Patch Tuesday - September 2026

What it is

Rapid7's September 2026 Patch Tuesday write-up. The part of the page that was fetched contains the commentary and the first part of the per-product tables, up to Windows Power Dependency Coordinator. This note covers what those tables add to the catalog summary: which unexploited bugs Microsoft rates as more likely to be exploited, and what the Edge advisory gap means in practice.

Preconditions / Affected

• Edge: CVE-2026-85046 is the exploited V8 zero-day. Edge stable got the fix on September 2 and Chrome on September 3. Microsoft had published no advisory for it almost a week later, and the advisory URL returned a 404. The Edge release notes do mention the fix.
• Other Chrome fixes: Chrome patched 11 other bugs alongside CVE-2026-85046, for example CVE-2026-85045. Rapid7 says it is unclear whether Edge has them, and advises assuming they are unpatched until Microsoft confirms.
• Volume: the tables are dominated by clusters, so triage by rating rather than by CVE count.
• Windows Biometric Service has roughly 80 EoP CVEs, almost all CVSS 7.8 and rated Unlikely or Less Likely.
• Windows DHCP Server has about 40 CVEs, including RCEs CVE-2026-69845 and CVE-2026-72979 (both 9.8, Less Likely).

What to do

1. Patch the two exploited zero-days first. - CVE-2026-85880 (ALPC EoP to SYSTEM) is rated "Exploitation Detected", CVSS 7.8. Rapid7 says Server 2025 and Windows 11 receive no patch for it, so those systems cannot be fixed this cycle. Check the MSRC entry for mitigations before relying on this. - CVE-2026-81963 (Windows Update Stack EoP) is patched on all supported Windows versions.
2. Then prioritize the bugs rated "Exploitation More Likely", all unexploited so far: - Network-facing RCE: - CVE-2026-69525, Remote Desktop Services, 9.8. - CVE-2026-69730, DNS Server, 9.8. - CVE-2026-69676, Kerberos, 8.8. - CVE-2026-69623, HTTP Print Provider, 8.0. - CVE-2026-72957, Deployment Services, 7.8. - Cloud: CVE-2026-69857 (Cosmos DB spoofing, 8.5) and CVE-2026-69854 (Spring Cloud Azure EoP, 9.0). - Local EoP, for post-compromise chaining: - Windows Kernel: CVE-2026-68846, -68884, -69366, -69466 and -69473. - Windows Search Component: CVE-2026-69305, -69585, -69600 and -69911. - Also CVE-2026-69436 and CVE-2026-69450 (Error Reporting), CVE-2026-70342 (Ancillary Function Driver for WinSock) and CVE-2026-69391 (Broker Infrastructure).
3. Check Edge by build, not by advisory. Compare the installed Edge version against the Edge release notes for September 2, not against MSRC.
4. Exchange 2016/2019 shows 9 CVEs in the ESU tables. The most severe are CVE-2026-69641 (EoP, 9.1) and CVE-2026-69356 (spoofing, 9.3), both rated Less Likely. Rapid7 says these versions have no ESU after the October 2026 lifecycle date.

Caveats

• Lifecycle dates have passed. The page says October 14, 2026 is when these happen: Windows 11 24H2 Home/Pro end of servicing, Server 2012/2012 R2 final ESU year ends, Office 2021 loses support, and Exchange 2016/2019 reach no-ESU status. Today is October 17, so check whether affected systems are now unsupported.
• The Rust claim is speculation. The page's suggestion that the missing ALPC patches reflect Rust rewrites is Rapid7's inference, not a Microsoft statement. Treat the missing patch as an unmitigated exposure.
• Coverage is partial. The page is 180,504 characters and only the first 60,000 were available. The tables end partway through the Windows section. The remaining Windows components and the other tables are not covered, so more "More Likely" items probably exist.