corruption flaw in SAP Extended Passport processing rated a maximum 10.0. CVE-2026-58240 is a missing authentication check in the NetWeaver Message Server, and CVE-2026-76969 is a credential disclosure issue in multitenant applications built on the sap/cds-mtxs library. HPE patched a critical RCE in ArubaOS-CX, and Cisco, Fortinet, VMware, and Zoom all shipped updates the same week.
Later in the month, Oracle's September Critical Security Patch Update covered 672 CVEs on the 15th, and reported zero-days in Citrix NetScaler surfaced near the end of the month. Neither lands on Patch Tuesday, and both are the kind of thing a monthly cadence is not built to absorb.
What September actually says
Every month we come back to the same gap from a different direction. In August it was ranking: the exploited flaw sat below the line. In September it is state. The release fixed a zero-day in the update agent, the update itself broke a core server role, administrators pulled it back out to stay in business, and Microsoft shipped a replacement that also carried a fix it had left out. Over six days the correct answer to "is this machine protected against the September zero-days" changed at least three times for a large number of servers.
A dashboard that records that an update was deployed cannot answer that question. What answers it is the current build on the machine, checked against what that build is supposed to contain, including anything rolled back and anything that only arrived out of band. That is less exciting than a 964-CVE headline, and it is the part that decided whether those servers were actually exposed.
October's release lands today. Windows Server 2022 moves to extended support and Windows 11 24H2 Home and Pro reach end of updates on the same day, so if your upgrade rings were waiting on September to settle, the window has closed.