Microsoft Patch Tuesday, September 2026: the CVEs
Filter
Microsoft Patch Tuesday September 2026: the CVEs Microsoft published on 8 September 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Aug 2026, Jul 2026, Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday
- 7.8CVE-2026-85880KEVEPSS 0.4%
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2026-81963KEVEPSS 7.1%
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.