Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Microsoft Releases September 2026 Security Updates

Scheduled updates for Microsoft products address 974 vulnerabilities, including 2 zero-day vulnerabilities

Threat ID:
CC-4846
Threat Severity:
Medium
Published:
9 September 2026 10:55 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Scheduled updates for Microsoft products address 974 vulnerabilities, including 2 zero-day vulnerabilities

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Office

The following platforms are also known to be affected:

Multiple other Microsoft platforms including the following product families:

  • Azure
  • Developer Tools
  • Exchange Server
  • Office 2016
  • SharePoint Server
  • Skype for Business
  • SQL

Please see Microsoft's September 2026 Security Updates guide for full details. 

Threat details

Two zero-day vulnerabilities identified

Microsoft states that exploitation of CVE-2026-81963 and CVE-2026-85880 has been reported. NHS England National CSOC assess that future exploitation is highly likely.

Introduction

Microsoft has released security updates to address 974 vulnerabilities in Microsoft products, including the 2 zero-day vulnerabilities highlighted below. Both of the vulnerabilities below have been reported as exploited.

  • CVE-2026-81963 - Windows Update Stack elevation of privilege vulnerability with a CVSSv3 base score of 7.8.
  • CVE-2026-85880 - Windows Advanced Local Procedure Call (ALPC) elevation of privilege vulnerability with a CVSSv3 base score of 7.8

Remediation advice

Affected organisations are encouraged to review Microsoft's September 2026 Security Updates and apply the relevant updates as soon as possible.

Last edited: 9 September 2026 10:55 am