Patch Tuesday, September 2026
Microsoft's monthly security release, Tuesday, September 8, 2026. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
5 CVEs · 0 critical · 2 exploited · 0 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
5 CVEs · 0 critical · 2 exploited · 0 with public exploit code
- 7.8HighSep 8, 2026Microsoft Windows Path traversal / file handlingCVE-2026-81963Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.Exploited
- 7.8HighSep 8, 2026Microsoft Windows Memory corruptionCVE-2026-85880Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.Exploited3.6% likely
- 8.6HighSep 8, 2026Microsoft Authenticator for Android Auth bypass / access controlCVE-2026-80097Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
- 7.8HighSep 8, 2026Microsoft Windows 10 Version 1607 Memory corruptionCVE-2026-69284Heap-based buffer overflow in Windows DCOM Server allows an authorized attacker to elevate privileges locally.
- 7.0HighSep 8, 2026Microsoft Windows 10 Version 1607 Memory corruptionCVE-2026-69473Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
Adobe
1 CVE · 1 critical · 1 exploited · 0 with public exploit code
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.