Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Immediate Actions

Key Takeaways

• 973 total vulnerabilities disclosed; 113 rated critical by Microsoft
• CVE-2026-81963 and CVE-2026-85880 exploited in the wild as EoP
• 82 of 113 critical vulnerabilities are remote code execution
• CVE-2026-83711 and CVE-2026-70352 scored CVSS 10.0
• Snort rules released: SIDs 67011-67032, 67036-67084 (Snort 2)

Attack Chain

1. Initial Access: Unpatched Windows systems exposed via DNS, RRAS, SSTP, or Netlogon RCE flaws
2. Execution: RCE vulnerabilities in Office, media codecs, or imaging components enable attacker code execution
3. Privilege Escalation: EoP flaws in Windows Update Stack (CVE-2026-81963) and ALPC (CVE-2026-85880) exploited in the wild
4. Credential Access: Kerberos capture-replay vulnerability enables authentication bypass on domain controllers
5. Lateral Movement: Elevated privileges and Kerberos compromise facilitate domain-wide propagation

Affected Systems

• Windows Update Stack
• Windows ALPC
• Windows DNS Server
• Microsoft Office suite (Word, Excel, Outlook, PowerPoint)
• Microsoft Entra ID / Azure AD B2C
• Windows Hyper-V

Vulnerabilities (CVEs)

Detection Availability

• Published: Snort/Suricata
• Platforms: Snort 2, Snort 3

Snort 2 SIDs 67011-67032, 67036-67084; Snort 3 SIDs 301619-301629, 301632-301655, 67046

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• Windows Security Event Logs
• DNS Server debug logs
• EDR process telemetry
• Network IDS alerts
• Kerberos authentication logs
• Microsoft Defender logs

Key Behavioral Indicators

• Unexpected child processes spawned by Windows Update Stack binaries
• Token elevation events following ALPC handle operations
• Anomalous Kerberos ticket requests from non-domain-joined hosts
• Crash dumps in DNS, RRAS, or SSTP service processes indicating exploitation attempts
• Unexpected process creation from Office applications after document open

Control Gaps

• Signature-based AV cannot detect memory corruption exploitation
• Network IDS coverage incomplete for all 973 vulnerabilities
• Patch management latency leaves window for exploitation

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Patch Windows DNS Server and Netlogon RCE vulnerabilities on domain controllers
• Restrict network exposure of RRAS and DHCP Server where feasible
• Apply Entra ID and Azure AD B2C patches for CVSS 9.0+ EoP flaws

User Protection

• Patch Microsoft Office, Outlook, and media codec components on all endpoints
• Enable attack surface reduction rules to block Office macro child process creation
• Deploy the latest Windows cumulative updates to all client systems

MITRE ATT&CK Mapping

Plain-Language Summary

Microsoft released security updates for 973 vulnerabilities in September 2026, including 113 critical ones. Two elevation of privilege flaws in Windows are already being used by attackers in the real world. Many of the critical vulnerabilities allow remote code execution, meaning an attacker could run malicious software on a target without physical access. Organizations should apply these patches immediately, prioritizing the two exploited vulnerabilities and internet-facing services like DNS and remote access.