September 2026 Patch Tuesday: The Dev-Machine CVEs Windows Update Won't Fix

Microsoft shipped the September 2026 Patch Tuesday on September 8, and the headline number is the biggest in the company's history. For developers, the number is a distraction. Four of the CVEs in this release sit on your working machine rather than a server, and not one of them is fixed by Windows Update. They ship through the Visual Studio Code updater, npm, and an Azure CLI extension.

How big was this Patch Tuesday, really?

Published counts range from 966 to 974, and none of them quite match. We pulled Microsoft's own CVRF v3.0 feed for 2026-Sep and counted: 1,187 CVE records in the document. Of those, 190 are Azure Linux (Mariner) packages that Microsoft republishes from upstream projects like libpcap. Strip those and 997 remain, 113 of them rated Critical and 860 Important.

That is why the reported totals differ. Each outlet draws the Mariner and unrated lines in a slightly different place. The count is real either way, and it is also close to meaningless as a severity signal, because two CVEs in the set are under active attack and neither is Critical.

Which CVEs are actually on a developer's machine?

The Copilot pair is the interesting one. CVE-2026-81380 is a command injection (CWE-77) that, per Microsoft's advisory, could "allow an attacker to obtain sensitive information from the user's development environment, including workspace data and environment variables, by causing GitHub Copilot agent mode to send that information to an attacker-controlled service." Its sibling CVE-2026-81381 is insufficiently protected credentials (CWE-522) and can expose the sign-in access token for a user's work account.

Neither carries a scary base score. Both require user interaction, and 81380 is rated high attack complexity. That scoring reflects how hard the bug is to trigger, not what you lose when it works, and what you lose here is the contents of a repo plus whatever secrets live in your shell environment. This is the same class of problem as the agent authorization CVEs from August: the agent has your permissions, so a bug in the agent inherits them.

The Azure CLI chain is worth reading twice. An attacker who can only edit tags on an Azure virtual machine plants a crafted tag. Later, an administrator runs the affected az vm repair tag-copy command on Windows, and the tag is interpreted as a command and executes with the administrator's permissions. Low starting privilege, changed scope, 8.0.

What about the two exploited zero-days?

Exactly two CVEs in the release carry Microsoft's "Exploitation Detected" tag, and nothing in the set was publicly disclosed before the patch:

• CVE-2026-81963, Windows Update Stack, link following, CVSS 7.8, grants SYSTEM.
• CVE-2026-85880, Windows ALPC, heap overflow, CVSS 7.8, escapes a low-privilege AppContainer to SYSTEM.

Both are local elevation of privilege, so an attacker needs code running on the box already. They are the back half of an intrusion, not the front door. The highest-scoring bug in the release, CVE-2026-69730 in Windows DNS Server (CVSS 9.8, use-after-free, no authentication or interaction, rated "Exploitation More Likely"), is the one to escalate if you run Windows DNS.

What to do now

Windows Update handles the OS half. The developer half needs three separate actions:

1# 1. VS Code: check Help > About for 1.136.2 or later, then update2code --version3 4# 2. Any app using MSAL for Node.js5npm install @azure/msal-node@^5.6.0 --save6 7# 3. Azure CLI vm repair extension8az extension update --name vm-repair

Then rebuild and redeploy anything that bundles MSAL, because a lockfile does not patch itself. That is the pattern worth internalizing from this month: as more of the toolchain moves into editors, extensions, and npm packages, self-hosted and local setups inherit the patching burden that a managed platform would have absorbed for you.