On September 8, 2026, Microsoft shipped its largest Patch Tuesday on record — somewhere between 964 and 974 CVEs depending on which tracker you trust — including two Windows zero-days already being exploited in the wild and a critical, "wormable" remote code execution bug in Windows DNS Server that Microsoft itself is comparing to SigRed, the 2020 DNS flaw that spent 17 years hiding in the codebase. If you run Active Directory, this is not a month to let updates sit in a maintenance window queue.
What happened
Microsoft's monthly security release landed with a count that every outlet covering it flagged as a record, beating the previous high (569 CVEs, set in July 2026) by a wide margin. BleepingComputer counted 966 vulnerabilities; Tenable's writeup cites 964; a handful of other trackers land at 973–974. The gap comes down to counting methodology — whether duplicate advisories, Edge/Chromium-sourced CVEs, and third-party component fixes get folded into the same tally — not disagreement about what shipped. For the purposes of "how big was this," treat the number as "just under a thousand," because every source agrees on that much.
Of those, roughly 105 were rated Critical, and about 860 Important. By vulnerability class, elevation-of-privilege bugs made up the largest share (around 45%), followed by remote code execution (roughly 27%), according to CrowdStrike's breakdown. The update spans Windows client and server, Microsoft 365 apps, SQL Server, Exchange Server, Entra ID, Azure services, and core Windows subsystems.
Two vulnerabilities were confirmed as zero-days — meaning they were being actively exploited before a patch existed:
- CVE-2026-81963 — an elevation-of-privilege flaw in the Windows Update Stack itself, caused by improper link resolution ("link following") that lets an attacker who already has local access escalate to SYSTEM. CVSS 7.8.
- CVE-2026-85880 — a heap-based buffer overflow in Windows ALPC (Advanced Local Procedure Call), also an EoP path to SYSTEM privileges. CVSS 7.8.
Both are local privilege-escalation bugs, not remote entry points — they're the second stage of an attack chain, used once someone already has a foothold on a box, which is exactly the pattern ransomware crews use after an initial phishing or credential-stuffing compromise.
The bug drawing the most attention from the security research community, however, isn't one of the confirmed zero-days — it's CVE-2026-69730, a critical, unauthenticated, remote code execution vulnerability in Windows DNS Server, with a CVSS score of 9.8. Microsoft describes it as a use-after-free triggerable by a single crafted network packet, requiring no authentication and no user interaction, and rates exploitation as "More Likely." Researchers covering the release have called it a "spiritual successor" to SigRed (CVE-2020-1350), the wormable DNS Server bug Check Point discovered in 2020 after it had shipped, unnoticed, for roughly 17 years. Microsoft's September release patched 20 vulnerabilities total that it rates as wormable — capable of spreading machine-to-machine without user interaction — with CVE-2026-69730 the standout because of where DNS typically runs.
Why the DNS bug specifically matters
In most on-premises Active Directory environments, the DNS Server role isn't isolated on dedicated infrastructure — it runs directly on domain controllers, because that's the default and the path of least administrative friction. That means a successful exploit against CVE-2026-69730 isn't "an attacker got into a DNS box"; it's "an attacker got remote code execution on a domain controller," with no credentials required. That's about as bad as a single CVE gets in a Windows environment: DCs hold the keys to Kerberos tickets, group policy, and effectively every downstream trust relationship in the domain. Eight other RCEs in Windows DNS Server were also patched this month, though Microsoft didn't rate any of them as exploitable as CVE-2026-69730.
What this changes
For a team running Windows Server and Active Directory, this is not a routine patch cycle to batch into next month's change window. The realistic priority order:
1. Patch domain controllers and any DNS-serving Windows Server hosts first, specifically for CVE-2026-69730. If your DNS role is co-located with AD (the common case), treat this like a Tier-0 emergency change, not a scheduled one.
2. Patch the two actively-exploited zero-days (CVE-2026-81963, CVE-2026-85880) on all endpoints, not just servers — both are local EoP bugs and both are already being used, meaning some attacker toolkits already assume they're present on unpatched machines.
3. Everything else in the ~966-CVE pile can follow your normal risk-based cadence, but don't let the sheer size of this release become an excuse to defer the two items above. A month with a thousand fixes is also a month where it's easiest to lose the three that matter in the noise.
If your infrastructure runs DNS on non-domain-controller, hardened resolvers — a pattern some larger shops already use specifically to limit blast radius from bugs like this — this is a good moment to confirm that separation is actually configured the way you think it is, rather than assuming it from an old architecture diagram.
For engineering teams outside the Windows/AD world, the more durable lesson is about attack surface concentration: a single memory-safety bug (use-after-free) in a protocol-parsing path (DNS) that happens to be co-located with your highest-value identity infrastructure turns a moderate bug into a domain-ending one. That's an architecture decision, not a patching decision, and it's worth an audit even in a quarter without a record-breaking Patch Tuesday.
Wise Hustlers builds and hardens backend infrastructure, including identity and access architecture, for clients who need this kind of separation done right — see our services if that's a gap you're looking to close.
Sources
- Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
- September 2026 Patch Tuesday: Updates and Analysis — CrowdStrike
- Microsoft's September 2026 Patch Tuesday addresses 964 CVEs — Tenable
- Microsoft September 2026 Patch Tuesday: 966 Flaws, 2 Zero-Days, Wormable DNS — byteiota
- September 2026 Microsoft Patch Tuesday — SANS Internet Storm Center