September 2026 Patch Tuesday: update your Windows PC at home

If you have a Windows PC at home, install this month’s updates today. Do not wait for the weekend reminder you will ignore.

Microsoft released the September 2026 security updates on September 8, 2026. Security vendors described the release as a record volume month, with about 972 CVEs in their tallies (CrowdStrike’s September 2026 Patch Tuesday analysis, secondary analysis). You do not need to read every CVE ID. You need your PC current, rebooted, and finished installing.

Two bugs matter most for a home PC because Microsoft says both are already exploited in the wild. Both are local elevation-of-privilege issues: an attacker who already has a foothold on your machine can use them to gain more power. That is exactly the kind of bug malware loves after a bad download, a browser exploit, or a shady attachment.

The two zero-days that matter at home

CVE-2026-81963: Windows Update Stack

Microsoft’s advisory for CVE-2026-81963 lists:

Impact: Elevation of Privilege
Max severity: Important
Attack vector: Local
Exploited: Yes (Exploitation Detected)
Released: September 8, 2026

The short version: a link-following flaw in the Windows Update Stack lets a local attacker raise privileges. Microsoft says a successful exploit can reach SYSTEM. No extra click from you is required once malware is already running under a normal user account.

CVE-2026-85880: Windows ALPC

Microsoft’s advisory for CVE-2026-85880 lists:

Impact: Elevation of Privilege
Max severity: Important
Attack vector: Local
Exploited: Yes (Exploitation Detected)
Released: September 8, 2026

This one hits Windows Advanced Local Procedure Call (ALPC), a built-in Windows communication path. Microsoft says a successful exploit can also reach SYSTEM, including from a low-privilege AppContainer sandbox. Again: local, no additional user interaction once code is already running.

Neither bug is “someone hacks you from the internet with one packet.” Both are post-compromise escalators. That is still urgent. Home PCs get footholds every day from phishing, drive-by sites, and cracked installers. Patching closes the easy “now I own the whole PC” step.

Office and Outlook: do not casually preview weird mail

This month also includes remote code execution issues that can fire through Outlook Reading Pane or Explorer Preview Pane. Secondary analysis from CrowdStrike notes a dozen Critical Office-family flaws that are exploitable via Preview Pane or Reading Pane, meaning a crafted file can run code when you merely preview it, without opening the attachment or enabling macros.

Practical habit until you are patched (and honestly, after as well):

Do not click “preview” on unexpected Office files from strangers.
Be suspicious of weird email with Word, Excel, PowerPoint, or RTF attachments you did not ask for.
If Outlook or File Explorer previews documents automatically, treat unknown mail as hostile until you know it is legit.
Updating Windows and Microsoft Office / Microsoft 365 apps covers the fixed Preview Pane and Reading Pane bugs. Checking Windows Update alone does not always update every Office channel the same way, so open Office apps and let them update too if they offer it.

You do not need a deep dive into every Office CVE number. You need to stop treating the preview pane like a safe peek.

Do this on your home PC

Open Settings → Windows Update.
Click Check for updates.
Install everything offered, including any restart-required quality updates.
Restart when Windows asks. Leaving the reboot for “later” leaves the old code running.
Open Windows Update again after reboot and confirm there are no pending required updates.
If you use Microsoft 365 or desktop Office, open an Office app, check for Office updates, and finish those too.
Repeat on every Windows computer you use at home (desktop, laptop, the kid’s machine, the shared living-room PC).

That is the whole job. No special tool required.

Confirm you are current

After reboot, Windows Update should show you are up to date, or only optional items left. If it still lists important quality updates, you are not done.

If updates fail repeatedly, note the error code Windows shows, free some disk space, and try again. A stuck Update Stack is not a reason to give up in a month with Update Stack and ALPC zero-days already exploited.

What you can skip reading

Longer write-ups this month dig into Netlogon, DNS, DHCP, Kerberos, and other server-only pieces. Those are not why your home PC should update today. Your action list is still: check for updates, install, reboot, confirm.

Bottom line

September 8, 2026 delivered a huge Patch Tuesday, including two local privilege-escalation zero-days Microsoft says are exploited in the wild (CVE-2026-81963 and CVE-2026-85880), plus Office Preview Pane / Reading Pane RCE risk. On your Windows PC at home: Settings → Windows Update → Check for updates, install, reboot, and confirm you are current. Do not casually preview weird email attachments while you are behind.

Image: Windows logo on Microsoft blue background (Windows branding).