September 2026 Windows Patch Tuesday Fixes Two Exploited Zero-Days: What to Install Now

Microsoft’s September 2026 Windows security updates fix two actively exploited privilege-escalation flaws. Check the correct KB and build for Windows 11, eligible Windows 10, and Windows Server, plus the no-new-macOS result.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

A blue security shield on a desktop monitor contains two amber threat symbols beside a secondary laptop with a neutral screen
Original editorial illustration: Windows is the actionable September 8 security update; the secondary laptop represents the separate macOS source check.

Microsoft’s September 2026 Patch Tuesday updates are available, and this month deserves prompt attention. Microsoft marks two Windows elevation-of-privilege vulnerabilities as already exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC).[1] Home users should back up important files and install the security update offered through Windows Update; businesses should use a short pilot ring, then accelerate deployment.

The short version

  • Release type: September 8, 2026 monthly Windows security “B” release—commonly called Patch Tuesday—not a preview or Insider build.[2][6]
  • Urgency: High. Microsoft reports exploitation detected for two Windows privilege-escalation flaws, although it does not disclose victim counts, campaign scope, or the attackers’ initial-access method in the checked feed.[1]
  • Main Windows 11 update: KB5124008 moves Windows 11 25H2 to build 26200.9445 and 24H2 to build 26100.9445.[2][3]
  • Windows 10: KB5122878 is for eligible Windows 10 22H2 ESU and LTSC 2021 systems; ordinary unsupported Windows 10 PCs do not become eligible merely because the KB exists.[5]
  • Apple check: Apple posted iOS/iPadOS 26.6.2 today, but its official pages show no same-day macOS security release, Rapid Security Response, or dated Background Security Improvement.[7][8][9]

Reporting cutoff: September 8, 2026 at 7:40:07 p.m. EDT (23:40:07 UTC). Vendor pages can change as investigations and servicing continue.

Why the two exploited Windows flaws matter

CVE-2026-81963 affects the Windows Update Stack, while CVE-2026-85880 affects Windows ALPC. Microsoft classifies both as Important elevation-of-privilege vulnerabilities and marks exploitation as detected.[1] Elevation of privilege usually matters after an attacker has obtained some access, because it can help that attacker gain stronger local rights. That is different from proving either flaw is a one-click remote compromise.

The machine-readable September catalog is unusually large and spans Windows, Office, Azure, developer tools, servers, and other Microsoft products. Applicability varies by product, edition, architecture, and installed components, so this guide does not turn the raw catalog into a misleading “every PC has this many flaws” total.[1]

What remains unknown

Microsoft’s checked data does not identify the attackers, victims, campaign scale, or initial-access method for either exploited flaw. Patching is important, but it does not replace phishing resistance, endpoint protection, application control, least privilege, and credential monitoring.

Which September update should you see?

Phone readers: swipe the table left to see every column. Use winver to identify your installed version and build before comparing it with this list.

Windows releaseSeptember updateExpected buildWho it applies to
Windows 11 25H2KB512400826200.9445Supported 25H2 editions[2][3]
Windows 11 24H2KB512400826100.9445Supported 24H2 editions; Home/Pro reach end of updates October 13, 2026[2][3]
Windows 11 26H1KB512401228000.2954Devices actually running this production branch[2]
Windows 11 23H2KB5122880Verify in Windows Update history after installationEnterprise/Education; their updates end November 10, 2026[1][4]
Windows 10 22H2 / 21H2KB512287819045.7725 / 19044.7725Eligible ESU and LTSC 2021 systems—not every old Windows 10 PC[1][5]
Windows Server 2025KB512287126100.33438Server 2025 and Server Core[1]
Windows Server 2022KB512288220348.5622Server 2022 and Server Core[1]
Windows Server 2019KB512287617763.9245Server 2019, Server Core, and related LTSC servicing[1]

How to check whether your PC is affected

  1. Press Windows key + R, type winver, and press Enter.
  2. Record the Windows version and OS build shown.
  3. Open Settings → Windows Update and select Check for updates.
  4. Install the September cumulative security update offered for your exact version.
  5. Restart when prompted, run winver again, and compare the result with the table.

Do not force KB5124008 onto a PC running a different Windows branch. Windows Update normally selects the package that matches the device’s version, architecture, servicing channel, and prerequisites. Managed business systems may intentionally receive the update through a delayed deployment ring.

What changed besides security fixes?

For Windows 11 24H2 and 25H2, KB5124008 carries forward the August 27 preview’s quality changes and adds security servicing. Microsoft highlights broader targeting for updated Secure Boot certificates, a fix for customized mouse cursor appearance, a fix for black or missing personalization backgrounds, improved Teams and Outlook stability on Arm64 PCs, Remote Desktop audio-redirection work, and updated Morocco time-zone handling.[3]

Microsoft also includes servicing-stack update KB5124007 (build 26100.9441) with KB5124008 and says it is not currently aware of issues with the main Windows 11 update.[3] “No known issues” means none are documented at the cutoff; it is not a guarantee that every hardware, driver, VPN, printer, or line-of-business application has been tested.

Known cautions

  • Microsoft’s KB5124008 and KB5122880 pages said the company was not currently aware of issues at the reporting cutoff.[3][4]
  • IT teams servicing offline Windows images must include the matching boot.stl file. Microsoft warns that omitting it can stop installation media from starting and produce error 0xc0430001.[3]
  • Windows 11 24H2 Home and Pro reach end of updates on October 13, 2026; installing today’s patch does not extend that deadline.[3]
  • Windows 11 23H2 Enterprise and Education reach end of updates on November 10, 2026.[4]

What home users should do tonight

  • Back up important files. A current backup protects against update trouble, storage failure, and malware.
  • Plug in laptops. Do not interrupt operating-system or Secure Boot servicing.
  • Use Windows Update. Avoid third-party “driver updater” or “patch” tools.
  • Restart and verify. Confirm the build with winver, then test your browser, printer, VPN, camera, and normal apps.
  • Watch for real symptoms. Do not uninstall the update preemptively. If a specific failure appears, document the error and get help before changing Secure Boot, BitLocker, or recovery settings.

What businesses and IT administrators should do

  1. Inventory Windows versions, editions, exposed servers, privileged workstations, and unsupported exceptions.
  2. Deploy to a representative pilot ring covering endpoint security, VPN, printing, Remote Desktop, Arm64 devices, management agents, and critical business applications.
  3. Because exploitation is documented, keep the pilot short and accelerate broad deployment when core checks pass.[1]
  4. Verify the installed KB and resulting build in Intune, Windows Update for Business, WSUS, RMM, or another inventory source; do not rely only on a “deployment complete” banner.
  5. Confirm recovery keys and backups are available before mass restarts. Monitor boot, BitLocker, VPN, authentication, Remote Desktop audio, and application-crash signals.
  6. For offline-image servicing, validate boot.stl and installation-media architecture before deployment.[3]

The good and the bad

Good

  • Security fixes are available for both exploited Windows flaws.
  • The main Windows 11 KB pages list no known issues at the cutoff.
  • The cumulative updates also include prior quality improvements.
  • Secure Boot certificate deployment continues to broaden.

Bad / caution

  • Two Windows flaws already have exploitation detected.
  • The catalog’s size and product breadth make applicability easy to misread.
  • Windows 10 eligibility depends on ESU or an in-support LTSC edition.
  • Version and servicing-channel checks matter before any manual Catalog installation.

What about macOS?

Apple’s security-release table was updated today for iOS 26.6.2 and iPadOS 26.6.2, but it did not list a September 8 macOS security release.[7] Apple’s Developer releases page likewise showed today’s iOS/iPadOS build 23G90 and Transporter 1.4.5, while the latest listed production macOS release remained macOS 26.6.2 build 25G83 from August 17.[8]

The latest macOS security entry remained macOS Tahoe 26.6.2 from August 17, and Apple’s Background Security Improvements overview did not establish a new dated macOS background release today.[7][9] Mac owners should still install the current update offered by Software Update, but this article’s same-day security action is Windows-focused.

Frequently asked questions

Is this a preview update or Insider build?

No. This is Microsoft’s monthly security “B” release for supported production branches. Preview “D” releases and Insider builds are separate categories.[2]

Are the two flaws really being exploited?

Yes. Microsoft marks CVE-2026-81963 and CVE-2026-85880 as “Exploitation Detected.” It does not disclose the scale or identify a campaign in the checked September feed.[1]

Should a home user wait a week?

The documented exploitation favors prompt installation after saving work and confirming a backup. A business can use a short pilot ring, but a broad delay should have monitoring, exception ownership, and compensating controls.

Do I need to download the KB manually?

Usually not. Supported PCs should receive the correct cumulative package through Windows Update or an organization’s approved management system. Manual Catalog installation is mainly for administrators and troubleshooting, and the package must match the exact version and architecture.

Is Windows 10 still protected?

Only eligible serviced systems receive this release. Microsoft lists KB5122878 for Windows 10 22H2 ESU and Windows 10 Enterprise LTSC 2021 branches; an unsupported consumer PC without ESU is not made current by the KB’s existence.[5]

Need a deeper recap?

Today’s 5 PM Technology News Recap covers the same Windows release in brief alongside four other technology stories.[10] This standalone guide adds version-by-version KB/build checks, Windows 10 and Server coverage, deployment cautions, and separate home/business actions.

If Windows Update fails, a BitLocker recovery prompt appears, or a critical business application breaks after patching, avoid random “fix” utilities. Schedule The IT Guys for practical help in Port Saint Lucie, Jensen Beach, Fort Pierce, and Vero Beach.

Sources checked

  1. Microsoft Security Response Center — September 2026 CVRF security release.
  2. Microsoft — Windows 11 release information.
  3. Microsoft Support — KB5124008 for Windows 11 24H2 and 25H2.
  4. Microsoft Support — KB5122880 for Windows 11 23H2.
  5. Microsoft Support — KB5122878 for eligible Windows 10 21H2/22H2 systems.
  6. Microsoft — Windows Message Center.
  7. Apple — Apple security releases.
  8. Apple Developer — Software Releases.
  9. Apple — Background Security Improvements by date.
  10. The IT Guys — September 8, 2026 5 PM Technology News Recap.

Browse Articles

Latest Articles