Record Patch Tuesday: 974 CVEs, Two Active Zero-Days, a Wormable DNS RCE

When your patching team shows up on the second Tuesday of the month expecting the usual grind, they might not expect to find nearly a thousand vulnerabilities waiting for them. That's what September 8, 2026 delivered: Microsoft's largest Patch Tuesday in history, resolving 974 CVEs across Windows, Office, Exchange, SharePoint, SQL Server, and developer tools — including two zero-days already confirmed exploited in the wild and 20 bugs that security researchers are calling wormable.

The raw count alone tells part of the story. Windows accounts for 723 of the fixes; Office adds 111 more; SQL Server contributes 62; SharePoint Server sees 16; and Exchange Server clocks in with nine. But volume is not the real concern. What matters is what is actively burning and what could start burning fast.

Two Zero-Days Already Under Attack

CISA added both exploited-in-the-wild CVEs to its Known Exploited Vulnerabilities catalog the same day patches shipped. Federal agencies must apply the fixes by September 22, 2026 — a tight 14-day window that implicitly signals how seriously the government is treating active exploitation.

CVE-2026-85880 is a heap-based buffer overflow combined with an uninitialized-resource use flaw in Windows Advanced Local Procedure Call (ALPC) — the foundational inter-process communication layer that underpins RPC, COM, and essentially every system service on every modern Windows release. CVSS 7.8. A low-privileged attacker who can execute code inside an AppContainer sandbox can exploit this to escape that sandbox and escalate directly to SYSTEM, with no user interaction required. Volexity and Proofpoint have both been credited with reporting it, which suggests it surfaced in real intrusion investigations before Microsoft had a patch ready. AppContainer sandboxes are a security boundary that browsers, PDF viewers, and third-party applications rely on — a reliable escape route out of one is significant.

CVE-2026-81963 hits the Windows Update Stack itself — a link-following flaw (CWE-59: improper link resolution before file access) that lets a locally authenticated attacker manipulate symlinks in a way that tricks the update process into operating on an attacker-controlled path, elevating to SYSTEM in the process. CVSS 7.8. The irony of the Windows update mechanism being weaponized to gain system privileges will not be lost on anyone who has spent time in incident response.

Neither vulnerability was publicly known before patches shipped on September 8. Microsoft has detected active exploitation in the wild for both. Patch these first.

The One That Is Not Exploited Yet — But Will Be

CVE-2026-69730 has not yet been confirmed exploited, but Microsoft has explicitly flagged it as exploitation likely — and security researchers at Zero Day Initiative are calling it SigRed's spiritual successor. That is not hyperbole. SigRed (CVE-2020-1350) was a CVSS 10.0 Windows DNS Server flaw that could propagate worm-to-worm across DNS servers with a single malformed packet.

CVE-2026-69730 carries a CVSS score of 9.8. An unauthenticated attacker sends a specially crafted packet to a Windows DNS Server — no credentials, no user interaction — and achieves remote code execution. Windows DNS Server runs on virtually every Windows Server deployment that handles Active Directory, internal name resolution, or both. The combination of no-auth, network-exploitable, and SYSTEM-level execution potential is precisely the profile that produces propagating worms. This Patch Tuesday includes 20 wormable-profile bugs in total; CVE-2026-69730 is the one researchers are most concerned about.

If your organization runs Windows DNS Server — internally or at the edge — treat this patch with the same urgency as the two zero-days.

Exchange and SharePoint: Unauthenticated Email RCE and Mailbox Hijacking

Exchange Server picks up nine fixes this month. Two are particularly relevant to organizations running their own mail infrastructure.

CVE-2026-55007 allows an unauthenticated attacker to achieve remote code execution on an Exchange Server by sending an email with a malicious Visio attachment. The attachment does not need to be opened by a recipient — delivery to the server is sufficient to trigger the parsing flaw. Exchange servers that accept external email are network-exposed to this by design.

CVE-2026-69380 (CVSS 8.1) is an elevation-of-privilege flaw that lets a low-privileged authenticated attacker impersonate any user in the organization and access every mailbox. In a world where a single compromised service account can now reach executive email, this is a meaningful lateral-movement enabler even after an initial compromise has been nominally contained.

SharePoint Server's nine-CVE haul includes CVE-2026-69465 (CVSS 8.8), an authorization bypass that can lead to code execution across an enterprise network. SharePoint environments behind good network segmentation carry lower risk, but attackers who already have a domain foothold have a clear path to it.

Context: Why 974 Is a Different Kind of Number

974 CVEs in a single Patch Tuesday is unprecedented — the previous record was set earlier in 2026. Some of that count reflects how Microsoft now tallies third-party components bundled into Windows, Chromium dependencies in Edge, and advisory-level disclosures that do not all map to discrete exploitable code paths. But the 119 Critical-rated CVEs and 20 wormable-profile findings are not statistical noise. They represent a real and substantial attack surface that did not exist 24 hours before patches shipped.

What Your Team Should Do This Week

• Patch CVE-2026-85880 and CVE-2026-81963 immediately on all Windows endpoints and servers. Both are under active exploitation. CISA's September 22 deadline is a floor, not a target date.
• Prioritize Windows DNS Server patching for CVE-2026-69730. If your patch cycle cannot reach DNS servers within 48 hours, consider temporarily restricting inbound DNS query sources at the network layer while you work through the queue.
• Apply the Exchange Server patches, especially for internet-exposed mail servers where CVE-2026-55007 poses an unauthenticated risk. Verify that inbound attachment parsing is not generating new errors post-patch as a quick sanity check.
• Address SharePoint CVE-2026-69465 and confirm your WAF or reverse-proxy rules log authorization failures — that is typically the first signal of attempted exploitation.
• Organizations using WSUS or Configuration Manager should approve and deploy Critical and zero-day fixes immediately, without waiting for the standard monthly maintenance window.
• Run a patch compliance check 72 hours post-rollout. Endpoints that missed updates due to offline status, VPN agent quirks, or connectivity issues are exactly the ones adversaries find first.

At Falcon Internet, months like this one are exactly why our managed hosting environments run continuous patch-compliance tracking rather than treating patching as a monthly checkbox — because by the time a zero-day lands in the CVE database, exploitation has usually already started.