What’s New Wednesday: September 2026 September 9, 2026 – Posted in: Cyber Security, IT Support, What's New Wednesdays – Tags: Cyber Security, CyberEssentials, cybersecurity, ITSupport, Patch Tuesday, patching, SoftwareSupport, WhatsNewWednesday
Welcome to Patch Tuesday September 2026, this month Microsoft has released patches for 966 flaws including 2 zero-day vulnerabilities. In July and August a record breaking in the number of patches were released, and in September we have nearly twice as many patches as August. Running updates on all your software including browsers and Adobe Suite is becoming even more important so please make sure you run updates and restart your PC today. We may restart some of your servers overnight this week if a patch requires it.
It’s not just how many patches being released that has increased, the regularity has gone up too. Keep an eye out for requests to update your PC – Microsoft usually only release patches outside of the regular cycle if they are critically important and many other software providers are now releasing patches two or three times a month. Keep an eye on your browsers – if it says it needs to restart Chrome/ Edge/ Firefox/ Safari for updates in the top right corner, restart your browser. Check the about section on your phone regularly and run updates when they are available. There may not be anything critical inside something like Zoom, but a hacker may be able to use it as a door into your computer and access your business critical, up to date software and the data inside it. All the software you use on your computer should be updated regularly, and any you don’t use regularly should be uninstalled.
NEW THIS WEDNESDAY
Overall Microsoft patched:
- 438 Elevation of Privilege Vulnerabilities
- 19 Security Feature Bypass vulnerabilities
- 258 Remote Code Execution Vulnerabilities
- 173 Information Disclosure Vulnerabilities
- 56 Denial of Service Vulnerabilities
- 16 Spoofing Vulnerabilities
There were 2 zero-day vulnerabilities patched:
CVE-2026-81963 – Windows Update Stack Elevation of Privilege Vulnerability
Improper link resolution before file access (‘link following’) in Windows Update Stack allowed an authorized attacker to elevate privileges locally.
CVE-2026-85880 – Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
A Windows Advanced Local Procedure Call (ALPC) flaw that was exploited in attacks to gain SYSTEM privileges.
Releases from other software providers include:
- Adobe – a max-severity zero-day Adobe Commerce vulnerability dubbed StyleSmuggler that was exploited in attacks to backdoor websites.
- Cisco – updates for multiple products, including Cisco IOS XR, Cisco Nexus 9000 Series Switches, and Cisco Phones.
- ConnectWise – mitigations for a ScreenConnect Remote Access vulnerability that it plans to patch later this week.
- CrowdStrike warned customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting after an anonymous researcher released a zero-day flaw for the software.
- Google – Chrome security updates for an actively exploited high-severity zero-day flaw in the V8 engine and 11 other vulnerabilities.
- Hewlett Packard Enterprise – patched a critical RCE vulnerability in the ArubaOS-CX network operating system.
- MicroTik – updates for two actively exploited flaws used to hijack devices over SSH.
- N-Able – an emergency hotfix for a maximum-severity remote code execution flaw affecting its N-central RMM platform believed to potentially exploited in attacks.
- Plex – updates for multiple vulnerabilities this week, they urged customers to install them as soon as possible with no further details.
- SAP – updates for numerous products, including a maximum-severity “OVERPASS” flaw in the SAP Kernel code.
- SonicWall – updates for two SMA1000 zero-day vulnerabilities that are being chained in RCE attacks.
LIST OF CRITICAL PATCHES
We used to list all published patches from Microsoft here, however with the recent AI-fuelled increase in the number of patches this blog would be too long to read. Going forward we will list only the critical patches.
| Vulnerable Service | CVE ID | CVE Title | Severity |
| Azure AI Language | CVE-2026-70352 | Azure AI Language Elevation of Privilege Vulnerability | Critical |
| Azure Cosmos DB | CVE-2026-69857 | Azure Cosmos DB Spoofing Vulnerability | Critical |
| Copilot Studio | CVE-2026-80098 | Copilot Studio Elevation of Privilege Vulnerability | Critical |
| Entra ID | CVE-2026-83941 | Entra ID Elevation of Privilege Vulnerability | Critical |
| Graphic Fonts | CVE-2026-72986 | Graphic Fonts Remote Code Execution Vulnerability | Critical |
| Graphic Fonts | CVE-2026-73018 | Graphic Fonts Remote Code Execution Vulnerability | Critical |
| IP Helper | CVE-2026-72981 | IP Helper Remote Code Execution Vulnerability | Critical |
| Mariner | CVE-2026-85507 | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info). | Critical |
| Mariner | CVE-2026-85508 | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info). | Critical |
| Mariner | CVE-2026-85509 | FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested. | Critical |
| Mariner | CVE-2026-85506 | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info). | Critical |
| Mariner | CVE-2026-85504 | FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses. | Critical |
| Mariner | CVE-2026-34182 | CMS AuthEnvelopedData Processing May Accept Forged Messages | Critical |
| Microsoft Azure Active Directory B2C | CVE-2026-83711 | Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability | Critical |
| Microsoft Discovery Studio | CVE-2026-62906 | Microsoft Discovery Studio Information Disclosure Vulnerability | Critical |
| Microsoft Dynamics 365 | CVE-2026-65772 | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability | Critical |
| Microsoft Entra ID | CVE-2026-62916 | Microsoft Entra ID Elevation of Privilege Vulnerability | Critical |
| Microsoft Fabric | CVE-2026-70178 | Microsoft Fabric Elevation of Privilege Vulnerability | Critical |
| Microsoft Graphics Component | CVE-2026-78439 | Microsoft Office Graphics Component Remote Code Execution Vulnerability | Critical |
| Microsoft Graphics Component | CVE-2026-81955 | Windows Graphics Component Remote Code Execution Vulnerability | Critical |
| Microsoft Graphics Component | CVE-2026-73006 | DirectWrite Remote Code Execution Vulnerability | Critical |
| Microsoft Graphics Component | CVE-2026-77493 | Windows Graphics Component Remote Code Execution Vulnerability | Critical |
| Microsoft Office | CVE-2026-69285 | Microsoft Office Remote Code Execution Vulnerability | Critical |
| Microsoft Office | CVE-2026-78505 | Microsoft Office Remote Code Execution Vulnerability | Critical |
| Microsoft Office | CVE-2026-77898 | Microsoft Office Remote Code Execution Vulnerability | Critical |
| Microsoft Office | CVE-2026-69632 | Microsoft Office Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-81949 | Microsoft Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-81948 | Microsoft Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-81950 | Microsoft Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-81959 | Microsoft Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-81953 | Microsoft Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-81951 | Microsoft Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Outlook | CVE-2026-78509 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical |
| Microsoft Office Outlook | CVE-2026-78520 | Microsoft Office Outlook Information Disclosure Vulnerability | Critical |
| Microsoft Office Outlook | CVE-2026-78525 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical |
| Microsoft Office Outlook | CVE-2026-78519 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical |
| Microsoft Office PowerPoint | CVE-2026-69678 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Critical |
| Microsoft Office PowerPoint | CVE-2026-69797 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Critical |
| Microsoft Office PowerPoint | CVE-2026-69767 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Critical |
| Microsoft Office Word | CVE-2026-78510 | Microsoft Word Remote Code Execution Vulnerability | Critical |
| Microsoft Office Word | CVE-2026-81952 | Microsoft Word Remote Code Execution Vulnerability | Critical |
| Microsoft Office Word | CVE-2026-77504 | Microsoft Office Word Remote Code Execution Vulnerability | Critical |
| Microsoft WebP Image Extension | CVE-2026-70351 | Microsoft WebP Image Extension Remote Code Execution Vulnerability | Critical |
| Microsoft Windows Codecs Library | CVE-2026-81352 | Web Media Extensions Remote Code Execution Vulnerability | Critical |
| Microsoft Windows Codecs Library | CVE-2026-58599 | HEVC Video Extensions Remote Code Execution Vulnerability | Critical |
| Microsoft Windows Media Foundation | CVE-2026-69601 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | Critical |
| Power Automate | CVE-2026-65818 | Power Automate Elevation of Privilege Vulnerability | Critical |
| Reliable Multicast Transport Driver (RMCAST) | CVE-2026-78449 | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability | Critical |
| Reliable Multicast Transport Driver (RMCAST) | CVE-2026-78450 | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability | Critical |
| Reliable Multicast Transport Driver (RMCAST) | CVE-2026-69530 | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability | Critical |
| Role: DNS Server | CVE-2026-69827 | Windows DNS Server Remote Code Execution Vulnerability | Critical |
| Role: DNS Server | CVE-2026-77505 | Windows DNS Server Remote Code Execution Vulnerability | Critical |
| Skype for Business | CVE-2026-66302 | Skype for Business Remote Code Execution Vulnerability | Critical |
| Spring Cloud Azure | CVE-2026-69854 | Spring Cloud Azure Elevation of Privilege Vulnerability | Critical |
| SQL Server | CVE-2026-67378 | Microsoft SQL Server Remote Code Execution Vulnerability | Critical |
| SQL Server | CVE-2026-67631 | Microsoft SQL Server Remote Code Execution Vulnerability | Critical |
| SQL Server | CVE-2026-65669 | Microsoft SQL Server Elevation of Privilege Vulnerability | Critical |
| SQL Server | CVE-2026-67643 | Microsoft SQL Server Remote Code Execution Vulnerability | Critical |
| SQL Server | CVE-2026-67636 | Microsoft SQL Server Remote Code Execution Vulnerability | Critical |
| Virtual Hard Disk (VHD) Miniport Driver | CVE-2026-81355 | Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability | Critical |
| Windows ALPC | CVE-2026-69874 | Windows ALPC Elevation of Privilege Vulnerability | Critical |
| Windows Credential Guard | CVE-2026-72958 | Windows Credential Guard Elevation of Privilege Vulnerability | Critical |
| Windows Deployment Services | CVE-2026-72954 | Windows Deployment Services Remote Code Execution Vulnerability | Critical |
| Windows Deployment Services | CVE-2026-72957 | Windows Deployment Services Remote Code Execution Vulnerability | Critical |
| Windows DHCP Server | CVE-2026-72979 | Windows DHCP Server Remote Code Execution Vulnerability | Critical |
| Windows DHCP Server | CVE-2026-69845 | Windows DHCP Server Remote Code Execution Vulnerability | Critical |
| Windows DNS | CVE-2026-69858 | Windows DNS Server Remote Code Execution Vulnerability | Critical |
| Windows DNS | CVE-2026-69813 | Windows DNS Server Remote Code Execution Vulnerability | Critical |
| Windows DNS | CVE-2026-69730 | Windows DNS Server Remote Code Execution Vulnerability | Critical |
| Windows DNS | CVE-2026-72987 | Windows DNS Remote Code Execution Vulnerability | Critical |
| Windows Failover Cluster | CVE-2026-73010 | Microsoft Failover Cluster Remote Code Execution Vulnerability | Critical |
| Windows Failover Cluster | CVE-2026-78444 | Microsoft Failover Cluster Remote Code Execution Vulnerability | Critical |
| Windows Graphics Kernel | CVE-2026-73017 | Graphics Kernel Remote Code Execution Vulnerability | Critical |
| Windows Hello | CVE-2026-69784 | Windows Hello Elevation of Privilege Vulnerability | Critical |
| Windows Hello | CVE-2026-81354 | Windows Hello Elevation of Privilege Vulnerability | Critical |
| Windows Hello | CVE-2026-69740 | Windows Hello Elevation of Privilege Vulnerability | Critical |
| Windows Hello | CVE-2026-69799 | Windows Hello Elevation of Privilege Vulnerability | Critical |
| Windows Hello | CVE-2026-69820 | Windows Hello Elevation of Privilege Vulnerability | Critical |
| Windows Hello | CVE-2026-69864 | Windows Hello Elevation of Privilege Vulnerability | Critical |
| Windows Hello | CVE-2026-69710 | Windows Hello Elevation of Privilege Vulnerability | Critical |
| Windows Hello | CVE-2026-69725 | Windows Hello Elevation of Privilege Vulnerability | Critical |
| Windows Hello | CVE-2026-72980 | Windows Hello Security Feature Bypass Vulnerability | Critical |
| Windows HTTP Print Provider | CVE-2026-69769 | Windows HTTP Print Provider Remote Code Execution Vulnerability | Critical |
| Windows Hyper-V | CVE-2026-72961 | Windows Hyper-V Elevation of Privilege Vulnerability | Critical |
| Windows Hyper-V | CVE-2026-69603 | Windows Hyper-V Remote Code Execution Vulnerability | Critical |
| Windows Hyper-V | CVE-2026-80083 | Windows Hyper-V Remote Code Execution Vulnerability | Critical |
| Windows Imaging Component | CVE-2026-73023 | Windows Imaging Component Remote Code Execution Vulnerability | Critical |
| Windows Imaging Component | CVE-2026-77495 | Windows Imaging Component Remote Code Execution Vulnerability | Critical |
| Windows Imaging Component | CVE-2026-73013 | Windows Imaging Component Remote Code Execution Vulnerability | Critical |
| Windows Imaging Component | CVE-2026-70296 | Windows Imaging Component Remote Code Execution Vulnerability | Critical |
| Windows Imaging Component | CVE-2026-69860 | Windows Imaging Component Remote Code Execution Vulnerability | Critical |
| Windows Imaging Component | CVE-2026-69499 | Windows Imaging Component Remote Code Execution Vulnerability | Critical |
| Windows Internet Connection Sharing (ICS) | CVE-2026-72983 | Internet Connection Sharing (ICS) Remote Code Execution Vulnerability | Critical |
| Windows Kerberos | CVE-2026-69676 | Windows Kerberos Remote Code Execution Vulnerability | Critical |
| Windows Key Distribution Center | CVE-2026-69712 | Windows Key Distribution Center Remote Code Execution Vulnerability | Critical |
| Windows Media Player | CVE-2026-70203 | Windows Media Player Remote Code Execution Vulnerability | Critical |
| Windows Media Player | CVE-2026-72960 | Windows Media Player Remote Code Execution Vulnerability | Critical |
| Windows Message Queuing | CVE-2026-69579 | Windows Message Queuing Remote Code Execution Vulnerability | Critical |
| Windows Netlogon | CVE-2026-72982 | Windows Netlogon Remote Code Execution Vulnerability | Critical |
| Windows Paint | CVE-2026-70586 | Windows Paint Remote Code Execution Vulnerability | Critical |
| Windows Raw Image Extension | CVE-2026-69649 | Raw Image Extension Remote Code Execution Vulnerability | Critical |
| Windows Remote Desktop | CVE-2026-69518 | Windows Remote Desktop Remote Code Execution Vulnerability | Critical |
| Windows Routing and Remote Access Service (RRAS) | CVE-2026-72959 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Critical |
| Windows Routing and Remote Access Service (RRAS) | CVE-2026-69590 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Critical |
| Windows Routing and Remote Access Service (RRAS) | CVE-2026-69852 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Critical |
| Windows Routing and Remote Access Service (RRAS) | CVE-2026-72950 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Critical |
| Windows Secure Kernel Mode | CVE-2026-69501 | Windows Secure Kernel Mode Elevation of Privilege Vulnerability | Critical |
| Windows Secure Kernel Mode | CVE-2026-83939 | Windows Secure Kernel Mode Elevation of Privilege Vulnerability | Critical |
| Windows Secure Kernel Mode | CVE-2026-69846 | Windows Secure Kernel Mode Elevation of Privilege Vulnerability | Critical |
| Windows Secure Kernel Mode | CVE-2026-69906 | Windows Secure Kernel Mode Elevation of Privilege Vulnerability | Critical |
| Windows Secure Socket Tunneling Protocol (SSTP) | CVE-2026-73009 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | Critical |
| Windows Services for NFS ONCRPC XDR Driver | CVE-2026-69595 | Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability | Critical |
| Windows Services for NFS ONCRPC XDR Driver | CVE-2026-70585 | Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability | Critical |
| Windows Services for NFS ONCRPC XDR Driver | CVE-2026-78445 | Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability | Critical |
| Windows Shell | CVE-2026-69829 | Windows Shell Remote Code Execution Vulnerability | Critical |
| Windows USB Video Driver | CVE-2026-72962 | Windows USB Video Driver Elevation of Privilege Vulnerability | Critical |
| Windows Virtual Trusted Platform Module | CVE-2026-69890 | Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability | Critical |
| Windows Virtualization-Based Security (VBS) Enclave | CVE-2026-83501 | Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability | Critical |
| Windows Virtualization-Based Security (VBS) Enclave | CVE-2026-83498 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | Critical |
GLOSSARY
- Authentication – proving who you are so you can be given access to what you need/have rights to.
- MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
- Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
- Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
- Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
- Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
- DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
- Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
- CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
- Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
- Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
- Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
- Information Disclosure Vulnerabilities – allow the wrong people access to your data.
- Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
- Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.
If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.