Skip to content

September 2026 Patch Tuesday: two exploited zero-days, 113 critical, and a post-patch Defender "ShieldCrash" PoC

Summary

CrowdStrike's September 8, 2026 Patch Tuesday analysis covers a record 972 Microsoft CVEs (more than double August), including fixes for two exploited zero-days and 113 Critical vulnerabilities. Separately, about two hours after the patches dropped, researcher MSNightmare (Nightmare-Eclipse) released a public proof-of-concept zero-day against Microsoft Defender dubbed "ShieldCrash" — claimed to exploit an unpatched path in the ShieldBreak (CVE-2026-69414) remediation for SYSTEM-level file reads, with potential escalation to full SYSTEM privilege escalation. No patch or mitigation for ShieldCrash existed at time of writing; CrowdStrike notes MSNightmare's prior claims have historically been accurate.

Tags

Why this matters

  • Patch-Tuesday record volume (972) with two in-the-wild exploited LPEs means the local escalation step is the hot path: both zero-days convert a foothold into SYSTEM/kernel control, the reliable "final step" that commodity malware and targeted operators both lean on.
  • A post-patch zero-day PoC (ShieldCrash) shipped alongside the patches, so "we patched Tuesday" is not sufficient for Defender posture this cycle — the ShieldBreak remediation path is reportedly incomplete.
  • Identity- and edge-critical items (critical RCE in Netlogon and Kerberos; AD-integrated DNS; SSTP VPN) are the classic "one exploited gateway = perimeter breach + lateral movement" classes.

The two exploited zero-days (both local, LPE, CVSS 7.8)

CVE Component Description
CVE-2026-81963 Windows Update Stack Elevation of privilege (7.8). A local low-privilege attacker exploits improper link resolution (link-following) to reach SYSTEM, no user interaction. Attack surface ≈ the entire Windows fleet; reliably converts "foothold" → "full control."
CVE-2026-85880 Windows Advanced Local Procedure Call (ALPC) Elevation of privilege (7.8). A local attacker with code execution — even inside a low-privilege AppContainer sandbox — triggers a heap-based buffer overflow to escape to kernel-mode control.

Both are on the September 8, 2026 CISA KEV page as the two local authorized-attacker Windows LPEs (due 2026-09-22).

Post-patch: "ShieldCrash" public PoC against Microsoft Defender

~Two hours after the Patch Tuesday release, MSNightmare published a PoC zero-day against Microsoft Defender, calling it ShieldCrash. The claim: Microsoft's patch for the ShieldBreak vulnerability (CVE-2026-69414) was incomplete, and the PoC follows an unpatched attack path to SYSTEM-level file reads, with the potential to be converted into a full SYSTEM privilege-escalation exploit. CrowdStrike's status: claims under review, analysis ongoing; no patch or mitigation available at time of writing; historically this researcher's claims have been accurate. Track: Microsoft's response, a fix that closes the unpatched ShieldBreak path, and any in-the-wild exploitation.

Other notable September 2026 items (CrowdStrike's picks)

  • Microsoft Office: 22 Critical patches, 12 exploitable via Preview Pane or Reading Pane — with the pane enabled, merely previewing a crafted file triggers code execution with no click/attachment handling. Three 9.8 items in the pane subset include CVE-2026-77493 (Windows Graphics Component).
  • Netlogon and Kerberos: critical RCE vulnerabilities in both domain-identity protocols. Compromise gives a foothold in the authentication layer every other domain service trusts, potentially enabling forged/manipulated ticket-granting operations and forest-wide lateral movement.
  • AD-integrated DNS: runs on domain controllers; a successful exploit delivers code execution on a DC (NTDS.dit, Kerberos keys, forge authentication).
  • SSTP VPN: critical RCE — SSTP-based remote-access VPNs typically expose the vulnerable service directly on TCP/443, so exploitation needs no prior network access or credentials; a perimeter breach with immediate lateral-movement opportunity.
  • Hyper-V: guest-to-host escape flaws (CVE-2026-72961 buffer overflow in virtual TPM state handling → VTL1; plus CVE-2026-7603 / CVE-2026-80083 enabling guest-VM hypervisor-boundary breach) — targets for advanced adversaries who bypass multi-tenant/segmentation isolation.

Risk mix (CrowdStrike): elevation of privilege 437 patches (45%), RCE 258 (26%), information disclosure 171 (18%). Windows received the most patches (726), followed by ESU (650) and Office (135).

Defender actions

  1. Prioritize the two exploited LPEs (CVE-2026-81963, CVE-2026-85880) across the Windows fleet — these are the post-initial-access escalation step.
  2. Do not assume "patched Tuesday" for Defender — track the ShieldCrash unpatched ShieldBreak path (CVE-2026-69414) and Microsoft's fix; watch for SYSTEM-level file-read abuse indicators in the interim.
  3. Harden the identity/edge layer: patch the Netlogon/Kerberos criticals, AD-integrated DNS, and exposed SSTP VPN endpoints (internet-facing :443).
  4. Review Preview/Reading Pane exposure for the Office criticals — consider disabling panes where not required until the 12 pane-exploitable items are patched.
  5. Segment hypervisor workloads and patch Hyper-V guest-to-host escapes to preserve isolation boundaries.
  6. Use the Falcon Patch Tuesday dashboard (Exposure Management → Vulnerability Management → Dashboards) for prioritization where available; CrowdStrike notes not all highly exploitable vulns are easily patched, so maintain a mitigation plan for the no-patch window (ShieldCrash).

Sources