Testing Guidance

September 2026 Patch Tuesday Testing Guidance

By ·

Readiness September 2026 Testing Guidance card showing low sun over a hillside meadow, with the Readiness and Microsoft marks, by Greg Lambert

Microsoft’s September 2026 Patch Tuesday is the largest cycle of the year: 963 CVEs needing customer action, 106 rated critical, and two already exploited. July, the previous high, carried 610. Microsoft has not published per-component risk flags this month, so the order below is drawn from the release itself, weighing patch volume, severity and exposed surface. Three clusters dominate: biometric sign-in takes 73 fixes, storage and file systems 132, and the DHCP Server role 36. Every supported baseline is in scope, from Windows Server 2012 on the monthly rollup up to Windows 11 26H1 and Server 2025.

Biometrics and Windows Hello

The Windows Biometric Service draws 64 fixes, the largest single-component count of the year, and 56 are heap overflows that hand a local attacker SYSTEM. Windows Hello adds nine more, all critical. Any estate using fingerprint or facial sign-in takes this first.

  • Enrol a fingerprint and a face on each supported device model, sign in with each, then delete and re-enrol the credential.
  • Sign in with Windows Hello for Business after a restart, after resume from sleep, and after a lock screen timeout, confirming PIN fallback works when the sensor is unavailable.
  • Work the failure paths, using a wet fingerprint, a covered camera, a disconnected external sensor and a device with no biometric hardware, and confirm each falls back cleanly rather than hanging.
  • Restart the biometric service (WbioSrvc) and confirm enrolled credentials survive the restart and a switch between user profiles.

Kernel, Core Services, and the Two Exploited Flaws

CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call are both exploited in the wild, and both give SYSTEM to a local attacker. Around them sit Windows Error Reporting (12 fixes), the Windows Kernel (11), Windows Search (11), the Device Association Service (11) and Secure Kernel Mode (four, all critical).

  • Install the update, then run a second Windows Update cycle end to end and confirm update history records both passes.
  • Trigger an application crash and confirm Windows Error Reporting writes its report without prompting for elevation.
  • Rebuild the search index, then search by file name and by content, and confirm results include indexed network and offline locations.
  • Pair and unpair a wireless device through Settings to exercise the Device Association Service, then confirm the pairing survives a restart.

Storage and File Systems

NTFS takes 29 fixes, Spaceport.sys behind Storage Spaces 17 and the Overlay Filter seven, with the Volume Manager, VHD miniport, iSCSI and Storage Port drivers behind them. This is the year’s heaviest storage cycle and it reaches the boot path, so test on hardware you can recover.

  • Copy large file sets to and from NTFS volumes, exercising extended attributes, hard links and junctions, then interrupt a copy and confirm the volume mounts intact and chkdsk runs clean.
  • Create a Storage Spaces pool, add and remove a disk, and confirm a mirrored space rebuilds and stays online across a restart.
  • Mount and detach VHD and VHDX files, including a differencing disk, and confirm an iSCSI target reconnects after a network interruption.
  • Run a full backup and a test restore, and confirm every shadow copy writer reports stable.

Networking, Server Roles, and Remote Desktop

DHCP Server takes 36 fixes, 12 of them remote code execution and 18 denial of service, which makes it the most exposed server role this month. DNS adds 18, RRAS eight, Remote Access Connection Manager seven, Services for NFS six and SSTP four. Remote Desktop takes 25 across the client, session host, gateway and licensing, 13 of them remote code execution.

  • On each DHCP server, lease, renew and release addresses on IPv4 and IPv6, exercising reservations, scope options and failover partners, then restart the service under load and confirm leases keep issuing.
  • Resolve internal and external names against a patched DNS server, transfer a zone, and confirm conditional forwarders and DNSSEC validation hold.
  • Establish client VPN connections over IKEv2 and SSTP, hold them through sleep and resume, and confirm RRAS routing and NAT still pass traffic.
  • Mount an NFS export from a Windows client, read and write to it, and confirm the portmapper and ONCRPC services restart cleanly.
  • Open several concurrent Remote Desktop sessions, enable printer, clipboard, audio, drive and smart card redirection together, and confirm none interferes with another.
  • Connect through a Remote Desktop Gateway, disconnect and reconnect, and confirm redirected devices reattach and the licensing server still issues in both Per User and Per Device modes.

Printing, Graphics, and Devices

Win32k takes 25 fixes, Microsoft Standard XPS 18, the print spooler and its HTTP provider 15, and the Windows Imaging Component eight, six of them critical. Devices are the group’s second half: nine fixes in the USB Audio Class driver, eight in the Windows Audio Service, six in Media Foundation and 14 across the USB, video, mass storage and hub drivers. These are elevation flaws in drivers that load whenever a device is attached, so test device handling, not content.

  • Print text-heavy, graphics-heavy and multi-page documents to physical and virtual (XPS and PDF) printers, repeating after each orientation, scaling and resolution change, and confirm the output matches the document on screen.
  • Share a printer from a print server, print from a separate client, cancel a job, and confirm the queue reflects every state change.
  • Open JPEG, TIFF, HEIF and raw images across Explorer, Photos and Office to exercise the imaging codecs, watching for clipping, distortion or missing glyphs.
  • Attach and remove USB audio, video and mass storage devices repeatedly, including through a hub, and confirm each enumerates and releases cleanly.
  • Play audio through USB, Bluetooth and built-in devices during a video call, switching the default output mid-call, then sleep and resume and confirm every device returns.

Office, SharePoint, and Skype for Business

This is the break from recent cycles. September’s Office wave is not MSI-only: roughly 105 CVEs reach Click-to-Run, so Microsoft 365 Apps, Office 2019, LTSC 2021 and LTSC 2024 all update, on Windows and Mac. Word takes 35 fixes, Excel 32, PowerPoint 10 and Outlook seven. SharePoint Server Subscription Edition takes 16 and is the only SharePoint baseline with a package. Skype for Business Server takes 10, one a critical remote code execution at CVSS 9.8.

  • On Click-to-Run estates, update the channel, then open complex Word documents and Excel workbooks carrying macros, external data, embedded objects and line-of-business add-ins.
  • On MSI Office 2016, apply the client updates: Word (KB5002923), Excel (KB5002914), PowerPoint (KB5002920), Outlook (KB5002919), Access (KB5002912, KB5002913), Publisher (KB5002644) and the suite rollups (KB5002904, KB5002916, KB5002898).
  • Patch SharePoint Server Subscription Edition (KB5002908) and Office Online Server (KB5002910), then check browser-based viewing and editing; these server updates cannot be uninstalled and always require a reboot.
  • Patch Skype for Business Server (KB5123301 for 2015 CU13, KB5123300 for 2019 CU8, KB5123287 for Subscription Edition CU1), then test sign-in, presence, instant messaging and a conference join.

Exchange, SQL Server, and Developer Tools

Exchange Server takes nine fixes across 2016 CU23, 2019 CU14 and CU15, and Subscription Edition, the highest at CVSS 9.3. SQL Server takes 63 across the 2017, 2019, 2022 and 2025 branches, with no 2016 package this month. Visual Studio Code draws 10, mostly security feature bypasses.

  • Apply the Exchange update from an elevated command prompt, then confirm every service returns, mail flows internally and externally, and Outlook, Outlook on the web and the admin centre sign in.
  • Install the SQL Server GDR or cumulative update on its matching branch, restart the service, run standard transactions with a backup and restore, and confirm Always On availability groups stay healthy.
  • Install the .NET runtime, SDK and Framework updates, then build and run a representative project to check for regressions.
  • Update Visual Studio Code and confirm workspace trust prompts, extension installation and remote sessions behave as configured.

September 2026 Patch Tuesday Testing Priorities

If you can’t test everything at once, this is the order that retires the most risk first.

  • Start with the two exploited flaws: patch, run a full Windows Update cycle end to end, and confirm crash reporting completes without an elevation prompt.
  • Take biometrics next, at 73 fixes with every Windows Hello entry critical, regressing enrolment, sign-in and PIN fallback on each device model.
  • Give storage a full pass across NTFS, Storage Spaces, VHD and iSCSI, on hardware you can recover.
  • Patch and exercise the DHCP and DNS servers, then RRAS, SSTP and NFS.
  • Work through printing and graphics, then the USB, audio and camera device paths.
  • Close out with Office, which is not MSI-only this month, then Exchange, SQL Server and the developer estate.

#patch-tuesday#testing-guidance#windows-11#windows-server