September 2026 marks the largest single-day vulnerability disclosure in Microsoft's history. The Redmond giant published 974 own-product vulnerabilities, of which 723 affect Windows — the operating system that underpins the vast majority of enterprise estates we defend. Add in Microsoft's fixes for 25 non-Microsoft CVEs (Chromium-based components, third-party libraries bundled into products, and similar), and defenders are looking at 999 vulnerabilities landing in a single drop.
Two things make this cycle more than a volume story:
- Microsoft is aware of in-the-wild exploitation for two of the vulnerabilities published today. Any CVE that ships with an "Exploited" flag goes to the front of the patching queue — full stop.
- A Windows Advanced Local Procedure Call (ALPC) elevation-of-privilege vulnerability remains unpatched — meaning an attacker with code execution on a Windows host has a publicly known path from a standard user context to SYSTEM, and there is no vendor fix available at publication time.
As Rapid7 noted last month, there is no indication Patch Tuesday will ever return to pre-2026 volumes. If your vulnerability management program was built around triaging 60–80 CVEs a month, it is now structurally broken. This post covers how to triage a 999-CVE drop, what the ALPC EoP means defensively while it remains unpatched, and concrete detection and hardening content your SOC can deploy today.
Technical Analysis
The Numbers That Matter
| Metric | September 2026 |
|---|---|
| Total CVEs addressed | 999 |
| Microsoft own-product CVEs | 974 |
| Windows-specific CVEs | 723 |
| Non-Microsoft CVEs fixed by Microsoft | 25 |
| Confirmed exploited in the wild | 2 |
| Publicly known, unpatched | 1 (Windows ALPC EoP) |
With 723 Windows CVEs in a single release, the practical reality is that every supported Windows version and nearly every core component is touched — the kernel, RPC runtime, print spooler, ALPC, common log and graphics subsystems, network protocol stacks, and privilege boundary services. Specific CVE identifiers and CVSS scores are enumerated in the Microsoft Security Update Guide and the Rapid7 Patch Tuesday analysis; the two exploited-in-the-wild entries will also land in the CISA Known Exploited Vulnerabilities (KEV) catalog shortly, which typically carries a 3-week remediation deadline for federal civilian agencies — a deadline every private-sector organization should treat as its own internal SLA.
The Unpatched Windows ALPC Elevation of Privilege
ALPC is the inter-process communication mechanism Windows uses to pass messages between processes on the same machine — it is the backbone of how low-privileged processes request services from privileged ones (Task Scheduler, Print Spooler, Workstation service, and dozens of others). Because privileged services accept and act on ALPC messages from untrusted callers, ALPC has been a perennial source of privilege escalation bugs — the "eternal game of whack-a-mole between Microsoft and attackers" is an apt description.
From a defender's perspective, the attack chain for an ALPC-class EoP looks like this:
- Initial access — attacker achieves code execution as a standard user (phishing payload, exploited service, web shell, malicious document).
- EoP stage — the attacker sends crafted ALPC messages to a privileged service, or abuses an insecure ALPC server endpoint to coerce the privileged service into performing an action on the attacker's behalf (writing a file, loading a DLL, modifying an ACL, or starting a scheduled task as SYSTEM).
- Privilege persistence — once SYSTEM is obtained, expect rapid follow-on activity: credential dumping (LSASS access), disabling of EDR/Defender, new local admin accounts, and lateral movement staging.
The critical defensive insight: an unpatched local EoP only matters if an attacker already has a foothold — but attackers almost always have a foothold. Phishing-driven initial access remains the dominant intrusion vector, which means this unpatched ALPC bug is effectively a "phish-to-SYSTEM" upgrade kit sitting on every unpatched Windows endpoint in your estate.
Exploitation Status Summary
- 2 CVEs in this release: confirmed in-the-wild exploitation (details and CVE identifiers in the Microsoft Security Update Guide and CISA KEV).
- Windows ALPC EoP: publicly known, no patch available at time of writing. Treat every Windows endpoint as carrying a latent SYSTEM-escalation path until Microsoft ships a fix — likely out-of-band or next month's cumulative update.
Detection & Response
Because the ALPC EoP is unpatched, detection is your compensating control. The most reliable observable of ALPC-class privilege escalation is the behavioral footprint of the escalation and its aftermath, not the ALPC message itself: a standard-user process causing a privileged service to write executable content into protected directories, spawn elevated children, or perform account/LSASS activity.
Sigma Rules
---
title: Non-System Process Writing Executable Content to System32 or SysWOW64
id: 9b2f4c71-3a8e-4d52-b7a1-6e5c2d8f9a3b
status: experimental
description: Detects a non-SYSTEM process writing DLL or EXE files into Windows system directories, a common payload stage of local privilege escalation exploits including ALPC-based EoP attacks that coerce privileged services into dropping attacker-controlled binaries.
references:
- https://www.rapid7.com/blog/post/em-patch-tuesday-september-2026
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/09/08
tags:
- attack.privilege_escalation
- attack.t1068
- attack.persistence
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- '\System32\'
- '\SysWOW64\'
TargetFilename|endswith:
- '.dll'
- '.exe'
- '.sys'
Image|contains:
- '\Users\'
- '\AppData\'
- '\ProgramData\'
- '\Temp\'
- '\Windows\Temp\'
falsepositives:
- Software deployment tooling running from staging directories (SCCM, Intune) - baseline and exclude known deployment agents
- Enterprise installers with per-user staging paths
level: high
---
title: Privileged Service Spawning Interactive or Scripting Child Processes
id: 4d7a9e13-8c25-4b61-a3f2-1e8d6b4c9a7e
status: experimental
description: Detects SYSTEM-level services commonly abused via ALPC (Task Scheduler, Print Spooler, RPC runtime hosts) spawning command shells or scripting interpreters. Legitimate instances of these services rarely spawn interactive interpreters; this pattern is a strong post-EoP indicator.
references:
- https://www.rapid7.com/blog/post/em-patch-tuesday-september-2026
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/08
tags:
- attack.privilege_escalation
- attack.t1068
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\svchost.exe'
- '\spoolsv.exe'
- '\dllhost.exe'
- '\lsass.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
filter_known:
CommandLine|contains:
- 'Microsoft-Windows-'
condition: selection_parent and selection_child and not filter_known
falsepositives:
- Some scheduled maintenance tasks invoke scripts via svchost-spawned taskeng - tune per environment
- Print driver installation utilities (rare in hardened environments)
level: high
---
title: LSASS Access by Non-Standard Processes Following Privilege Escalation
id: 7e1c3b58-2f94-4a36-9d8b-5c6a1e7f2b4d
status: experimental
description: Detects processes opening LSASS with memory-read access rights, a near-universal post-exploitation step after SYSTEM-level escalation for credential theft. Correlate with recent local privilege escalation activity on the same host.
references:
- https://www.rapid7.com/blog/post/em-patch-tuesday-september-2026
- https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/09/08
tags:
- attack.credential_access
- attack.t1003.001
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|endswith: '\lsass.exe'
GrantedAccess|contains:
- '0x1010'
- '0x1410'
- '0x1438'
- '0x143a'
- '0x1fffff'
filter_legitimate:
SourceImage|contains:
- '\Windows\System32\'
- '\Windows\System32\svchost.exe'
- '\Program Files\Microsoft Defender'
- '\Program Files\Windows Defender'
- 'MsMpEng.exe'
- 'NisSrv.exe'
condition: selection and not filter_legitimate
falsepositives:
- EDR agents and AV products legitimately inspect LSASS - add vendor paths to exclusion list per environment
- Backup and identity management agents
level: critical
KQL — Microsoft Sentinel / Defender
The following hunt query identifies the two-stage behavioral signature of local privilege escalation: a non-system process writing executable content into system directories, correlated with privileged service processes spawning shells on the same device within a short window. It is tuned for Microsoft Defender for Endpoint tables and works in both the Defender portal and Sentinel.
// Hunt for local EoP behavior: user-context processes writing executables into System32,
// correlated with privileged services spawning shells on the same host
let Lookback = 7d;
let SuspiciousWrites =
DeviceFileEvents
| where Timestamp > ago(Lookback)
| where FolderPath has_any (@"\Windows\System32", @"\Windows\SysWOW64")
| where FileName endswith_any (".dll", ".exe", ".sys")
| where InitiatingProcessFolderPath has_any (@"\Users\", @"\AppData\", @"\ProgramData\", @"\Temp\")
| extend WriteTime = Timestamp
| project WriteTime, DeviceName, DeviceId, FileName, FolderPath,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, ReportId;
let ServiceShells =
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName in~ ("svchost.exe", "spoolsv.exe", "dllhost.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
"cscript.exe", "rundll32.exe", "regsvr32.exe")
| where ProcessCommandLine !has "Microsoft-Windows-"
| project ShellTime = Timestamp, DeviceName, DeviceId, FileName,
ProcessCommandLine, AccountName, InitiatingProcessFileName;
SuspiciousWrites
| join kind=inner ServiceShells on DeviceId
| where abs(datetime_diff('minute', ShellTime, WriteTime)) <= 60
| project WriteTime, ShellTime, DeviceName, FileName, FolderPath,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, ProcessCommandLine, AccountName
| order by WriteTime desc
Velociraptor VQL
Use this artifact during triage of a host suspected of local privilege escalation. It surfaces recently created executable content in system directories alongside currently running processes executing from user-writable paths — the classic "escalated payload dropped by exploit, now running as SYSTEM" pattern.
-- Triage: Recent executable writes to system directories and processes
-- running from user-writable paths (post-EoP indicators)
LET system_writes <=
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
'C:/Windows/System32/**/*.exe',
'C:/Windows/System32/**/*.dll',
'C:/Windows/SysWOW64/**/*.exe',
'C:/Windows/SysWOW64/**/*.dll'
], accessor='ntfs')
WHERE Btime > now() - 86400 * 3
ORDER BY Btime DESC
LET suspicious_procs <=
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)\\\\(Users|ProgramData|AppData|Temp)\\\\'
AND NOT Username =~ '(?i)^(SYSTEM|LOCAL SERVICE|NETWORK SERVICE)$'
SELECT 'RecentSystemWrite' AS Indicator, FullPath AS Detail, Btime AS Seen
FROM system_writes
UNION
SELECT 'UserPathProcess' AS Indicator,
format(format='%v (PID %v) %v', args=[Name, Pid, Exe]) AS Detail,
CreateTime AS Seen
FROM suspicious_procs
ORDER BY Seen DESC
Remediation and Verification Script
This PowerShell script applies September 2026 cumulative updates, verifies installed hotfixes from this cycle, confirms the two exploited-in-the-wild CVEs' patches are present (via the Microsoft Security Update Guide), and applies hardening measures that mitigate ALPC-class escalation while the unpatched EoP remains outstanding. Run as an administrator; adapt the KB check list to your OS builds from the Microsoft Security Update Guide.
# September 2026 Patch Tuesday - Verification & Hardening Script
# Run elevated on Windows 10/11 and Windows Server 2022/2025
# 1. Check pending reboots and current OS build
$os = Get-CimInstance Win32_OperatingSystem
Write-Host "[+] OS: $($os.Caption) Build $($os.BuildNumber).$($os.UBR)" -ForegroundColor Cyan
# 2. Trigger scan & install via PSWindowsUpdate (module must be deployed enterprise-wide)
if (Get-Module -ListAvailable -Name PSWindowsUpdate) {
Import-Module PSWindowsUpdate
Write-Host "[+] Scanning for September 2026 updates..." -ForegroundColor Cyan
Get-WindowsUpdate -MicrosoftUpdate -Verbose
# Uncomment to install in production rings after testing:
# Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot:$false
} else {
Write-Warning "PSWindowsUpdate not present. Install: Install-Module PSWindowsUpdate -Force"
}
# 3. Verify September 2026 cumulative update installed (populate with KBs for your builds
# from the Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide)
$TargetKBs = @("KB5065XXX", "KB5066XXX") # <-- REPLACE with Sept 2026 CU KBs per build
$Installed = Get-HotFix | Select-Object -ExpandProperty HotFixID
foreach ($kb in $TargetKBs) {
if ($Installed -contains $kb) {
Write-Host "[PASS] $kb installed" -ForegroundColor Green
} else {
Write-Host "[FAIL] $kb MISSING - host vulnerable to Sept 2026 CVEs" -ForegroundColor Red
}
}
# 4. Compensating hardening while the ALPC EoP remains unpatched
# a. Enforce Attack Surface Reduction rules that break post-EoP payload stages
$ASRRules = @{
'75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84' = 1 # Block Office from creating child processes
'D4F940AB-401B-4EFC-AADC-AD5F3C50688A' = 1 # Block Office child/injection content
'E6DB77E5-3DF2-4CF1-B95A-636979351E5B' = 1 # Block persistence through WMI event subscription
'D1E49AAC-8F56-4280-B9BA-993A6D77406C' = 1 # Block abuse of exploited signed drivers
'BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550' = 1 # Block executable content from email/webmail
}
foreach ($rule in $ASRRules.GetEnumerator()) {
Add-MpPreference -AttackSurfaceReductionRules_Ids $rule.Key -AttackSurfaceReductionRules_Actions $rule.Value
}
Write-Host "[+] ASR rules enforced" -ForegroundColor Cyan
# b. Enable Credential Guard + LSASS protection to blunt post-EoP credential theft
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'RunAsPPL' -Value 1 -Force
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard' -Name 'EnableVirtualizationBasedSecurity' -Value 1 -Force
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'LsaCfgFlags' -Value 1 -Force
Write-Host "[+] LSASS PPL and Credential Guard enabled (reboot required)" -ForegroundColor Cyan
# c. Audit privileged service child-process spawning to feed detection rules
auditpol /set /subcategory:"Process Creation" /success:enable /failure:disable
auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:disable
# 5. Quick EoP triage check: executable content written to System32 in last 72h by non-SYSTEM writers
$cutoff = (Get-Date).AddHours(-72)
Get-ChildItem 'C:\Windows\System32' -Include *.exe,*.dll -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.CreationTime -gt $cutoff } |
Select-Object FullName, CreationTime |
Format-Table -AutoSize
Write-Host "[!] Review any hits above against approved change records" -ForegroundColor Yellow
Remediation — Prioritized Action Plan
With 999 CVEs, "patch everything now" is not a plan — it's paralysis. Execute in this order:
T+0 to T+48 hours (Emergency tier):
- Patch the 2 exploited-in-the-wild CVEs first. Identify them in the Microsoft Security Update Guide and the Rapid7 September 2026 Patch Tuesday analysis. Check the CISA KEV catalog for confirmed additions and due dates — treat KEV deadlines as binding even if you are not a federal agency.
- Deploy the compensating controls above for the unpatched ALPC EoP: ASR rules, LSASS PPL/Credential Guard, and the behavioral detections in this post. This is your only protection until Microsoft ships a fix.
- Internet-facing and boundary systems: any September CVE affecting exposed services (web, RDP, VPN concentrators, Exchange, SharePoint) gets patched inside this window regardless of exploitation status.
T+7 days (Standard ring): 4. Critical/Important remote code execution CVEs across server and workstation fleets, prioritized by exposure and privilege context (services running as SYSTEM first). 5. The 25 non-Microsoft CVEs Microsoft shipped fixes for — verify Chromium-based Edge components and bundled third-party libraries are covered by your standard browser/application update channels.
T+14 days: 6. Remaining elevation-of-privilege and information-disclosure CVEs. Do not skip these: EoP flaws are precisely what convert a phished workstation into domain compromise, as the unpatched ALPC bug demonstrates.
Structural changes this cycle demands:
- Rebuild your triage model for 2026 volumes. Risk-based scoring (KEV status, exploitation probability, asset exposure, privilege context) is no longer optional when a single month delivers 999 CVEs. CVSS alone will drown your team.
- Validate patch deployment with vulnerability scanner confirmation, not WSUS/Intune "success" reports. At this volume, silent partial failures are guaranteed — scan-verify a statistically significant sample of each ring.
- Watch for an out-of-band ALPC fix. Microsoft has historically shipped emergency releases for actively discussed unpatched EoPs. Subscribe to the MSRC and set your patch pipeline to fast-track any ALPC/RPC runtime update.
- Hunt retroactively. If the two exploited CVEs have been in use, assume weeks of pre-patch exposure. Run the detection content above against 30–90 days of telemetry, not just going forward.
The uncomfortable truth of September 2026 is that vulnerability volume has permanently reset. The organizations that will absorb record Patch Tuesdays without incident are the ones that treat prioritization, compensating controls, and behavioral detection as a system — not as a monthly fire drill.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.