Whelp, here we are. Deep into the new normal. With nearly 1,000 CVEs coming out from Microsoft and a healthy release from Adobe as well, there’s a phrase from my military days that comes to mind: embrace the suck. Take an extend break from your regularly scheduled activities as we take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release.

Adobe Patches for September 2026

For the first part of the August release, Adobe released 10 bulletins addressing 172 unique CVEs in Adobe ColdFusion, Acrobat Reader, Commerce (two bulletins), Campaign Classic, Experience Manager, Photoshop, Illustrator, Animate, and Adobe Photoshop Mobile. A total of 22 of these were submitted through the ZDI program.

Here’s this month’s overview table:

Clearly, the priority here is the Commerce bug currently under active attack. Campaign Classic and ColdFusion also clock in with a deployment priority of 1. The Acrobat Reader should also be a priority. It contains 32 CVEs, including many code execution bugs, and PDFs are a favorite of attackers. The Experience Manager has plenty of CVEs being patched and also rates a deployment priority of 2.

Besides the one bug in Commerce, none of the other Adobe bugs receiving patches this month are listed as publicly known or under active attack at the time of release.

Microsoft Patches for September 2026

It’s a new record release from Microsoft, but, again, that seems to be the new normal. As always, counting this beast is tricky, but I see 972 new CVEs rolling out from Redmond this month. As with last month, only a single CVE is listed as being under active attack, so that’s something, I suppose. As for the products affected by this release, we have Windows and Windows components, Office and Office Components, Azure and Azure Components, .NET and Visual Studio, Active Directory, Copilot Studio, Dynamics, Edge (Chromium-based), DHCP Server and Client, DNS Server, Exchange Server, Teams for Android, OpenSSH, Remote Desktop Client and Server, Skype for Business, Biometric Service, SQL Server, Windows Hello, Xbox, and Defender. Along with the external and Chromium bugs being documented this month, this drives the total CVE count to a staggering 997. Of these new CVEs, 114 are rated Critical, with the rest being rated Important.

To provide a little historical context on how many CVEs have been patched by Microsoft this year, let’s take a look at some year-over-year totals:

On the one hand, congrats to the security gnomes at Microsoft for being able to patch bugs at this rate. On the other hand, AI-assisted vulnerability discovery shows no signs of slowing down. However, we have not seen a correlating spike in active exploits – yet.  

As always, we’ll start with the bugs under active attack and move on from there.  

-              CVE-2026-81963 - Windows Update Stack Elevation of Privilege Vulnerability
This is the first bug being exploited in the wild, but we know little about how broadly that exploitation is. The bug itself is a privilege escalation in the Update Stack, which is worrisome, but I doubt the automatic update process itself is compromised. More likely is that this bug is being combined with a code execution bug to spread malware or ransomware. Patch this one quickly.

-              CVE-2026-85880 - Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
This is the other bug currently being exploited, and it is also a privilege escalation bug. These types of bugs must be triggered by the user, but they can hide within documents, PDFs, and other attachments. As with the Update Stack EoP, we don’t know how widespread these exploits may be, so assume they are coming for you and patch quickly.

-              CVE-2026-55007 - Microsoft Exchange Server Remote Code Execution Vulnerability
There are several Exchange patches this month, but despite the CVSS rating, I find this one most important. A remote, unauthenticated attacker could get code execution on an affected Exchange server just by sending an email with a malicious Visio attachment. The code execution occurs when the server processes the mail – no need even for the Preview Pane. Microsoft states the exploit would be unreliable, but the attacker only needs to get it right once. Schedule your downtime and update your Exchange servers with haste.

 -              CVE-2026-80097 - Microsoft Authenticator Elevation of Privilege Vulnerability
This is the worst type of privilege escalation as it uses a bug in the authentication system itself. An attacker would need to install a malicious app on an Android device, then convince a user to complete the authentication sequence. Once done, the attacker gets the auth tokens and can access resources as the affected user. If you have a large Android user base, best not to ignore this one.

-              CVE-2026-69465 - Microsoft Office SharePoint Remote Code Execution Vulnerability
I count 17 different SharePoint bugs in this release, with four leading to code execution. On its own, this bug doesn’t look like the worst, but SharePoint has been a popular target recently, and these are the types of bugs being used. An authenticated user can submit a page that bypasses a control-safety check, causing the affected server to load code from a filesystem under the attacker’s control. If you have SharePoint servers accessible from the internet, test and deploy these updates quickly.

-              CVE-2026-65669 - Microsoft SQL Server Elevation of Privilege Vulnerability
Speaking of AI-assisted code audits, there are over 60 patches for SQL Server in the September release. This bug even has an AI component, as the attacker would need to convince a user to submit specially crafted instructions to SQL Copilot in SQL Server Management Studio. So there’s the user interaction component, but if they succeed, the attacker could gain access to the database at the user’s permission level. Patching SQL Server will not be trivial this month, so take your time with your testing and really guard those SQL Servers that may be connected to the Internet.

-              CVE-2026-69525 - Remote Desktop Services Remote Code Execution Vulnerability
This CVSS 9.8 bug allows remote, unauthenticated attackers to run arbitrary code on affected systems via a Use-After-Free bug. Microsoft notes it needs to be an “in-network attacker”, but the CVSS still says Network. Since many enterprises rely on RDP, I would treat this one seriously and test and deploy the patch soonest.

So where are the wormable bugs, you may ask? Well, quite frankly, there are too many to single out. I count 20 different patches that could all be classified as wormable.  In each of these cases, a remote, unauthenticated attacker could get arbitrary code execution on affected systems with no user interaction. While some might be more exploitable than others, having 20 of them in a single release is something else. These are the ones I found (presented in no particular order):

• CVE-2026-69510 – Windows DHCP Server Remote Code Execution Vulnerability

• CVE-2026-69524 – Windows Active Directory Domain Services Remote Code Execution Vulnerability

• CVE-2026-69530 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

• CVE-2026-69579 – Windows Message Queuing Remote Code Execution Vulnerability

• CVE-2026-69590 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

• CVE-2026-69595 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

• CVE-2026-69730 – Windows DNS Server Remote Code Execution Vulnerability (SigRed’s spiritual successor)

• CVE-2026-69858 – Windows DNS Server Remote Code Execution Vulnerability

• CVE-2026-72936 – Windows SMB Client Remote Code Execution Vulnerability

• CVE-2026-72979 – Windows DHCP Server Remote Code Execution Vulnerability

• CVE-2026-72981 – IP Helper Remote Code Execution Vulnerability

• CVE-2026-72982 – Windows Netlogon Remote Code Execution Vulnerability

• CVE-2026-72983 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

• CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability

• CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

• CVE-2026-73010 – Microsoft Failover Cluster Remote Code Execution Vulnerability

• CVE-2026-78444 – Microsoft Failover Cluster Remote Code Execution Vulnerability

• CVE-2026-78449 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

• CVE-2026-78450 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

• CVE-2026-83997 – Windows Message Queuing Remote Code Execution Vulnerability

Here’s the full list of CVEs released by Microsoft for September 2026: