Skip to content
Auto-CTI
Back to all deep dives
RAPID7 CYBERSECURITY BLOG

Patch Tuesday - September 2026

KEV CRITICAL Patch Tuesday Windows EoP zero-day
Patch Tuesday - September 2026

Strategic summary

The September Patch Tuesday contains an already actively exploited Windows ALPC EoP flaw and, with 999 CVEs, exceeds all previous Microsoft Patch Tuesdays.

Relevance for you

Two Windows EoP zero-days (ALPC, Update Stack) with active exploitation are addressed in Microsoft Patch Tuesday September 2026; CVSS 7.8 may understate operational risk for systems vulnerable to locally-exploitable privilege-escalation vectors.

Mentioned CVEs

Risk score

95
cvss base
78.00
kev bonus
20.00
epss bonus
0.00
poc bonus
15.00
raw before weight
113.00
industry weight
1.21
freshness factor
1.00
exploitability factor
1.00
days old
0.00
vendor mismatch penalty
0.00
consensus penalty
-5.00

Path: operational

Consensus check

The pipeline self-checks before delivery. These rules lowered the score:

  • VENDOR_MISMATCH Vendor not found in alert title −5
Consensus penalty:
−5.0
Total penalty:
−5.0
ESC

…