September 2026 Patch Tuesday: 1,186 Patches, 118 Critical, 975 Actively Exploited
By the Numbers
Microsoft's September 2026 Patch Tuesday is unprecedented in scope and urgency. The release addresses 1,186 vulnerabilities: 118 rated Critical, 913 Important, and 112 Moderate. What makes this month extraordinary is the sheer volume of active exploitation: 975 vulnerabilities are confirmed exploited in the wild, with three already added to the CISA Known Exploited Vulnerabilities catalog. This is not a typical Patch Tuesday; this is an emergency remediation event. The Windows family dominates the release with 620 patches, followed by 307 patches across other components, 133 for Office, and 62 for SQL Server. Organizations should treat this as an all-hands situation requiring immediate patching cycles.
Patches to Prioritize
CVE-2026-34182: CMS AuthEnvelopedData Processing Forgery (CVSS 9.1, Actively Exploited)
This is the highest-severity actively exploited vulnerability this month. A flaw in CMS AuthEnvelopedData processing allows attackers to forge cryptographically signed messages, potentially bypassing authentication controls entirely. An attacker can craft malicious messages that pass validation checks, enabling impersonation attacks or unauthorized access to protected resources.
Attack vector: Network-based, no user interaction required. The attacker submits specially crafted messages to systems processing CMS-formatted data.
Fix: Apply the September cumulative update. Review logs for anomalous authentication events.
---
CVE-2026-55007: Microsoft Exchange Server Remote Code Execution (CVSS 8.1, Actively Exploited)
Attackers are actively exploiting this RCE vulnerability in Exchange Server. Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the Exchange service account, which typically has extensive privileges.
Attack vector: Network-accessible Exchange servers are at risk. The attack requires authentication but can be executed remotely. Given Exchange's exposure profile, this is a high-value target.
Fix: Apply Exchange security updates immediately. Consider temporarily restricting external access to Exchange services until patched.
---
CVE-2026-47297: Microsoft SQL Server Remote Code Execution (CVSS 8.1, Actively Exploited)
This SQL Server vulnerability allows authenticated attackers to execute arbitrary code on the database server. Compromising a SQL Server instance typically grants access to sensitive data and can serve as a pivot point for lateral movement.
Attack vector: Requires network access to the SQL Server instance and valid credentials. Exploitation does not require administrative privileges on the database.
Fix: Apply SQL Server cumulative updates. Audit SQL Server network exposure and authentication logs.
---
CVE-2026-56177: Windows Server Elevation of Privilege (CVSS 7.8, Actively Exploited)
This privilege escalation vulnerability allows a local attacker to elevate from standard user to SYSTEM privileges on Windows Server installations. Attackers with initial foothold can use this to gain complete control of the server.
Attack vector: Local access required. Typically chained with an initial access vulnerability or phishing compromise.
Fix: Deploy the September cumulative update to all Windows Server instances.
---
CVE-2026-56172: Windows VHD Miniport Driver Elevation of Privilege (CVSS 7.8, Actively Exploited)
A flaw in the Windows VHD miniport driver allows local attackers to escalate privileges. This is particularly relevant in virtualization environments and scenarios where VHD files are mounted from untrusted sources.
Attack vector: Local. Attacker must be able to execute code on the target system and interact with VHD mounting operations.
Fix: Apply the Windows cumulative update. Review policies around mounting external VHD files.
---
CVE-2026-56198: Microsoft Trace Data Helper Elevation of Privilege (CVSS 7.8, Actively Exploited)
Attackers are exploiting the Trace Data Helper component to escalate from low-privilege user to SYSTEM. This component is present on most Windows installations.
Attack vector: Local code execution required. Used as a post-compromise privilege escalation technique.
Fix: September cumulative update for Windows.
---
CVE-2026-50349: Windows Ancillary Function Driver for WinSock Elevation of Privilege (CVSS 7.0, Actively Exploited)
The AFD.sys driver vulnerability allows local privilege escalation. AFD vulnerabilities have historically been reliable exploitation targets due to the driver's presence on all Windows systems.
Attack vector: Local. Attacker needs code execution capability on the target system.
Fix: Apply Windows cumulative update. This affects all supported Windows versions.
---
CVE-2026-70873: SQLite zipfile Extension Information Disclosure (CVSS 7.5, Actively Exploited)
A heap memory disclosure vulnerability in SQLite's zipfile extension (versions 3.51.1 and earlier) allows attackers to read sensitive heap memory contents by supplying a malicious ZIP file. This can leak credentials, encryption keys, or other sensitive data.
Attack vector: Attacker supplies a crafted ZIP file to an application using the vulnerable SQLite zipfile extension.
Fix: Update SQLite to version 3.51.2 or later. Identify applications bundling vulnerable SQLite versions.
---
CVE-2026-57098: Microsoft Remote Desktop App Information Disclosure (CVSS 7.5, Actively Exploited)
The Remote Desktop App for Windows leaks sensitive information under exploitation. This could expose credentials, session data, or connection details to attackers.
Attack vector: Network-based. Exploitation targets systems running the Remote Desktop App client.
Fix: Update the Remote Desktop App through Microsoft Store or enterprise deployment channels.
---
CVE-2026-57099: ASP.NET Core Denial of Service (CVSS 7.5, Actively Exploited)
Attackers are actively causing denial-of-service conditions against ASP.NET Core applications. Successful exploitation makes the application unresponsive, affecting availability.
Attack vector: Network-based. Attacker sends crafted requests to the ASP.NET Core application.
Fix: Update the .NET runtime and ASP.NET Core packages. Redeploy applications with updated dependencies.
---
Critical Vulnerability Breakdown
FreeIPMI Stack-Based Buffer Overflows (CVE-2026-85504, CVE-2026-85506, CVE-2026-85507, CVE-2026-85508, CVE-2026-85509)
Five Critical-severity stack-based buffer overflow vulnerabilities affect FreeIPMI versions prior to 1.6.19, all scoring CVSS 9.8. These are not currently exploited but represent severe risk for organizations using IPMI management tools.
CVE-2026-85504: Buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text triggered by malformed Fujitsu SEL long-text responses. An attacker controlling BMC responses or performing man-in-the-middle attacks can achieve code execution.
CVE-2026-85506: Buffer overflow in _get_dell_system_info_idrac_info via the idrac-info subcommand. Affects Dell server management operations.
CVE-2026-85507: Buffer overflow in _output_dell_system_info_cmc_info via the cmc-info subcommand. Exploitation requires interaction with malicious BMC responses.
CVE-2026-85508: Buffer overflow in _output_dell_system_info_cmc_ipv6_info via the cmc-ipv6-info subcommand. Another Dell-specific vector.
CVE-2026-85509: Buffer overflow in _read_fru_data when a BMC returns more bytes than requested. Affects FRU data reading operations.
Fix for all: Upgrade FreeIPMI to version 1.6.19 or later. Isolate IPMI management networks.
---
By Product Family
Windows (620 patches)
Windows dominates this release with over half of all patches. Critical items include the actively exploited privilege escalation vulnerabilities in AFD.sys (CVE-2026-50349), the VHD miniport driver (CVE-2026-56172), Windows Server (CVE-2026-56177), and Trace Data Helper (CVE-2026-56198). The cumulative update addresses a massive attack surface; prioritize deployment across all Windows endpoints and servers.
Office (133 patches)
Microsoft Office receives 133 patches this month. While none of the top actively exploited vulnerabilities are Office-specific, the volume suggests significant code review and remediation has occurred. Review the specific CVEs for any document-parsing or macro-related vulnerabilities that could enable phishing-based attacks.
SQL Server (62 patches)
SQL Server administrators must address CVE-2026-47297 immediately; this RCE vulnerability is actively exploited. The remaining 61 patches span various SQL Server components. Database servers storing sensitive data should be patched within 24 to 48 hours.
Browser (25 patches)
Edge and browser-related components receive 25 patches. Browser vulnerabilities represent common initial access vectors; ensure automatic updates are enabled or deploy updates through enterprise management tools.
.NET (22 patches)
The .NET family includes CVE-2026-57099, an actively exploited denial-of-service vulnerability in ASP.NET Core. Organizations running .NET web applications should update runtime packages and redeploy applications promptly.
Exchange (9 patches)
Exchange Server receives 9 patches, including the Critical actively exploited RCE vulnerability CVE-2026-55007. Given Exchange's history as a high-value target, these patches are mandatory for any organization running on-premises Exchange.
Azure (8 patches)
Azure components receive 8 patches this month. Review Azure-specific advisories for any services your organization consumes. Cloud-hosted services may require configuration changes or redeployment.
---
What to Patch First
- CVE-2026-34182 (CMS AuthEnvelopedData): Highest CVSS among actively exploited, enables authentication bypass through message forgery. Patch immediately.
- CVE-2026-55007 (Exchange Server RCE): Actively exploited, network-accessible, grants code execution on email infrastructure. Patch within 24 hours.
- CVE-2026-47297 (SQL Server RCE): Actively exploited, enables code execution on database servers. Patch within 24 hours.
- CVE-2026-56177, CVE-2026-56172, CVE-2026-56198, CVE-2026-50349 (Windows privilege escalation cluster): All four are actively exploited and allow SYSTEM-level access. Deploy Windows cumulative update within 48 hours.
- CVE-2026-70873 (SQLite): Actively exploited information disclosure. Identify and update affected applications.
- CVE-2026-57099 (ASP.NET Core DoS): Actively exploited, affects web application availability. Update .NET runtimes.
- CVE-2026-57098 (Remote Desktop App): Actively exploited information disclosure. Update client applications.
- FreeIPMI vulnerabilities (CVE-2026-85504 through CVE-2026-85509): Critical severity, not yet exploited. Update FreeIPMI to 1.6.19 within one week.
- Remaining Critical patches: Address within standard Critical SLA timelines.
- Important and Moderate patches: Address through normal patch cycles, prioritizing network-exposed services.
This is the most severe Patch Tuesday in recent memory; the combination of nearly 1,000 actively exploited vulnerabilities and multiple Critical RCE flaws demands emergency patching operations for most organizations.