September 2026 Patch Tuesday: What Windows Server, Active Directory, and Exchange Admins Need to Patch Right Now

Microsoft’s September 2026 Patch Tuesday is the largest release in the program’s history: 974 CVEs addressed in a single month, 114 of them rated Critical. Two of those are zero-days already being exploited in the wild and confirmed on CISA’s Known Exploited Vulnerabilities (KEV) catalog. If you manage Windows Server, Active Directory, or Exchange Server, this is not a month to let patching slip. Here’s what actually matters, in priority order, and how to verify you’re covered.

Patch these first: the two confirmed zero-days

Two vulnerabilities in this release are already being actively exploited, which puts them ahead of everything else on the list regardless of CVSS score:

• CVE-2026-81963, an elevation of privilege vulnerability in the Windows Update Stack.
• CVE-2026-85880, an elevation of privilege vulnerability in Windows Advanced Local Procedure Call (ALPC).

Both are on CISA’s KEV catalog, which specifically tracks vulnerabilities confirmed to be exploited in real attacks, not just theoretically exploitable. Elevation of privilege bugs like these are typically chained with an initial foothold (phishing, a compromised low-privilege account) to reach full system control, so patching them closes off a step attackers are already actively using.

CVE-2026-55007: unauthenticated remote code execution in Exchange Server

This is the one Exchange administrators specifically need to know about. CVE-2026-55007 is a double-free vulnerability (CVSS 8.1) that allows an unauthenticated attacker to achieve remote code execution by sending an email with a specially crafted Visio attachment to an affected Exchange server.

What makes this one worth understanding in detail rather than just patching blind:

• No user interaction is required. The vulnerable code path triggers during content indexing when the server processes the mail, not when a user opens the attachment or even views it in the Preview Pane.
• Successful exploitation requires the target system to be under sustained low-memory (memory pressure) conditions, not something present during normal, healthy operation. This narrows the practical attack window somewhat, but it is not a reason to deprioritize patching, since memory pressure is exactly the kind of condition that can occur during a busy mail day, a backup window, or an already-degraded server you might not have noticed yet.
• This continues a pattern from recent Exchange Server disclosures: unauthenticated, no-interaction-required RCE vulnerabilities reachable simply by sending mail to the server remain one of the most consistently dangerous categories of Exchange vulnerability, precisely because internet-facing Exchange servers accept mail from anyone by design.

Verify your patch level after installing this month’s update:

Get-ExchangeServer | Select-Object Name, AdminDisplayVersion, Edition | Format-List
Get-Command Get-SecurityUpdateStatus -ErrorAction SilentlyContinue

Cross-reference the build number shown against Microsoft’s current Exchange Server build numbers reference to confirm you’re on the September 2026 security update, not just “a recent one.”

CVE-2026-69676: Kerberos authentication bypass via replay attack

This is the one that matters most for Active Directory environments specifically. CVE-2026-69676 is a Critical RCE (CVSS 8.8) that works through a capture-and-replay attack against Windows Kerberos.

The mechanics: an attacker who has already obtained low-privileged credentials somewhere in the environment (a compromised standard user account, for example, not a domain admin) can intercept a legitimate Kerberos authentication exchange and replay a modified variant of it back to the target server. The server processes the replayed exchange as authentic and executes attacker-controlled code as a result.

This affects a very broad range of systems: Windows 10, Windows 11 across all currently supported feature updates, and Windows Server 2012 through 2025 (including Server Core installations). If you have any domain controllers or member servers not yet on this month’s update, treat this one as urgent, since Kerberos sits underneath essentially all authentication in an Active Directory environment. A working exploit chain here is a path toward broader domain compromise, not an isolated single-machine issue.

Check patch status across your domain controllers in one pass:

Get-ADDomainController -Filter * | ForEach-Object {
    Invoke-Command -ComputerName $_.HostName -ScriptBlock {
        Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-14) } |
            Select-Object HotFixID, InstalledOn
    }
}

CVE-2026-69524: Active Directory Domain Services, part of a wormable cluster

Alongside the Kerberos bug, this release includes a cluster of vulnerabilities Microsoft and third-party researchers have flagged as wormable, meaning a successful exploit could self-propagate across a network without further attacker interaction, in the style of historical worms like WannaCry and NotPetya. CVE-2026-69524 affects Active Directory Domain Services directly. Wormable classifications are reserved for vulnerabilities with genuinely severe potential blast radius, treat any wormable-flagged AD vulnerability as a same-week patching priority, not a normal-cadence one.

Practical patching order for this specific month

1. The two confirmed zero-days (CVE-2026-81963, CVE-2026-85880) on every Windows machine, workstation and server alike, since both affect the Windows Update stack and core OS components broadly.
2. Domain controllers, prioritizing the Kerberos fix (CVE-2026-69676) and the AD DS wormable fix (CVE-2026-69524), given how central both are to overall domain security.
3. Exchange servers, for CVE-2026-55007, especially any internet-facing Exchange server accepting external mail.
4. Everything else in this month’s 974-CVE release, via your normal patch management cadence (WSUS, SCCM, Intune, or your update tooling of choice).

Frequently asked questions

How do I confirm a specific CVE from this Patch Tuesday is actually installed on a given server?
Cross-reference the KB article associated with the CVE (found in Microsoft’s Security Update Guide entry for that CVE) against Get-HotFix output on the target machine, or check your patch management platform’s compliance report if you’re using WSUS, SCCM, or Intune, all three can report compliance against a specific KB or CVE directly rather than requiring manual cross-referencing on every machine.

Our Exchange server is only accessible internally, not from the internet. Does CVE-2026-55007 still matter?
Yes, treat it as still urgent. The vulnerability triggers on mail the server processes, not on network-level access to the server itself. Internal mail, mail forwarded from an internet-facing gateway, and mail from a compromised internal account can all reach the vulnerable code path even without the Exchange server itself being directly internet-facing.

What does “wormable” actually mean in Microsoft’s advisory language, and should it change how fast I patch?
It means Microsoft’s own security researchers assess that a successful exploit could spread automatically between vulnerable systems without further attacker action, similar to how EternalBlue enabled WannaCry to spread in 2017. It is one of the strongest urgency signals Microsoft attaches to a vulnerability, and it should move that specific patch ahead of your normal testing and deployment cadence rather than waiting for the next scheduled maintenance window.