5 minhigh
September Patch Tuesday haul includes 973 CVEs
Microsoft's September 2026 Patch Tuesday ships 973 CVEs including two actively exploited Windows elevation-of-privilege flaws and 58 more expected to be exploited within 30 days. Two Windows EoP CVEs are under active exploit. 82 Office for Mac CVEs lack patches including two Critical 9.8 CVSS issues. OpenSSL CVE-2026-34182 (CVSS 9.1) and SQLite CVE-2025-70873 require third-party patching outside Microsoft's cycle.
Sens:■ ImmediateConf:high
IOCs4
4cve
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Patch CVE-2026-81963 and CVE-2026-85880 on all Windows systems immediately
- Prioritize the 58 CVEs Microsoft flags for likely exploitation within 30 days
- Apply the 114 Critical-severity patches before the Important-severity batch
- Download cumulative updates manually from Windows Update Catalog if auto-patch lags
Key Takeaways
- 973 CVEs across 39 product families; 114 Critical, 284 with CVSS 8.0+
- Two actively exploited EoP CVEs: Update Stack (CWE-59) and ALPC (CWE-122)
- 82 Office for Mac CVEs unpatched; two are Critical 9.8 CVSS
- OpenSSL CVE-2026-34182 scores 9.1 CVSS; improper integrity-check validation in CMS data
- 58 CVEs expected exploitation within 30 days; zero publicly disclosed pre-patch
Attack Chain
- Active Exploitation: Two Windows EoP CVEs exploited in the wild
- Privilege Escalation: CVE-2026-81963 targets Update Stack via link following
- Privilege Escalation: CVE-2026-85880 targets ALPC via heap buffer overflow
- Pending Risk: 82 Office for Mac CVEs unpatched, two Critical 9.8 CVSS
- Third-Party Risk: OpenSSL CVE-2026-34182 and SQLite CVE-2025-70873 need separate patches
Affected Systems
- Windows (all supported client and server versions)
- Microsoft Office for Mac (82 CVEs unpatched)
- OpenSSL (CMS data handling)
- SQLite v3.51.1
- Azure, Copilot Studio, Entra, Fabric, Power Automate
- Microsoft 365, Exchange, SharePoint, SQL Server
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-81963 | Windows Update Stack | Important | Elevation of Privilege via link following; under active exploit in the wild. |
| CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) | Important | Elevation of Privilege via heap-based buffer overflow; under active exploit. |
| CVE-2026-34182 | OpenSSL | Critical | Improper validation of integrity-check value in CMS data; CVSS 9.1. |
| CVE-2025-70873 | SQLite v3.51.1 | Information disclosure issue reported by MITRE. |
Detection Availability
- Published: Other detection logic
- Platforms: Sophos Intercept X/Endpoint IPS, Sophos XGS Firewall
Sophos IPS signatures available for 38 CVEs; see protections table in article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EoP exploits may generate process telemetry but patch-level detection requires asset inventory. |
| Network Visibility | Low | Most vulnerabilities are local privilege escalation, not network-exploitable. |
| Detection Difficulty | Hard | 973 CVEs across 39 families; prioritization and coverage validation challenging. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Look for exploitation of Windows Update Stack or ALPC privilege escalation (T1068) via anomalous child processes of update-related services. | EDR process ancestry and Windows Security event logs. | Privilege Escalation | Medium — update services spawn varied child processes normally. |
| Look for exploitation of unpatched Office for Mac via Preview Pane or Outlook viewing vectors (T1203) on Mac endpoints lacking the pending patches. | EDR process telemetry on Mac endpoints, Office crash logs. | Execution | Low — Preview Pane exploitation is anomalous on Mac. |
Required Log Sources
- Windows Security Event Logs
- Process creation telemetry (EDR)
- Microsoft Update logs
- Patch management system inventory
- Office for Mac update logs
- OpenSSL service version inventory
Key Behavioral Indicators
- Anomalous child processes spawned by Windows Update Stack services
- ALPC port access patterns from non-standard processes
- Office for Mac processes accessing Preview Pane with no patch applied
- Outlook message rendering triggering unexpected process spawns
- OpenSSL CMS processing failures indicating integrity-check bypass attempts
- Privilege escalation from standard user to SYSTEM on unpatched Windows
Control Gaps
- Patch management tools may not track Office for Mac separately
- Asset inventory may miss OpenSSL versions in custom deployments
- SQLite embedded in third-party apps may not be inventoried
- No detection coverage for 82 unpatched Office for Mac CVEs
- Pre-patched cloud CVEs may lack on-prem visibility
False Positive Assessment
Low — article is a patch summary with specific CVE IDs and vendor-confirmed protections, not behavioral detection logic.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Patch OpenSSL to address CVE-2026-34182 (CVSS 9.1) in all deployments
- Update SQLite to a version beyond v3.51.1 for CVE-2025-70873
- Apply Adobe Acrobat and Edge patches released alongside Patch Tuesday
- Inventory all OpenSSL and SQLite instances including embedded copies
User Protection
- Monitor for Office for Mac patches; 82 CVEs remain unpatched including two Critical
- Restrict Preview Pane and Outlook reading pane on unpatched Mac systems
- Ensure Sophos IPS signatures are deployed for the 38 protected CVEs
- Verify Servicing Stack update ADV990001 is applied before cumulative updates
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Execution
Tactic
Privilege Escalation
Plain-Language Summary
Microsoft released 973 security patches in September 2026, fixing vulnerabilities across 39 product families. Two Windows flaws are already being used by attackers, and 58 more are expected to be exploited soon. Users and administrators should prioritize the two actively exploited patches and watch for the 82 Office for Mac fixes still pending.
Showing defanged values
- cveCVE-2025-70873Information disclosure issue reported by MITRE.
- cveCVE-2026-34182Improper validation of integrity-check value in CMS data; CVSS 9.1.
- cveCVE-2026-81963Elevation of Privilege via link following; under active exploit in the wild.
- cveCVE-2026-85880Elevation of Privilege via heap-based buffer overflow; under active exploit.