Skip to content

Back to the catalog

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
blog.talosintelligence.comadvisory

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Cisco Talos's analysis of Microsoft's September 2026 Patch Tuesday release, covering 973 vulnerabilities (113 critical, 82 of those RCE). Two flaws are confirmed exploited in the wild — CVE-2026-81963 (Windows Update Stack elevation of privilege) and CVE-2026-85880 (Windows ALPC elevation of privilege) — alongside a long list Microsoft rates "more likely" to be exploited, including a Windows Kerberos auth-bypass-by-replay RCE (CVE-2026-69676) and a Windows DNS Server use-after-free RCE (CVE-2026-69730). Talos releases accompanying Snort 2/3 rule coverage (SIDs 67011-67084, 301619-301655) to detect exploitation attempts.

TL;DR Talos breaks down September 2026 Patch Tuesday's 973 Microsoft CVEs (2 already exploited, dozens "more likely") and ships matching Snort detection rules.
Open original ↗
Document

What it is

Cisco Talos's breakdown of Microsoft's September 2026 Patch Tuesday, with the specific CVSS scores, CWE mechanisms, and affected components for each of the two actively-exploited bugs and the eight "more likely exploited" vulnerabilities, plus Snort SID coverage ranges.

How it works

CVE-2026-81963 (Windows Update Stack EoP, CVSS 7.8) stems from improper link resolution before file access ("link following") combined with improper access control — a local attacker can redirect a file operation via a symlink/junction to escalate privileges. CVE-2026-85880 (Windows ALPC EoP, CVSS 7.8) is a heap-based buffer overflow paired with use of uninitialized resource in the ALPC message-passing subsystem.

Among the "more likely" set, the Kerberos RCE CVE-2026-69676 (CVSS 8.8) is an authentication-bypass-by-capture-replay flaw — an attacker captures and replays a Kerberos auth exchange to execute code. The DNS Server RCE CVE-2026-69730 (CVSS 9.8) is a use-after-free. Others in that tier: Windows RRAS heap overflow RCE (CVE-2026-69852, 7.5), Windows Deployment Services heap overflow RCE (CVE-2026-72957, 7.8), Spring Cloud Azure improper-authentication EoP (CVE-2026-69854, CVSS 9.0 — notably not a Windows-OS component), Windows VBS out-of-bounds read info-disclosure (CVE-2026-83501, 5.5), Windows NFS ONCRPC XDR driver use-after-free RCE (CVE-2026-70585, 7.0), and Azure Cosmos DB authorization-bypass-through-user-controlled-key spoofing (CVE-2026-69857, 8.5).

Separately, several uncategorized "critical" cloud/identity bugs carry maximum severity: CVE-2026-83711 (Azure AD B2C, authorization bypass, CVSS 10.0) and CVE-2026-70352 (Azure AI Language, missing authentication for a critical function, CVSS 10.0), plus CVE-2026-83941 (Entra ID, missing authorization, 9.9).

Preconditions / Affected

Windows Update Stack and ALPC exploits require local access (both are EoP). Kerberos replay RCE requires an attacker able to intercept/replay auth traffic on the network path. DNS Server RCE requires the vulnerable DNS role to be running and reachable. Cloud-service CVEs (Spring Cloud Azure, Cosmos DB, Entra ID, AD B2C, AI Language) affect Microsoft-hosted/managed services rather than on-prem Windows installs, so patching is Microsoft-side, not customer-deployed.

What to do

Prioritize patching CVE-2026-81963 and CVE-2026-85880 first (confirmed in-the-wild exploitation). Next, patch the Kerberos (CVE-2026-69676) and DNS Server (CVE-2026-69730, CVSS 9.8) RCEs given Microsoft's "more likely exploited" rating and the DNS bug's severity. For network detection, Talos's Snort 2 ruleset covers SIDs 67011-67032 and 67036-67084; Snort 3 covers SIDs 301619-301629, 301632-301655, and 67046 — apply these via SRU update (Cisco Secure Firewall) or the latest Snort.org rule pack.

Caveats

The article itself states additional Snort rules may be released later and current rules are subject to change pending more information on the exploits.

CVEs named here

  • CVE-2026-81963
  • CVE-2026-85880
  • CVE-2026-69676
  • CVE-2026-69852
  • CVE-2026-72957
  • CVE-2026-69854
  • CVE-2026-83501
  • CVE-2026-70585
  • CVE-2026-69730
  • CVE-2026-69857
  • CVE-2026-69845
  • CVE-2026-72979
  • CVE-2026-58599
  • CVE-2026-65772
  • CVE-2026-66302
  • CVE-2026-67631
  • CVE-2026-65669
  • CVE-2026-67378
  • CVE-2026-69499
  • CVE-2026-70296
  • CVE-2026-73023
  • CVE-2026-77495
  • CVE-2026-73013
  • CVE-2026-69501
  • CVE-2026-83939
  • CVE-2026-69906
  • CVE-2026-69846
  • CVE-2026-69590
  • CVE-2026-72959
  • CVE-2026-69601
  • CVE-2026-72981
  • CVE-2026-73006
  • CVE-2026-73009
  • CVE-2026-73010
  • CVE-2026-78444
  • CVE-2026-73017
  • CVE-2026-77493
  • CVE-2026-83498
  • CVE-2026-69530
  • CVE-2026-78449
  • CVE-2026-78450
  • CVE-2026-81948
  • CVE-2026-81950
  • CVE-2026-81951
  • CVE-2026-81959
  • CVE-2026-81953
  • CVE-2026-81354
  • CVE-2026-78525
  • CVE-2026-78520
  • CVE-2026-78519
  • CVE-2026-78509
  • CVE-2026-81952
  • CVE-2026-78510
  • CVE-2026-69595
  • CVE-2026-78445
  • CVE-2026-73018
  • CVE-2026-72986
  • CVE-2026-70203
  • CVE-2026-69632
  • CVE-2026-77898
  • CVE-2026-69285
  • CVE-2026-78505
  • CVE-2026-69813
  • CVE-2026-77505
  • CVE-2026-78439
  • CVE-2026-81355
  • CVE-2026-77504
  • CVE-2026-69649
  • CVE-2026-69797
  • CVE-2026-69767
  • CVE-2026-69678
  • CVE-2026-72983
  • CVE-2026-69518
  • CVE-2026-69712
  • CVE-2026-69603
  • CVE-2026-72961
  • CVE-2026-80083
  • CVE-2026-69710
  • CVE-2026-69725
  • CVE-2026-69740
  • CVE-2026-69784
  • CVE-2026-69799
  • CVE-2026-69820
  • CVE-2026-69864
  • CVE-2026-72980
  • CVE-2026-69769
  • CVE-2026-69829
  • CVE-2026-69860
  • CVE-2026-69874
  • CVE-2026-69890
  • CVE-2026-70586
  • CVE-2026-72950
  • CVE-2026-72954
  • CVE-2026-72958
  • CVE-2026-72960
  • CVE-2026-72962
  • CVE-2026-72982
  • CVE-2026-72987
  • CVE-2026-81949
  • CVE-2026-81352
  • CVE-2026-81955
  • CVE-2026-69858
  • CVE-2026-69827
  • CVE-2026-67643
  • CVE-2026-67636
  • CVE-2026-69579
  • CVE-2026-70351
  • CVE-2026-62916
  • CVE-2026-83941
  • CVE-2026-65818
  • CVE-2026-80098
  • CVE-2026-83711
  • CVE-2026-70178
  • CVE-2026-70352
  • CVE-2026-62906
  • CVE-2026-68846
  • CVE-2026-68876
  • CVE-2026-68880
  • CVE-2026-68884
  • CVE-2026-69274
  • CVE-2026-69277
  • CVE-2026-69301
  • CVE-2026-69305
  • CVE-2026-69310
  • CVE-2026-69337
  • CVE-2026-69364
  • CVE-2026-69385
  • CVE-2026-69391
  • CVE-2026-69406
  • CVE-2026-69436
  • CVE-2026-69450
  • CVE-2026-69451
  • CVE-2026-69459
  • CVE-2026-69466
  • CVE-2026-69473
  • CVE-2026-69478
  • CVE-2026-69498
  • CVE-2026-69525
  • CVE-2026-69541
  • CVE-2026-69585
  • CVE-2026-69600
  • CVE-2026-69605
  • CVE-2026-69623
  • CVE-2026-69714
  • CVE-2026-69723
  • CVE-2026-69757
  • CVE-2026-69777
  • CVE-2026-69779
  • CVE-2026-69832
  • CVE-2026-69911
  • CVE-2026-69921
  • CVE-2026-70289
  • CVE-2026-70342
  • CVE-2026-70562
  • CVE-2026-70583
  • CVE-2026-71340
  • CVE-2026-72936
  • CVE-2026-77500
  • CVE-2026-78454
  • CVE-2026-69460
  • CVE-2026-69467
  • CVE-2026-80093
  • CVE-2026-72940
  • CVE-2026-71343
  • CVE-2026-69366

Technologies named here

Techniques named here

Related in Blue Team & Detection