September 2026 Patch Tuesday: 974 Flaws, 2 Zero-Days

What does the September 2026 Patch Tuesday contain?

According to The Hacker News: 723 Windows flaws, 111 Office and Office 2016, 62 SQL Server, 22 developer tools (these totals do not add up to 974 and the article does not explain the gap). Elevation of privilege, remote code execution and information disclosure make up nearly 90% of the batch. Tenable gives a slightly different total (964) and puts the month about 70% above the previous record of 569. According to the Zero Day Initiative, Microsoft has fixed 2,760 flaws since January 2026. Count differences come from methods (products included, third-party flaws); keep the order of magnitude rather than the exact figure.

What are the two exploited zero-days?

• CVE-2026-85880 (ALPC): a heap overflow in Windows Advanced Local Procedure Call that lets an authorized local attacker obtain SYSTEM privileges (CVSS v3.1 7.8). Reported by Volexity and Proofpoint. Tenable presents it as the second Windows zero-day of this kind since CVE-2023-21674.
• CVE-2026-81963 (Windows Update Stack): improper link resolution before file access, allowing local elevation to SYSTEM (CVSS v3.1 7.8). Credited to Romain Deperne (Airbus Helicopters) and MSTIC. Tenable says it is the first flaw in this stack exploited in the wild, after seven privilege escalations since 2022.

Microsoft detected exploitation without specifying the actor, the scale or the victims. Both flaws assume local access: they serve as a second stage after an initial compromise.

Which other flaws should you note?

• CVE-2026-55007 (Exchange Server 2019 and SE, CVSS v3.1 8.1): double free, unauthenticated network code execution.
• CVE-2026-80097 (Microsoft Authenticator, 8.6): improper authentication, local elevation; fixed in versions from 6.2606.4246 per NVD.
• 9.8 network RCEs: Remote Desktop Services (CVE-2026-69525), NFS ONCRPC XDR driver (CVE-2026-69595), DNS Server (CVE-2026-69730), Shell (CVE-2026-69829), DHCP Server (CVE-2026-72979).
• CVE-2026-65669 (SQL Server, 9.6) and CVE-2026-69465 (SharePoint, 8.8).

How do you prioritize?

Treating 974 fixes as 974 decisions is a mistake. Filter in three steps: presence in your inventory, exposure (servers reachable from uncontrolled segments, DMZ, guest Wi-Fi, customer networks), then exploitability (KEV, public code). Recommended order: the two zero-days on all workstations and servers, the 9.8 network RCEs on exposed servers, Exchange, then the rest in the normal cycle. The September 22 KEV deadline is a ceiling.

How do you verify and fix?

1. Measure your patch level by build version on workstations and servers (inventory, fleet management tool).
2. Deploy the ALPC and Update Stack fixes first, then RDS, DNS, DHCP, NFS and Exchange servers.
3. Look for signs of local exploitation: low-privilege processes launching SYSTEM processes, suspicious symbolic links in update directories, new services.
4. Check Microsoft Authenticator on managed devices and update it.

What changes when an AI agent has access to these workstations and servers?

Agents that act on a workstation (computer use, coding agents, desktop automation) execute code and open files in a low-privilege user session. Local elevation zero-days are exactly what turns a compromise of that session, for example a prompt injection that makes it run a script or download a booby-trapped file (OWASP LLM01, LLM06), into control of the machine. An agent where the model has the initiative becomes a first attack stage, and a SYSTEM flaw the second.

Three effects. Untrusted code surface: an agent that opens documents, archives and pages runs parsers that have their own flaws. The authenticator: Microsoft Authenticator carries second factors; a local elevation (CVE-2026-80097) can expose codes or approvals used for agent accounts. And cadence: patch volumes are rising, and Microsoft said in July it uses an AI-assisted flaw discovery system (reported by BleepingComputer), so agent workstations must be updated at a steady pace. Useful controls: agents in disposable virtual machines or containers, accounts without administrator rights, no production secrets on workstations, logging of launched commands and human approval of executable downloads. See AI agent security and the article on the July 2026 Patch Tuesday.

How do you industrialize monthly triage?

Automate three things: the inventory of build versions per machine, the daily cross-check against CISA's KEV and Microsoft advisories, and a dashboard of the delay between publication and deployment per category (exploited, critical and exposed, other). Set written target delays: a few days for exploited flaws, one to two weeks for exposed critical ones, the normal cycle for the rest. These delays are what a customer or an auditor will ask for, well before the number of patches. Include agent workstations and virtual machines in the same inventory, since they are often created outside the usual fleet process.

How do you test an agent against September 2026 Patch Tuesday?

An agent red team checks what a booby-trapped instruction can make the agent launch on the workstation or server where it runs, with which rights, and whether isolation holds. On the offer side, the Agent Red Team Express transposes to an agent's perimeter the flaws of one month of patches (5 days, 1,900 euros). The method details the approach.

What is the lesson?

A record number of patches mostly signals that triage matters more than volume. Know within hours whether you are exposed to a given CVE, keep an accurate inventory and treat agent workstations as machines exposed to hostile content.