The short version
All 633 CVEs from September 2026 Patch Tuesday — searchable, filterable, with plain-English IT admin notes on every vulnerability. Includes CVE-2026-81963, the exploited Windows Update Stack EoP, and the five CVEs KB5124008 does not fix.
633
CVEs Catalogued
56
Critical
577
Important
2
Exploited in Wild
What is a CVE?
A CVE (Common Vulnerabilities and Exposures) is a publicly registered security flaw in a software product. Each one gets a unique ID like
CVE-2026-69579 — the year and a sequence number. Microsoft bundles fixes for all known CVEs into monthly Patch Tuesday releases.CVSS Score — the risk number
Every CVE gets a CVSS score from 0.0 to 10.0. It captures: is this remotely exploitable? Does the attacker need a user to click something? How much damage can they do? A 9.8 means unauthenticated, remote, no user interaction. The large number on each row is that score.
Vulnerability types
RCE — attacker runs code on the device
EoP — standard user becomes SYSTEM (common in ransomware chains)
Info Disclosure — data leaks out
DoS — service crashes, no data stolen
SFB — security control bypassed (e.g. SmartScreen)
EoP — standard user becomes SYSTEM (common in ransomware chains)
Info Disclosure — data leaks out
DoS — service crashes, no data stolen
SFB — security control bypassed (e.g. SmartScreen)
What to do
1. Apply KB5124008 — it closes 628 of the 633 below on Windows 11 24H2/25H2. Five need separate action: four are Microsoft Store components (HEVC Video Extensions, Raw Image Extension, Web Media Extensions) that update through the Store, and CVE-2026-69522 is a .NET and Visual Studio flaw with its own updates.
2. Prioritise Critical + CVSS 9+ — especially CVE-2026-81963 (actively exploited EoP).
3. Server admins: RRAS, Netlogon, SSTP all have Critical RCEs this month.
2. Prioritise Critical + CVSS 9+ — especially CVE-2026-81963 (actively exploited EoP).
3. Server admins: RRAS, Netlogon, SSTP all have Critical RCEs this month.
CVSS distribution — the 633 CVEs catalogued below
Below 6 · 92
6.x · 31
7.x · 371
8.x · 115
9+ · 24
September 2026 pattern: Elevation of Privilege dominates (390 of the 633 catalogued here, 62%). For scale, Microsoft’s full September 2026 security update feed carries 2,776 CVE records across every product line, including 442 Chromium entries — so treat the 633 below as this guide’s curated Windows and server scope rather than the entire month. The 56 Critical CVEs are notably high. On a like-for-like scope, the CVEs each month’s Windows 11 client cumulative update remediates, September’s KB5124008 carries 53 Critical out of 628, against 25 of 379 for July’s KB5101650 and just 7 of 194 for August’s KB5121003. Two CVEs were flagged as exploited at release, not one. CVE-2026-81963, a Windows Update Stack elevation of privilege that Microsoft’s own FAQ says could let an attacker "gain SYSTEM privileges", and CVE-2026-85880, a Windows Advanced Local Procedure Call (ALPC) elevation of privilege, both carried Exploited:Yes in Microsoft’s September security update feed. The table below includes the first and not the second, and that is deliberate: Microsoft lists CVE-2026-85880 against Windows 10 and Windows Server only, not Windows 11. So KB5124008 (build 26100.9445 or 26200.9445) closes CVE-2026-81963 on Windows 11, but it does not fix CVE-2026-85880. That one needs its own platform update, such as KB5122878 for Windows 10 22H2 or KB5122882 for Windows Server 2022.
Corrections, 13 October 2026: every row in the catalogue below was re-checked against Microsoft’s September 2026 security update data. All 633 CVE ids exist, and the severity and exploited flags matched on every one. Three field errors were found and fixed: CVE-2026-78446 was listed as a Denial of Service at CVSS 5.3 and is actually a Remote Code Execution at CVSS 7.5, and CVE-2026-69436 was attributed to Windows Error Reporting rather than the Windows State Repository Service. The CVSS chart above was updated to match. Four prose figures were also corrected: the month’s total CVE records, the Chromium count, the July and August Critical comparison, and the claim that KB5124008 fixes all 633. It fixes 628.
Severity
Type
Loading…