Search
Find merged stories by title or summary.
Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." Microsoft notes that 2 of the vulnerabilities disclosed this month have been exploited in the wild: CVE-2026-81963 affects Windows Update Stack. CVE-2026-81963 is a elevation of privilege vulnerability associated with Improper Link Resolution Before File Access ('Link Following') and Improper Access Control and has a CVSS base score of 7. 8. CVE-2026-85880 affects Windows Advanced Local Procedure Call (ALPC). CVE-2026-85880 is a elevation of privilege vulnerability associated with Heap-based Buffer Overflow and Use of Uninitialized Resource and has a CVSS base score of 7. 8. Out of 113 "critical" vulnerabilities, 82 are remote code execution (RCE) vulnerabilities.
Microsoft releases Windows security update addressing 723 flaws
Microsoft has released its September 2026 security updates, fixing two Windows elevation-of-privilege vulnerabilities that attackers are already exploiting in the wild. The company’s broader Patch Tuesday release addresses 974 CVEs across its products, including 723 affecting Windows. The two actively exploited flaws are tracked as CVE-2026-85880 and CVE-2026-81963. Microsoft says neither vulnerability was publicly disclosed … The post Microsoft releases Windows security update addressing 723 flaws appeared first on CyberInsider .
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)
• 104 Critical • 860 Important • 0 Moderate • 0 Low Microsoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild. Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 104 rated critical and 860 rated as important.
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. • CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability • CVE-2026-81963 Microsoft Windows Link Following Vulnerability • CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability • CVE-2026-86218 N-able N-central Static Code Injection Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.
CVE-2026-81963 - Microsoft Windows Link Following Vulnerability
Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.
You've reached the end of current stories for this search.