Microsoft has released the September 2026 Patch Tuesday security updates, addressing 974 vulnerabilities across Microsoft’s products. More importantly, two of the vulnerabilities were already being exploited in the wild before Microsoft released fixes. The two zero-days, CVE-2026-81963 and CVE-2026-85880, affect the Windows Update Stack and Windows Advanced Local Procedure Call (ALPC). Both are elevation-of-privilege flaws that could allow a local attacker to gain SYSTEM-level privileges.
Beyond security fixes, Microsoft also introduced new features, improved system reliability, and released the latest cumulative updates for Windows 11 and Windows 10 ESU devices. Here’s everything you need to know about the Microsoft 2026 Patch Tuesday update.
Two Windows Zero-Days Are Being Exploited
The most urgent part of this month’s release is the two actively exploited zero-day vulnerabilities.
CVE-2026-81963 — Windows Update Stack
CVE-2026-81963 is an elevation-of-privilege vulnerability in the Windows Update Stack. Microsoft says an authorized attacker could exploit improper link resolution before file access to elevate privileges locally.
Successful exploitation can allow an attacker to obtain SYSTEM-level privileges, making this a serious issue on affected Windows systems.
Microsoft has not publicly disclosed details on how the vulnerability was exploited, but the fact that it is already being exploited makes installing the security update a priority.
CVE-2026-85880 — Windows ALPC
The second zero-day, CVE-2026-85880, affects Windows Advanced Local Procedure Call (ALPC).
The vulnerability can allow a low-privileged attacker to escape an AppContainer sandbox and elevate privileges to SYSTEM. Microsoft says no additional user interaction is required for exploitation.
Like CVE-2026-81963, this vulnerability has already been exploited in real-world attacks, making it more important than an ordinary unexploited security flaw.
Both vulnerabilities have also been identified by JPCERT/CC as exploited vulnerabilities in Microsoft’s September security updates.
Several Critical Vulnerabilities Were Also Fixed
Microsoft’s September security release includes Critical vulnerabilities affecting several Windows components and server services. Some of the most notable issues involve DNS Server, DHCP Server, Windows Graphics Component, Windows Imaging Component, Outlook, Word, Excel, and other Microsoft products.
For example, CVE-2026-69730 in Windows DNS Server has a CVSS score of 9.8. Microsoft also fixed several other critical DNS and DHCP vulnerabilities, some of which carry CVSS scores of 9.8.
Another notable vulnerability is CVE-2026-69525 in Remote Desktop Services. Although Microsoft rates this one Important rather than Critical, it has a 9.8 CVSS score and could allow a remote unauthenticated attacker to execute code on an affected system.
The September security release isn’t limited to Windows. Microsoft has also patched numerous vulnerabilities affecting Office, Azure, Active Directory, SQL Server, Remote Desktop and other business-oriented products.
Windows 11 Gets More Than Security Fixes
The September update is also significant for Windows 11 because Microsoft has finally introduced several interface changes that have been tested in preview releases.
KB5124008 is available for Windows 11 24H2 and 25H2, bringing the operating system builds to:
- Windows 11 24H2 — 26100.9445
- Windows 11 25H2 — 26200.9445
One of the biggest changes is the return of a movable Taskbar. Users can position it at the top, left, right, or bottom of the screen. Microsoft has also added a smaller Taskbar option that reduces its height and icon size.
The Start menu is getting more customization as well. Users can choose Small, Large, or Automatic sizing, rename the Recommended section to Recent, and hide their name and profile picture.
Windows Search has also been cleaned up. Users get more control over web and Microsoft Store suggestions, making it easier to focus Search on local files and recent activity.
Microsoft is also beginning the rollout of Administrator Protection, a security feature designed to reduce unnecessary administrator privileges and help limit elevation-of-privilege attacks.
What About Windows 10?
Windows 10 users receive KB5122878 as the September security update. It applies to supported Windows 10 systems, including eligible devices covered by the Extended Security Updates program.
The update brings builds to:
- Windows 10 22H2 — 19045.7725
- Windows 10 21H2 — 19044.7725
There are no major interface changes for Windows 10. Instead, KB5122878 focuses on security and reliability improvements.
Microsoft has expanded device-targeting data for Secure Boot certificate updates, fixed a Remote Desktop audio redirection problem, and addressed an issue that could incorrectly require a BitLocker recovery key because of an unrecommended Group Policy configuration.
The update also includes changes related to Morocco’s time zone and improves OMA DM logging for managed devices.
Because standard Windows 10 22H2 support ended in October 2025, KB5120249 is intended for eligible Extended Security Updates (ESU) devices and supported LTSC editions.
Download the Windows cumulative updates
All these security updates are automatically downloaded and installed on supported devices via Windows Update. If your device has not received them yet, open Settings > Update & Security (or Windows Update), and click Check for updates. Once the updates are installed, restart your device to apply the changes.
- Windows 11 KB5124008 (versions 24H2/25H2) offline installer – Direct Download Link (64-bit).
- Windows 10 KB5122878 (version 22H2, ESU) offline installer – Direct Download Links: 64-bit and 32-bit (x86).
The links above open the Microsoft Update Catalog, a library of offline installers for Windows updates. Click the Download button next to the OS version installed on your machine, then run the .msu file to begin installing the update.
If you encounter any issues installing these updates, refer to our Windows Update troubleshooting guide to resolve problems such as stuck downloads or failed installations with various error codes.
Frequently Asked Questions
Microsoft Patch Tuesday is the company’s monthly security update release, normally published on the second Tuesday of each month. It includes security fixes and other quality improvements for Windows, Microsoft Office, Windows Server, and other Microsoft products. Microsoft typically releases the monthly Windows security update at 10:00 AM Pacific Time.
Microsoft typically releases its monthly security updates at 10:00 AM Pacific Time (PT) on the second Tuesday of each month. The exact timing can vary slightly by service or product, but 10:00 AM PT is Microsoft’s standard release time for Windows monthly security updates.
Microsoft calls the second Tuesday of each month Patch Tuesday because it is the company’s regular monthly window for releasing security and quality updates. Microsoft formalized this schedule in 2003 to make security updates more predictable for users and IT administrators.
A zero-day vulnerability is a security flaw that was unknown to the vendor or had no available fix when it was discovered or exploited. The term refers to the fact that developers have had zero days to provide an official patch. A zero-day can become especially serious when attackers exploit it before a security update is available.
Microsoft’s September 2026 Patch Tuesday release addresses 974 vulnerabilities across its products, including two zero-days that were already being exploited in the wild.
The two actively exploited zero-days are CVE-2026-81963, affecting the Windows Update Stack, and CVE-2026-85880, affecting Windows ALPC. Both are elevation-of-privilege vulnerabilities that can allow an attacker to gain SYSTEM-level privileges.
