Microsoft's Largest Patch Tuesday in History: 0-Days and Wormable DNS Vulnerabilities Behind 966 CVEs

On September 9, Microsoft released its September 2026 Patch Tuesday update, fixing between 966 and 997 CVEs (depending on statistical criteria), breaking the historical record for the number of fixes in a single month. Among them, two Windows privilege escalation 0-days are already being actively exploited in the wild, and 20 vulnerabilities have wormable propagation capabilities. The most concerning is a CVSS 9.8 Windows DNS Server remote code execution vulnerability, which the security community has directly dubbed the "successor to SigRed".

I. What does 966 CVEs mean?

Before 2026, Microsoft fixed an average of about 175 vulnerabilities per month. Fixing 966 in September is 5.6 times the baseline. Combined with the 204 vulnerabilities already fixed in early September for services like Azure, Entra ID, and Edge, the cumulative fixes for September exceeded 1,200.

Microsoft explained that its internal AI-driven vulnerability scanning has significantly accelerated the discovery rate of its own bugs. ZDI (Zero Day Initiative) pointed out in its report that the trend of AI-assisted vulnerability discovery shows no signs of slowing down. The good news is that patching is accelerating; the bad news is that the backlog of vulnerabilities in mature software is far greater than the industry assumed, and AI is digging them out one by one.

II. Details of the Two In-the-Wild 0-Days

The day before the patch release (September 8), two 0-days were added to the KEV catalog. Private enterprises do not have a mandatory deadline, but they should treat them with the same level of urgency.

Both 0-days require local access privileges, usually used by attackers for privilege escalation after gaining an initial foothold. However, in CI runners, multi-tenant dev machines, and containerised build environments, the premise of "local" means the attack surface is much larger than it appears.

III. The Wormable DNS Vulnerability Overshadowed by 0-Days

While the two 0-days dominated the headlines, ZDI and several security vendors have pointed to another vulnerability as the most dangerous of the month: CVE-2026-69730, a Use-After-Free vulnerability in Windows DNS Server with a CVSS score of 9.8.

This vulnerability allows unauthenticated attackers to achieve remote code execution by sending specially crafted packets over the network—no credentials required, no user interaction needed, and no prior foothold necessary. Microsoft has not yet observed active exploitation in the wild, but has assessed it as "more likely". The security community has directly called it the "successor to SigRed"—SigRed being the 2020 CVE-2020-1350, for which Microsoft broke routine to release an emergency out-of-band patch due to its self-propagating worm potential.

Priority Reminder: If you run Windows DNS Server, treat CVE-2026-69730 as a 0-day, regardless of whether it is currently exploited in the wild. A single exposed, unpatched host is all it takes if just one machine in the network is compromised.

This month, a total of 20 wormable vulnerabilities affect network services such as DHCP, Active Directory, SMB Client, Netlogon, NFS, RRAS, IP Helper, MSMQ, and SSTP VPN. Twenty wormable vulnerabilities in a single month is extremely rare on past Patch Tuesdays.

IV. High-Risk Vulnerabilities in Exchange and RDS

Exchange Server has two vulnerabilities this month that require urgent attention:

CVE-2026-55007 (CVSS 8.1): An unauthenticated attacker sends an email with a Visio attachment. The server processes the attachment during content indexing and executes arbitrary code, requiring no user interaction throughout. Microsoft rated exploitation as "unlikely" (requiring the system to be under memory pressure), but repeated attempts only need to succeed once.

CVE-2026-69380 (CVSS 8.1): A low-privileged authenticated attacker can impersonate any user within the organisation and hijack all mailbox data.

The Remote Desktop Services (RDS) vulnerability CVE-2026-69525 (CVSS 9.8) also requires urgent handling: an unauthenticated attacker on the network can execute arbitrary code on the target. Microsoft's advisory states that the exploitation condition is "the attacker must be inside the target network", but because RDP is so widely deployed, it should be treated as an urgent risk regardless of technical limitations.

V. Patch Priority Checklist

It is impossible to apply patches for all 966 CVEs on the same day. Handle them in the following order:

Priority 1 (Immediate): CVE-2026-85880 and CVE-2026-81963—two 0-days exploited in the wild, install KB5124008 via Windows Update (Win11 24H2/25H2)

Priority 2 (Within 48 hours): CVE-2026-69730 Windows DNS Server—if you run DNS Server, treat it as a 0-day

Priority 3 (Within this week): Exchange Server (CVE-2026-55007, CVE-2026-69380) and RDS (CVE-2026-69525)

Priority 4 (Within two weeks): SQL Server (62 vulnerabilities), SharePoint (17 vulnerabilities, including 4 RCEs), Developer Tools (22 vulnerabilities)

Priority 5 (Scheduled): Remaining cumulative updates, arranged according to business maintenance windows

VI. Cyritex's Patch Priority Validation Capabilities

Managing 966 CVEs is a triage issue, not a patching issue. Enterprises need to know: Which vulnerabilities are actually exposed on my attack surface? Can my defensive measures hold up?

The CyriBAS Cyritex Breach and Attack Simulation Platform translates the KEV catalog and real-world threat intelligence into security validation test cases. After the two 0-days are added to the KEV, the platform can use the corresponding attack validation playbooks, allowing enterprises to validate whether their security controls are truly effective before and after patch deployment—whether the firewall blocked it, whether the EDR detected it, and whether the SIEM raised an alert.

The CyriIntel Cyritex Threat Intelligence Platform integrates over 30 global intelligence sources to continuously track more than 900 APT groups and ransomware gangs. For this month's 20 wormable vulnerabilities, the platform monitors the appearance of these CVEs in public in-the-wild exploitation intelligence, helping enterprises determine which vulnerabilities have already been weaponised by attackers.

The CyriCART Cyritex Automated Red Teaming System automatically simulates real attack chains after patch deployment to validate the remediation effects. It is impossible to manually validate all 966 CVEs; automated red teaming allows enterprises to cover key attack paths with a single test to confirm if the patches are truly effective.

Behind the 966 CVEs is the reality that AI is accelerating the discovery of potential vulnerabilities in all software. This trend will not reverse. What enterprises need to build is not the ability to "apply every single patch", but rather the operational capability to "determine which ones must be applied within a limited time, and whether they are truly effective after being applied".

References

[1] Microsoft Security Update Guide, September 2026

[2] CISA Known Exploited Vulnerabilities Catalog, 2026-09-08

[3] Trend Micro Zero Day Initiative, September 2026 Patch Tuesday Analysis

[4] Security researcher analysis, September 2026 Patch Tuesday

Cyritex · Intelligence-Driven Operations, AI-Built Closed Loop