September 2026 Patch Tuesday: 964 CVEs and Two Actively Exploited Zero-Days (CVE-2026-81963, CVE-2026-85880) — Defender's Triage and Remediation Guide

Microsoft's September 2026 Patch Tuesday is the largest security update release in the company's history: 964 CVEs, dwarfing the previous record set in July 2026. Of those, 104 are rated Critical and 860 are rated Important. Most concerning for defenders: two of these vulnerabilities — CVE-2026-81963 and CVE-2026-85880 — were exploited in the wild as zero-days before patches were available.

If you run Windows, you are affected. The component list alone reads like an inventory of the modern Microsoft enterprise stack: .NET, ASP.NET Core, Active Directory Certificate Services (AD CS), Active Directory Domain Services (AD DS), Active Directory Federation Services (AD FS), Azure Arc, Azure CycleCloud, Azure HDInsight, BranchCache, Connected Devices Platform Service (Cdpsvc), GitHub Copilot and Visual Studio Code, Graphic Fonts, and the HID class driver, among others. Identity infrastructure, developer tooling, and cloud-connected management planes are all in the blast radius.

This post is a practitioner's guide to triaging a release of this magnitude: what we know, how to hunt for post-exploitation behavior while you patch, and how to sequence remediation when "patch everything immediately" collides with operational reality.

What Happened

Per reporting from Tenable's analysis of the release, Microsoft addressed 964 CVEs in September 2026, shattering the previous Patch Tuesday record from July 2026. The severity breakdown:

The two zero-days — CVE-2026-81963 and CVE-2026-85880 — were confirmed as exploited in the wild prior to patch availability, which means threat actors had a working window of opportunity against unpatched systems. At the time of initial reporting, granular per-CVE details (exact component mapping, CVSS vectors, and attacker attribution) were still being digested across the community; defenders should monitor the Microsoft Security Response Center update guide and the Tenable analysis for the authoritative per-CVE breakdowns as they are finalized.

Why This Release Demands Immediate Attention

Three factors elevate this from a routine Patch Tuesday to an emergency change event:

1. Confirmed in-the-wild exploitation. CVE-2026-81963 and CVE-2026-85880 are not theoretical. Once a patch drops, exploit code is reverse-engineered from the binary diff within days — for zero-days that are already being exploited, that window is effectively zero.
2. Identity infrastructure is in scope. AD CS, AD DS, and AD FS all received fixes. Vulnerabilities in these components routinely translate into domain dominance — certificate abuse, Kerberos attacks, and token forgery are the bread and butter of post-initial-access tradecraft.
3. The sheer volume creates patch fatigue risk. A 964-CVE release tempts teams into "deploy the rollup and move on" behavior without validating coverage, reboots, or application compatibility. That's how organizations end up with partially patched fleets three weeks later.

Exploitation Status Summary

• CVE-2026-81963 — Actively exploited in the wild (zero-day at time of patch release).
• CVE-2026-85880 — Actively exploited in the wild (zero-day at time of patch release).
• Remaining 962 CVEs — No confirmed exploitation reported at release, but 104 Critical ratings mean remote code execution and elevation-of-privilege candidates exist across the batch. Assume exploitation of high-value components (AD CS, AD FS, .NET, ASP.NET Core) will follow patch-diffing.

Check CISA's Known Exploited Vulnerabilities catalog — zero-days patched by Microsoft are typically added within days of release, which triggers binding remediation deadlines for federal agencies and serves as a de facto priority signal for everyone else.

Technical Analysis

Affected Products and Platforms

The September 2026 release spans the full Microsoft ecosystem. Components explicitly called out in the release include:

• Identity & Access: Active Directory Certificate Services (AD CS), Active Directory Domain Services, Active Directory Federation Services (AD FS)
• Developer & Runtime: .NET, .NET and Visual Studio, ASP.NET Core, GitHub Copilot and Visual Studio Code
• Cloud & Hybrid Management: Azure Arc, Azure CycleCloud, Azure HDInsight
• Core Windows Services: BranchCache, Connected Devices Platform Service (Cdpsvc), Data Sharing Service Client, Audio Video Control Transport Protocol, HID class driver, Graphic Fonts

The practical implication: this is not a "workstation team handles it" release. Domain controllers, PKI infrastructure, federation servers, Azure Arc-connected servers, and developer endpoints all require coverage — frequently from different teams with different change windows.

Understanding the Threat Model

Without confirmed per-CVE component mapping for the two zero-days at initial publication, defenders should reason from the affected component classes:

• Web and application tier (.NET, ASP.NET Core): Historically the highest-value RCE surface. Exploitation typically manifests as the IIS worker process (w3wp.exe) or a dotnet.exe host spawning unexpected child processes — shells, reconnaissance tooling, or downloaders.
• Identity tier (AD CS, AD DS, AD FS): Exploitation or post-exploitation abuse here targets credential material and trust relationships. Watch for anomalous certificate issuance, unexpected service behavior on federation servers, and identity-protocol anomalies.
• Client and driver tier (HID class driver, Graphic Fonts, Cdpsvc): These are classic local privilege escalation and user-interaction-driven RCE surfaces — the kind chained after phishing or used to escape sandboxes and elevate from user to SYSTEM.

For zero-days already exploited in the wild, the defender's working assumption should be: if an internet-facing or identity-critical system was unpatched during the exploitation window, investigate it — don't just patch it.

Detection & Response

While your patching pipeline runs, hunt for the post-exploitation behaviors most consistent with compromise of the affected component classes. These detections are deliberately behavior-focused rather than CVE-specific — they catch what an attacker does after exploiting a web tier, identity service, or client-side bug, which is where defenders have durable visibility regardless of the exact vulnerability used.

SIGMA Rules

The following rules target the most reliable post-exploitation observables for the affected components. The first two are high-signal in most environments; the third is tuned for developer endpoints and carries a higher false-positive rate — scope it to non-developer machines or tune against your engineering baseline.

---
title: Web Server or .NET Worker Process Spawning Shell
description: Detects IIS worker processes or .NET host processes spawning command shells, script interpreters, or download tools — consistent with post-exploitation of ASP.NET Core or .NET web tier vulnerabilities such as those addressed in the September 2026 Patch Tuesday release.
references:
  - https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-85880-cve-2026-81963
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/09
id: 8f2c1a94-3b7e-4d51-9a26-5e7c8d2f1a3b
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\dotnet.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate application functionality in custom .NET applications that shell out to system tools — baseline per application pool identity
level: high
---
title: Identity Service Process Spawning Unexpected Child Process
description: Detects AD FS or AD CS service processes spawning unusual child processes. Compromise of federation or certificate services — both patched in the September 2026 release — frequently manifests as service processes executing shells or reconnaissance commands under service account context.
references:
  - https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-85880-cve-2026-81963
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/09
id: 4d7e9b12-6a3f-4c85-b2d1-9f4a6c8e2b5d
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Microsoft.IdentityServer.ServiceHost.exe'
      - '\certsrv.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\nltest.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate AD FS and AD CS service operations do not normally spawn interactive tooling — investigate all hits
level: critical
---
title: Visual Studio Code Extension Host Spawning Script Interpreter
description: Detects VS Code or its extension host spawning script interpreters or shells outside typical build tooling context. Relevant given GitHub Copilot and Visual Studio Code fixes in the September 2026 release; malicious extension or workspace-level code execution frequently follows this pattern.
references:
  - https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-85880-cve-2026-81963
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/09
id: 2b6a3d78-9c1e-4f47-8a35-7d2e5b9c4f61
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\Code.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\mshta.exe'
  selection_suspicious_cli:
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'hidden'
      - 'bypass'
  condition: selection_parent and selection_child and selection_suspicious_cli
falsepositives:
  - Developer automation scripts and build tasks using encoded commands — scope to non-developer endpoints or tune against known build tooling
level: medium

KQL Hunt (Microsoft Sentinel / Defender)

This query hunts the same post-exploitation pattern across your fleet via Microsoft Defender for Endpoint telemetry — service and application-tier processes spawning interactive tooling. Run it across the exploitation window (at minimum, the 30 days preceding patch deployment) on any host that was unpatched when the zero-days were public.

// Post-exploitation hunt: web tier, identity services, and developer tooling spawning interactive tooling
// Scope: hosts pending or recently receiving September 2026 Microsoft updates
let Lookback = 30d;
let SensitiveParents = dynamic(["w3wp.exe", "dotnet.exe", "Microsoft.IdentityServer.ServiceHost.exe", "certsrv.exe", "Code.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "net.exe", "whoami.exe", "nltest.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ (SensitiveParents)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName, SHA256
| extend SuspicionScore = case(
    InitiatingProcessFileName in~ ("Microsoft.IdentityServer.ServiceHost.exe", "certsrv.exe"), 3,
    InitiatingProcessFileName in~ ("w3wp.exe", "dotnet.exe"), 2,
    1)
| order by SuspicionScore desc, TimeGenerated desc

Layer a second hunt on identity infrastructure for anomalous behavior during the exposure window — unexpected certificate template modifications, unusual service account logons on AD FS/AD CS hosts, or new services installed on domain controllers:

// Anomalous new services or processes on domain controllers / PKI / federation servers
let Lookback = 30d;
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where DeviceName has_any ("dc", "adfs", "pki", "ca")  // tune to your naming convention
| where FileName =~ "sc.exe" and ProcessCommandLine has "create"
   or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("New-Service", "Set-AD", "Add-Adfs", "certutil -"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName
| order by TimeGenerated desc

Velociraptor VQL

For endpoint forensics on high-value assets (domain controllers, AD FS, AD CS, internet-facing web servers) during the exploitation window, this VQL artifact enumerates live processes matching the post-exploitation parent/child patterns:

-- Hunt for sensitive service processes spawning interactive tooling
-- Targets: IIS/.NET workers, AD FS, AD CS, VS Code post-exploitation patterns
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|certutil|bitsadmin)\.exe'
  AND (
       CommandLine =~ '(?i)(encodedcommand|frombase64string|downloadstring|invoke-expression|bypass|hidden)'
       OR Exe =~ '(?i)(users\\public|programdata|appdata\\local\\temp|windows\\temp)'
      )
ORDER BY CreateTime DESC

Pair it with a review of recently created services and scheduled tasks on identity servers — persistence installed during the zero-day window survives patching:

-- Enumerate services with suspicious binary paths (persistence triage on identity servers)
SELECT Name, DisplayName, PathName, StartName, State, StartMode
FROM services()
WHERE PathName =~ '(?i)(users\\public|programdata|appdata\\local\\temp|windows\\temp)'
   OR PathName =~ '(?i)(powershell|cmd\.exe|mshta|rundll32)'

Patch Verification Script

Deploying the update is not the same as being patched. This PowerShell script verifies update installation state, checks for pending reboots (the number-one cause of "we thought we patched" findings in IR engagements), and flags hosts that have not received updates since before the September 2026 release:

# September 2026 Patch Tuesday verification - run elevated on target hosts
# 1. Confirm latest installed update date
Write-Host "=== Recent Installed Updates ===" -ForegroundColor Cyan
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, Description, InstalledOn | Format-Table -AutoSize

# 2. Check pending reboot status (unrebooted = patch not fully effective)
Write-Host "=== Pending Reboot Check ===" -ForegroundColor Cyan
$pendingReboot = $false
if (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending") { $pendingReboot = $true; Write-Host "CBS RebootPending: TRUE" -ForegroundColor Red }
if (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired") { $pendingReboot = $true; Write-Host "WindowsUpdate RebootRequired: TRUE" -ForegroundColor Red }
if (-not $pendingReboot) { Write-Host "No pending reboot detected." -ForegroundColor Green }

# 3. Query Windows Update for any applicable updates not yet installed
Write-Host "=== Outstanding Applicable Updates ===" -ForegroundColor Cyan
$session = New-Object -ComObject Microsoft.Update.Session
$searcher = $session.CreateUpdateSearcher()
$result = $searcher.Search("IsInstalled=0 and Type='Software' and IsHidden=0")
if ($result.Updates.Count -eq 0) { Write-Host "No outstanding updates detected." -ForegroundColor Green }
else { $result.Updates | ForEach-Object { Write-Host $_.Title -ForegroundColor Yellow } }

# 4. Flag host if newest installed update predates September 2026 Patch Tuesday
$patchTuesday = Get-Date "2026-09-08"
$latest = (Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1).InstalledOn
if ($latest -lt $patchTuesday) { Write-Host "WARNING: No updates installed on/after September 2026 Patch Tuesday. Host likely UNPATCHED for CVE-2026-81963 and CVE-2026-85880." -ForegroundColor Red }
else { Write-Host "Latest update installed on $latest - on/after September 2026 Patch Tuesday." -ForegroundColor Green }

Wrap this in your RMM, Intune remediation, or GPO startup script and pipe results to a central location — a fleet-wide compliance picture matters more than any single host check.

Remediation

Immediate Actions (24–48 Hours)

1. Deploy the September 2026 cumulative updates to internet-facing systems and identity infrastructure first. Domain controllers, AD CS servers, AD FS servers, Azure Arc-connected servers, and any host running ASP.NET Core applications exposed to the internet are your tier-zero priority. These map directly to the components patched and the components attackers target.
2. Verify CVE-2026-81963 and CVE-2026-85880 coverage explicitly. Pull the per-CVE-to-KB mapping from the MSRC Security Update Guide and confirm the relevant KBs report as installed — don't assume the rollup applied cleanly everywhere.
3. Check CISA KEV. If either zero-day is added to the Known Exploited Vulnerabilities catalog, federal civilian agencies face a binding remediation deadline under BOD 22-01 — and private-sector organizations should treat that date as their own ceiling.
4. Hunt before you close the ticket. For any system unpatched during the exploitation window, run the detections above across at least 30 days of telemetry. Patching closes the door; it does not evict an intruder already inside.

Short-Term (This Week)

• Force reboots on patched hosts. A pending-reboot host is functionally unpatched for kernel and driver-level fixes (the HID class driver fixes in this release are a case in point).
• Update developer endpoints. GitHub Copilot and Visual Studio Code fixes require the IDE itself to be updated, not just Windows. Enforce minimum VS Code versions via your software management tooling.
• Validate AD CS and AD FS change control. Review certificate template configurations and federation trust settings for unauthorized modifications made during the exposure window.
• Baseline your exposure. With 964 CVEs, expect follow-up out-of-band updates if any of the Critical-rated issues are subsequently exploited. Pre-stage your emergency patch process now.

Strategic Hardening

• Application control on servers: WDAC or AppLocker policies that block w3wp.exe and service processes from spawning shells would have neutralized entire classes of post-exploitation behavior regardless of which CVE opened the door.
• Tier your identity infrastructure: AD CS, AD FS, and domain controllers should be in a dedicated tier with no internet browsing, no email, and restricted logon — dramatically shrinking the exploitation surface for exactly these component classes.
• Measure patch latency as a KPI: The gap between Patch Tuesday and verified fleet-wide deployment is your real exposure window. For actively exploited zero-days, that window should be measured in hours-to-days, not weeks.

References

• Tenable: Microsoft's September 2026 Patch Tuesday Addresses 964 CVEs
• Microsoft Security Response Center — Security Update Guide
• CISA Known Exploited Vulnerabilities Catalog

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub