Back Rapid7

Patch Tuesday

Rapid7 •Rapid7 • September 8, 2026

Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday , including 723 vulnerabilities in Windows. Along with Microsoft fixes for 25 non-Microsoft CVEs, that brings the total number of vulnerabilities on the table today to 999. Whether this is the biggest Patch Tuesday ever depends on how we count, but this is by far the most CVEs that Microsoft has ever published in a single day. As Rapid7 noted last month, there is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. Microsoft is aware of exploitation in the wild for two of the vulnerabilities published today.

Windows ALPC: zero-day EoP

The eternal game of elevation of privilege whack-a-mole between Microsoft and attackers continues. This month, the battle is centered on the Windows Advanced Local Procedure Call (ALPC) mechanism, a kernel capability that facilitates inter-process communication. Microsoft is aware of exploitation in the wild already. Successful abuse of the flaw underlying CVE-2026-85880 grants an attacker SYSTEM via a buffer overflow that enables an out-of-bounds write, and as we all know by now, this is exactly what would happen during the first five minutes of a technically accurate horror movie ransomware. We can infer one silver lining here: since neither Server 2025 nor Windows 11 receives patches for CVE-2026-85880, it is likely that Microsoft’s ongoing efforts to level up memory safety by rewriting critical kernel components in Rust are paying off.

Windows Update Stack: zero-day EoP

Attackers disappointed by Microsoft’s move towards memory safety improvements for various critical kernel components need not leave empty-handed today. Microsoft is aware of existing exploitation in the wild for CVE-2026-81963 , an elevation of privilege vulnerability in the Windows Update Stack that leads to SYSTEM privileges via improper link resolution. All supported versions of Windows receive a patch, which presumably tightens up controls to prevent the Windows Update Stack from following a malicious link and overwriting a system component with an attacker-controlled imposter. The relatively pedestrian CVSS v3 base score of 7.8 is no reason for less concern, since no serious attacker will bother developing an intricate one-shot RCE when a two-stage attack chain consisting of low-privileged local access coupled with elevation of privilege will achieve the same ultimate goal much more easily.

Living on the Edge: browser advisory uncertainty

For the second month in a row, Microsoft does not appear to have published any desktop browser security advisories between the start of the month and Patch Tuesday. Microsoft Edge is built on top of Google’s open-source Chromium project, and on September 3, 2026, Google Chrome patched CVE-2026-85046, an exploited-in-the-wild zero-day vulnerability in the V8 JavaScript engine relied upon by both Edge and Chrome. So, is Microsoft Edge falling dangerously behind Google Chrome? Well, maybe. In this specific case, the Edge stable channel did receive a patch a day earlier than Chrome on September 2, 2026, and we know this because the Edge release notes mention it . However, almost a week later, Microsoft still hasn’t published a security advisory for CVE-2026-85046 , and until that URL returns something better than a 404, that will remain true. In short: if you’re patched, you are protected, but if you rely on advisories to know which vulns exist, you could miss this zero-day vulnerability altogether. Only Microsoft knows why this advisory is missing, but there is no reason to suppose that Microsoft is somehow immune to the pressures that come along with the vast increase in vulnerability volume. A patch without an advisory is perhaps marginally better than an advisory without a patch, but keeping track of exposures without reliable advisory materials is not straightforward. Chrome patched 11 other vulnerabilities at the same time as CVE-2026-85046, but it’s not yet clear if those are patched in Edge. Until Microsoft sets the record straight, the only safe assumption is that these vulnerabilities (e.g. CVE-2026-85045 ) remain unpatched in Edge.

Microsoft lifecycle update

The Microsoft product lifecycle changes with broad impact occur on October 14, 2026, when Windows 11 24H2 & Pro reach end of servicing, and Windows Server 2022 moves to extended support, with free critical security updates continuing, but no further feature development. At the same time, the final curtain falls for Windows Server 2012 and 2012 R2 with the expiry of the third and final year of cash-for-updates Extended Security Update (ESU) program for these aging workhorses. Office 2021 also moves beyond support, including the Long-Term Servicing Channel , with no ESU available in that case. Also in October, Exchange Server 2016 and 2019 will join the “no ESU” club, after two six-month reprieves. Presumably, Microsoft really means it this time.

Microsoft Authenticator Elevation of Privilege Vulnerability

Exploitation Less Likely

Xbox Gaming Services Elevation of Privilege Vulnerability

Exploitation Less Likely

Azure vulnerabilities

Azure AI Language Elevation of Privilege Vulnerability

Azure Arc SQL Server Extension Elevation of Privilege Vulnerability

Exploitation Less Likely

Azure Cosmos DB Spoofing Vulnerability

Exploitation More Likely

Azure CycleCloud Information Disclosure Vulnerability

Exploitation Less Likely

Azure HDInsight Ambari Elevation of Privilege Vulnerability

Entra ID Elevation of Privilege Vulnerability

Microsoft Authentication Library (MSAL) for Node.js Spoofing Vulnerability

Exploitation Less Likely

Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability

Microsoft Azure CLI Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft Discovery Studio Information Disclosure Vulnerability

Microsoft Entra ID Elevation of Privilege Vulnerability

Spring Cloud Azure Elevation of Privilege Vulnerability

Exploitation More Likely

Browser vulnerabilities

Chromium: CVE-2026-84323 Missing authorization in FileSystem

Chromium: CVE-2026-84324 Use after free in Proxy

Chromium: CVE-2026-84325 Improper input validation in DataTransfer

Chromium: CVE-2026-84326 Uninitialized resource in V8

Chromium: CVE-2026-84327 Incorrect authorization in Autofill

Chromium: CVE-2026-84328 Missing authorization in FileSystem

Chromium: CVE-2026-84329 Confused deputy in CredentialProvider

Chromium: CVE-2026-84331 Incorrect authorization in Actor

Chromium: CVE-2026-84332 Incorrect authorization in SiteSettings

Chromium: CVE-2026-84334 Incorrect authorization in Chromoting

Chromium: CVE-2026-84335 Incorrect authorization in TabStrip

Chromium: CVE-2026-84347 Use after free in WebRTC

Chromium: CVE-2026-84348 Information leak in MediaCapture

Chromium: CVE-2026-84349 Use after free in Browser

Chromium: CVE-2026-84350 Use after free in TabStrip

Chromium: CVE-2026-84351 Buffer overflow in GPU

Chromium: CVE-2026-84353 Use after free in Shared Tab Groups

Chromium: CVE-2026-84354 Incorrect authorization in FileSystem

Chromium: CVE-2026-84355 Incorrect authorization in

Chromium: CVE-2026-84356 UI misrepresentation in FullScreen

Chromium: CVE-2026-84357 Improper input validation in Omnibox

Chromium: CVE-2026-84358 Improper privilege management in Downloads

Chromium: CVE-2026-84359 Information leak in Skia

Developer Tools vulnerabilities

.NET and Visual Studio Elevation of Privilege Vulnerability

Exploitation Unlikely

.NET and Visual Studio Remote Code Execution Vulnerability

Exploitation Unlikely

.NET and Visual Studio Remote Code Execution Vulnerability

Exploitation Unlikely

.NET Elevation of Privilege Vulnerability

Exploitation Less Likely

.NET Elevation of Privilege Vulnerability

Exploitation Less Likely

.NET Information Disclosure Vulnerability

Exploitation Less Likely

An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

ASP.NET Core Denial of Service Vulnerability

Exploitation Less Likely

ASP.NET Core Denial of Service Vulnerability

Exploitation Less Likely

CMS AuthEnvelopedData Processing May Accept Forged Messages

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Exploitation Less Likely

Visual Studio Code Information Disclosure Vulnerability

Exploitation Less Likely

Visual Studio Code Security Feature Bypass Vulnerability

Exploitation Less Likely

Visual Studio Code Security Feature Bypass Vulnerability

Exploitation Less Likely

Visual Studio Code Security Feature Bypass Vulnerability

Exploitation Less Likely

Visual Studio Code Security Feature Bypass Vulnerability

Exploitation Less Likely

Visual Studio Code Security Feature Bypass Vulnerability

Exploitation Less Likely

Visual Studio Code Security Feature Bypass Vulnerability

Exploitation Less Likely

Visual Studio Code Security Feature Bypass Vulnerability

Exploitation Less Likely

Visual Studio Code Security Feature Bypass Vulnerability

Exploitation Less Likely

Visual Studio Code Tampering Vulnerability

Exploitation Less Likely

Visual Studio Remote Code Execution Vulnerability

Exploitation Less Likely

Visual Studio Remote Code Execution Vulnerability

Exploitation Less Likely

Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability

Exploitation Unlikely

Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability

Exploitation Unlikely

Active Directory Certificate Services (AD CS) Information Disclosure Vulnerability

Exploitation Unlikely

Active Directory Certificate Services (AD CS) Tampering Vulnerability

Exploitation Unlikely

Active Directory Domain Services Elevation of Privilege Vulnerability

Exploitation Less Likely

Active Directory Federation Services (AD FS) Denial of Service Vulnerability

Exploitation Unlikely

BranchCache Denial of Service Vulnerability

Exploitation Unlikely

Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability

Exploitation Unlikely

Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Exploitation Unlikely

Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Exploitation Less Likely

Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Exploitation Less Likely

Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Exploitation Less Likely

Data Sharing Service Client Elevation of Privilege Vulnerability

Exploitation Less Likely

DirectWrite Remote Code Execution Vulnerability

Exploitation Less Likely

DirectWrite Remote Code Execution Vulnerability

Exploitation Less Likely

Graphic Fonts Elevation of Privilege Vulnerability

Exploitation Less Likely

Graphic Fonts Remote Code Execution Vulnerability

Exploitation Less Likely

Graphic Fonts Remote Code Execution Vulnerability

Exploitation Less Likely

Graphics Kernel Remote Code Execution Vulnerability

Exploitation Less Likely

HID Class Driver Elevation of Privilege Vulnerability

Exploitation Less Likely

Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

Exploitation Less Likely

Internet Storage Name Service Information Disclosure Vulnerability

Exploitation Less Likely

IP Helper Remote Code Execution Vulnerability

Exploitation Less Likely

Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Exploitation Less Likely

Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Exploitation Unlikely

Microsoft Account Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft COM for Windows Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft COM for Windows Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft DirectMusic Remote Code Execution Vulnerability

Exploitation Unlikely

Microsoft Exchange Server Denial of Service Vulnerability

Exploitation Less Likely

Microsoft Exchange Server Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Exchange Server Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Exchange Server Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft Exchange Server Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft Exchange Server Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft Exchange Server Spoofing Vulnerability

Exploitation Less Likely

Microsoft Exchange Server Spoofing Vulnerability

Exploitation Less Likely

Microsoft Exchange Server Tampering Vulnerability

Exploitation Less Likely

Microsoft Graphics Component Elevation of Privilege Vulnerability

Exploitation More Likely

Microsoft Graphics Component Remote Code Execution Vulnerability

Exploitation Unlikely

Microsoft Install Service Elevation of Privilege Vulnerability

Exploitation More Likely

Microsoft JScript Remote Code Execution Vulnerability

Exploitation Unlikely

Microsoft JScript Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability

Exploitation More Likely

Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability

Exploitation Unlikely

Microsoft Office Word Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft Office Word Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft Office Word Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft PowerShell Security Feature Bypass Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Elevation of Privilege Vulnerability

Exploitation Unlikely

Microsoft Standard XPS Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft Standard XPS Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability

Exploitation Unlikely

Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability

Exploitation Unlikely

Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft WDAC OLE DB provider for SQL Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Exploitation Unlikely

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Exploitation Less Likely

Microsoft Windows PDF Remote Code Execution Vulnerability

Exploitation Unlikely

Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Windows SCSI Class System File Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft Windows SCSI Class System File Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft Windows Component Elevation of Privilege Vulnerability

Exploitation More Likely

Microsoft Windows Component Elevation of Privilege Vulnerability

Exploitation More Likely

Microsoft Windows Component Elevation of Privilege Vulnerability

Exploitation More Likely

Microsoft Windows Component Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Windows Component Elevation of Privilege Vulnerability

Exploitation More Likely

Microsoft Windows Component Information Disclosure Vulnerability

Exploitation Less Likely

Microsoft Windows Component Tampering Vulnerability

Exploitation Less Likely

Microsoft Windows Component Tampering Vulnerability

Exploitation Unlikely

Microsoft Windows Speech Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Windows Speech Elevation of Privilege Vulnerability

Exploitation Less Likely

Microsoft Windows Speech Tampering Vulnerability

Exploitation Unlikely

PowerShell Elevation of Privilege Vulnerability

Exploitation Unlikely

Push Message Routing Service Information Disclosure Vulnerability

Exploitation Less Likely

Remote Desktop Client Remote Code Execution Vulnerability

Exploitation Less Likely

Remote Desktop Client Remote Code Execution Vulnerability

Exploitation Less Likely

Remote Desktop Client Remote Code Execution Vulnerability

Exploitation Less Likely

Remote Desktop Client Remote Code Execution Vulnerability

Exploitation Unlikely

Remote Desktop Gateway Service Elevation of Privilege Vulnerability

Exploitation Unlikely

Remote Desktop Gateway Service Elevation of Privilege Vulnerability

Exploitation Less Likely

Remote Desktop Licensing Service Elevation of Privilege Vulnerability

Exploitation Less Likely

Remote Desktop Services Remote Code Execution Vulnerability

Exploitation Unlikely

Remote Desktop Services Remote Code Execution Vulnerability

Exploitation More Likely

Remote Desktop Services Remote Code Execution Vulnerability

Exploitation Unlikely

Role: Windows Fax Service Elevation of Privilege Vulnerability

Exploitation Less Likely

Role: Windows Fax Service Elevation of Privilege Vulnerability

Exploitation Less Likely

Role: Windows Fax Service Elevation of Privilege Vulnerability

Exploitation Unlikely

RPC Runtime Library Remote Code Execution Vulnerability

Exploitation Less Likely

Storage Spaces Controller Information Disclosure Vulnerability

Exploitation Unlikely

Telnet Client Remote Code Execution Vulnerability

Exploitation Unlikely

Virtual Hard Disk (VHD) Miniport Driver Denial of Service Vulnerability

Exploitation Less Likely

Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability

Exploitation More Likely

Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability

Exploitation Less Likely

Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability

Exploitation Less Likely

Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability

Exploitation Unlikely

Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability

Exploitation Less Likely

Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability

Exploitation Less Likely

Volume Manager Driver Elevation of Privilege Vulnerability

Exploitation Unlikely

Volume Manager Driver Elevation of Privilege Vulnerability

Exploitation Less Likely

Volume Manager Driver Elevation of Privilege Vulnerability

Exploitation Unlikely

Volume Shadow Copy Elevation of Privilege Vulnerability

Exploitation Less Likely

Win32k Information Disclosure Vulnerability

Exploitation Unlikely

Win32k Information Disclosure Vulnerability

Exploitation Unlikely

Win32k Information Disclosure Vulnerability

Exploitation More Likely

Win32k Information Disclosure Vulnerability

Exploitation Unlikely

Win32k Information Disclosure Vulnerability

Exploitation Less Likely

Windows Accounts Control Elevation of Privilege Vulnerability

Exploitation Less Likely

Windows Accounts Control Elevation of Privilege Vulnerability

Exploitation Less Likely

Windows Active Directory Domain Services Denial of Service Vulnerability

Exploitation Unlikely

Windows Active Directory Domain Services Remote Code Execution Vulnerability

Exploitation Unlikely

Windows Active Directory Domain Services Remote Code Execution Vulnerability

Exploitation Unlikely

Windows Active Directory Domain Services Remote Code Execution Vulnerability

Exploitation Less Likely

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

Exploitation Detected

Windows AF_UNIX Socket Provider Elevation of Privilege Vulnerability

Exploitation Less Likely

Windows ALPC Elevation of Privilege Vulnerability

Exploitation Unlikely

Windows ALPC Elevation of Privilege Vulnerability

Exploitation Unlikely

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Exploitation Less Likely

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Exploitation More Likely

Windows Audio Service Elevation of Privilege Vulnerability

Exploitation Unlikely

Windows Audio Service Elevation of Privilege Vulnerability

Exploitation Less Likely

Windows Audio Service Elevation of Privilege Vulnerability

Exploitation Less Likely

Windows Audio Service Elevation of Privilege Vulnerability

Exploitation Less Likely

Windows Audio Service Elevation of Privilege Vulnerability

Exploitation Unlikely

Windows Audio Service Elevation of Privilege Vulnerability

Exploitation Unlikely

Windows Audio Service Elevation of Privilege Vulnerability

Exploitation More Likely

Windows Authentication Methods Elevation of Privilege Vulnerability

Exploitation Unlikely

Windows Autopilot Tampering Vulnerability

Exploitation Unlikely