Microsoft Patch Tuesday Security Recap: September 2026 Edition
Arctic Wolf, Tuesday, September 8th, 2026
Two exploited zero-days and over 110 critical flaws affecting DNS and remote services in September's release.
Arctic Wolf Labs summarizes the 8 September Patch Tuesday, highlighting two actively exploited zero-days, CVE-2026-85880 in Windows ALPC and CVE-2026-81963 in the Windows Update Stack, plus more than 110 critical-severity flaws affecting DNS and remote services.
The recap format concentrates on what requires immediate action versus what fits the normal cycle, which is the only workable approach at this release volume.
DNS and remote service vulnerabilities are called out specifically because they are reachable without user interaction.