Key Stats: 971 Fixes in Total
- Critical: 112
- Important: 857
- Moderate: 1
- Low: 1
- Weaponized: 1
- Publicly Known: 0
This month's release covers Windows, Office, Outlook, SharePoint, Exchange, SQL Server, Azure services, Entra ID, and core operating system components. 112 Critical vulnerabilities is a big number, and a handful of them carry a perfect or near-perfect CVSS score of 10.0 or 9.9. Naturally, that's where the eye goes first.
But the one vulnerability Microsoft confirms is already being exploited isn't on that list at all. It's rated Important. It has no published CVSS score. And it's the kind of bug that only matters once an attacker is already standing on the doorstep.
That's the pattern I want to dig into this month. A CVSS score tells you how bad a vulnerability is in isolation. It doesn't tell you where that vulnerability sits in an attack chain, the sequence of steps an attacker takes to turn a foothold into full control. This month, the CVE that matters most for the chain isn't the one with the highest score.
CVE-2026-81963: The Vulnerability Nobody Scored
This is a Windows Update Stack Elevation of Privilege vulnerability, caused by improper link resolution before file access, a classic "link following" flaw. Microsoft confirms exploitation has already been detected, and a successful attacker gains SYSTEM privileges.
What makes this one stand out is what it doesn't have: no CVSS score, no Critical label, no publicly known disclosure ahead of the patch. If you were sorting this month's release by severity alone, it would sit well down the list. If you sort by what attackers are actually doing right now, it's at the top.
This is the same shape as CVE-2026-68820 last month, the WinSock elevation flaw already being exploited. Neither one gets an attacker onto a device by itself. Both turn a foothold into full control. Vulnerabilities like this rarely make headlines, but they're exactly the ones worth checking your exposure to first.
The Preview Pane, Still an Attack Vector
Regular readers of this column know the Preview Pane keeps coming back, and September doesn't break the streak.
CVE-2026-78509 and CVE-2026-78510 are Critical Microsoft Office Outlook Remote Code Execution vulnerabilities, both scoring 9.8, both caused by heap-based buffer overflows, and both flagged by Microsoft with the same note: the Preview Pane is an attack vector. CVE-2026-78505 (Office RCE) and CVE-2026-81952 (Word RCE) carry the identical warning.
That means four separate code paths this month where simply previewing a malicious file, no click, no macro, no "enable content" needed, is enough to hand an attacker code execution. It's a low-friction way onto an endpoint, and low-friction is exactly what the first stage of an attack chain needs.
SharePoint's Surface Keeps Growing
SharePoint shows up again too, with 16 CVEs this month spanning Remote Code Execution, Elevation of Privilege, Spoofing, and Information Disclosure. None are individually the loudest CVE in the release, but taken together they describe a platform with a genuinely wide attack surface. As I said last month, SharePoint is somewhere organizations already trust. That trust is precisely what makes controlling it valuable to an attacker, and precisely why the volume here deserves attention even without a single standout Critical score.
Worth Noting: The 10.0s That Need Nothing From You
Three of this month's highest-scoring vulnerabilities, CVE-2026-70352 (Azure AI Language EoP, 10.0), CVE-2026-83711 (Azure AD B2C EoP, 10.0), and CVE-2026-83941 (Entra ID EoP, 9.9), are already fully mitigated by Microsoft on the service side. No customer action is required for any of them. They're worth knowing about for risk reporting, but they shouldn't compete with your patch cycle for attention this week.
Special Mention: A Guest-to-Host-to-VTL1 Chain Worth Watching
One combination in this release deserves a flag even though it's not confirmed as exploited: a potential path from inside a virtual machine all the way through to the Virtualization-Based Security boundary on the host.
CVE-2026-69910 and CVE-2026-80083 are both Windows Hyper-V Remote Code Execution vulnerabilities that let a process running inside a guest VM reach code execution on the host. Microsoft's guidance describes CVE-2026-69910 as exploitable via malicious TPM commands sent from the guest, and CVE-2026-80083 via a specially crafted application run on the guest. Either way, that's already a serious boundary crossing: a guest breaking out to the host it runs on.
CVE-2026-72961 is a separate Hyper-V Elevation of Privilege vulnerability. Here we're speculating on a plausible chain, not reporting a confirmed one. On its own, it lets an attacker with admin access to the host use crafted virtual TPM data to reach VTL1 (Virtual Trust Level 1), the isolated "secure kernel" that even a compromised regular Windows environment (VTL0) can't touch, and where Credential Guard keeps domain credentials safe.
Line them up and the shape is: compromise a guest VM, break out to the host via a TPM or application-level bug, then use a second TPM bug to climb past VTL0 into VTL1. If that holds up end to end, a VM-level compromise could undermine credential protections most organizations treat as a hard boundary.
Special Mention: RRAS as a Possible Edge-to-Domain Bridge
A second combination worth flagging separately, for the same reason: real CVEs, plausible connection, not a confirmed attack path.
CVE-2026-69590 is an unauthenticated Windows Routing and Remote Access Service (RRAS) Remote Code Execution vulnerability. RRAS is typically deployed at the network edge, VPN gateways, routing services facing untrusted networks, which makes an unauthenticated RCE there a meaningful first-stage target.
Two more RRAS RCEs this month, CVE-2026-72950 and CVE-2026-72959, both require only "an authenticated attacker with low-level access to an affected server." That's exactly the position an attacker would be in immediately after successfully exploiting CVE-2026-69590, with no additional credentials or lateral movement needed, just the low-level foothold the first bug already handed them.
Strung together, the shape is: an unauthenticated attacker on the network reaches an edge-facing RRAS box, gets code execution, and that same low-level access is sufficient to trigger two further RCEs on the service. RRAS isn't installed by default, and it isn't something that turns on by accident, but it can be running on more servers than a quick inventory would suggest. It ships bundled with DirectAccess under the same "Remote Access" role, so a server set up years ago for DirectAccess is running RRAS underneath, even if nobody on the team today would think to call it a "VPN server." Worth checking for that blind spot specifically, not just searching your fleet for anything labeled RRAS.
Whether this actually extends further into domain infrastructure depends on something we can't determine from the advisory alone: whether the RRAS servers in your environment are standalone edge appliances or co-located with other domain-facing roles. If RRAS sits on a box that also touches AD, DNS, or Netlogon, this stops being a self-contained RRAS problem. That's worth confirming against your own network before deciding how much urgency this deserves.
How to Be the Hero This Month: Follow the Exploit, Not the Score
- Patch CVE-2026-81963 without delay. It's already being exploited, regardless of its Important rating and missing CVSS score. Severity labels describe potential impact; exploitation status describes what's actually happening.
- Treat the Preview Pane as a live attack surface. Four separate RCE paths this month rely on it. Maintain strong attachment filtering, keep Attack Surface Reduction rules current, and consider whether Preview Pane needs to be enabled by default for every user group.
- Review SharePoint as a system, not sixteen line items. Restrict administrative privileges, monitor for unusual permission changes and file uploads, and patch the full set rather than cherry-picking the highest CVSS entry.
- Don't let a 10.0 distract you from a bug with no score at all. This month's Azure/Entra Critical vulnerabilities need no customer action. The unscored, Important-rated one very much does.
- Ask what an attacker does next, not just what CVSS says now. An EoP bug that only works after initial access, and an RCE bug that only needs a preview pane, describe two ends of the same chain.
- If you run shared Hyper-V infrastructure, look closely at the VTL1 chain above. It isn't confirmed end to end, but the individual pieces are real, and the potential blast radius, undermining Credential Guard from inside a guest VM, is worth ruling out rather than assuming away.
- Check whether your RRAS servers are edge-only or domain-connected. If they touch AD, DNS, or Netlogon, the RRAS chain above deserves more urgency than three isolated CVEs would suggest.
- Prioritize resilience alongside prevention. When prevention fails, recovery speed is what limits the damage. Absolute enables organizations to rapidly restore compromised endpoints at scale using firmware-embedded Absolute Persistence® and automated Absolute Rehydrate® capabilities, helping reduce downtime and operational strain during major incidents.
Patch smart. Build resilience. Happypatching.
See the September 2026 Patch Tuesday Chart (PDF).
Kindregards,
Rob
