Week 37 sources
Microsoft published 12 Windows KB releases (12 security). MSRC published 975 new Microsoft CVEs, 113 critical, 2 already exploited in the wild. 38 roadmap changes, led by Microsoft 365 Copilot (8) and Teams (7). CISA added 2 Microsoft CVEs to its Known Exploited Vulnerabilities catalog. 57 lifecycle milestones fall in the next 30 days. 8 Azure updates, including 1 retirement. 44 Windows and security articles from Microsoft blogs.
Security to act on2
Windows releases12
- Windows 10, version 1607 — KB5123099 (B), build 14393.95128 Sep
- Windows 10, version 1809 — KB5122876 (B), build 17763.92458 Sep
- Windows 10, version 21H2 — KB5122878 (B), build 19044.77258 Sep
- Windows 10, version 22H2 — KB5122878 (B), build 19045.77258 Sep
- Windows 11, version 23H2 — KB5122880 (B), build 22631.75828 Sep
7 more
- Windows 11, version 24H2 — KB5124008 (B), build 26100.94458 Sep
- Windows 11, version 25H2 — KB5124008 (B), build 26200.94458 Sep
- Windows 11, version 26H1 — KB5124012 (B), build 28000.29548 Sep
- Windows Server 2016 — KB5123099 (B), build 14393.95128 Sep
- Windows Server 2019 — KB5122876 (B), build 17763.92458 Sep
- Windows Server 2022 — KB5122882 (B), build 20348.56228 Sep
- Windows Server 2025 — KB5122871 (B), build 26100.334388 Sep
MSRC security releases1
Windows and security news44
- CVE-2026-0295 GlobalProtect App: Local Privilege Escalation via Race Condition on macOS (Severity: MEDIUM)12 Sep
- CVE-2026-0296 GlobalProtect App: Improper Certificate Validation Bypass Vulnerability (Severity: MEDIUM)12 Sep
- CVE-2026-0297 GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake (Severity: MEDIUM)12 Sep
- CVE-2026-0298 GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP) (Severity: MEDIUM)12 Sep
- CVE-2026-0299 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM)12 Sep
39 more
- Announcing new builds for 11 September 202611 Sep
- 30-Day Reminder: Windows Server 2022 will reach end of mainstream support on October 13, 202611 Sep
- Protecting organizations from AI-assisted executive impersonation and invoice fraud10 Sep
- Announcing Windows 11 Release Preview Builds 26100.9539/26200.953910 Sep
- Windows Office Hours: September 17, 202610 Sep
- Detect and disrupt AI-themed attacks with Microsoft Defender10 Sep
- Edge 153.0.4234.32: Chromium security fixes10 Sep
- GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.810 Sep
- WAF - WAF Release - 2026-09-10 - Emergency10 Sep
- Threat matrix: Mapping threats across cloud web applications9 Sep
- IT resources to plan, prepare, and deploy Windows9 Sep
- CVE-2026-0302 Checkov by Prisma Cloud: OS Command Injection Vulnerability (Severity: LOW)9 Sep
- CVE-2026-0303 Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File (Severity: LOW)9 Sep
- CVE-2026-0304 Cortex XDR Broker VM: Privilege Escalation Vulnerability (Severity: MEDIUM)9 Sep
- CVE-2026-0305 Prisma Access Agent: Information Disclosure Vulnerability on Linux (Severity: MEDIUM)9 Sep
- CVE-2026-0306 Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows (Severity: MEDIUM)9 Sep
- CVE-2026-0308 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (Severity: LOW)9 Sep
- CVE-2026-0309 PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration (Severity: MEDIUM)9 Sep
- CVE-2026-0310 PAN-OS: Buffer Overflow Vulnerability via XML Processing (Severity: HIGH)9 Sep
- PAN-SA-2026-0012 Chromium: Monthly Vulnerability Update (September 2026) (Severity: HIGH)9 Sep
- Announcing new builds for 8 September 20268 Sep
- Listening to families. Improving Microsoft Family.8 Sep
- Helping families and educators support safer experiences and healthier habits on Windows8 Sep
- The September 2026 Windows security update is now available8 Sep
- FortiAnalyzer: Uncontrolled Resource Consumption in SNMP8 Sep
- FortiClient: Arbitrary process termination from exposed minifilter communication port8 Sep
- FortiManager: Workflow session email approval process bypass8 Sep
- FortiMonitorOnSight: JWT used for authentication in web GUI signed with static key8 Sep
- FortiOS: Null Pointer Dereference in Log Report8 Sep
- FortiOS: ZTNA Portal Improper Certificate Validation8 Sep
- FortiSandbox: Cron Job Injection in Remote Backup8 Sep
- FortiSandbox: Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information8 Sep
- FortiSOAR: Broken Access control on Websocket streams8 Sep
- Improper Authentication of FortiPAM Server8 Sep
- Open Redirect on FortiSIEM8 Sep
- WAF - WAF Release - 2026-09-088 Sep
- Securing Your Certification Authorities (Practical PKI Part 4)7 Sep
- WAF - Attack Signature Detection is now available in Early Access7 Sep
- WAF - Enforce positive security with Application Profiles7 Sep
Lifecycle milestones in the next 30 days57
- Retirement · 3 products: Azure Functions 1.0 Deprecation; Azure Monitor Data Collector API; Monitoring Support for AKS-Engine 14 Sep
- Retirement · 2 products: Activity logs legacy connector, storage integration API; Azure Maps Gen1 Price Tier 15 Sep
- Retirement: Azure Maps Render V1 17 Sep
- Retirement: Azure Maps Web SDK Map Controls Version 1.xx 19 Sep
- Retirement: SMART on FHIR Proxy in Azure Health Data Services 21 Sep
- Retirement · 11 products: Azure API for FHIR; Azure API for FHIR Gen 1 offering; Azure Container Registry ACR 2017-03-01-(GA) API; Azure FXT Edge Filer; Azure Maps Web SDK v2 Subversion (v2.0~v2.0.32) and Service Module Retirement; Azure Virtual Desktop (Classic); Container Log V1; Get AlertSummary API; Service Bus Control plane APIS v2014-09; v2015-08; v2016-07; Single URL Ping Test in Application Insights; Track 0 and 1 Service Bus SDKs and SBMP protocol 30 Sep
- Retirement · 5 products: Azure Anomaly Detector; Azure Metrics Advisor; Azure Personalizer; Personalizer; Translator Billing Model 1 Oct
- Retirement · 10 products: Access 2021; Excel 2021; Office 2021; OneNote 2021; Outlook 2021; PowerPoint 2021; Project 2021; Publisher 2021; Visio 2021; Word 2021 13 Oct
- End of support · 16 products: Access LTSC 2021; Excel LTSC 2021; Office LTSC 2021; Office LTSC 2021 for Mac; OneNote LTSC 2021; Outlook LTSC 2021; PowerPoint LTSC 2021; Project 2021 (LTSC); Publisher LTSC 2021; Skype for Business LTSC 2021; Visio LTSC 2021; Windows 10 2016 LTSB; Windows 10 IoT Enterprise LTSB 2016; Windows Server 2012 R2, Extended Security Update Year 3; Windows Server 2012, Extended Security Update Year 3; Word LTSC 2021 13 Oct
- End of servicing · 2 products: Dynamics 365 Business Central on-premises (Modern Policy), 2025 release wave 1, version 26.x; Windows 11 Home and Pro, Version 24H2 13 Oct
- Moves to extended support · 5 products: Office LTSC 2021 for Mac; Windows Server 2022; Windows Server 2022 Datacenter: Azure Edition; Windows Server 2022 Standard (MSL); Windows Server IoT 2022 13 Oct
Product news141
- Cognition helps Devin test its own work with GPT‑6 Astra11 Sep
- Rapidly scaling online storage to serve over 1 billion ChatGPT users11 Sep
- How a researcher uses Codex and ChatGPT to search for new antimicrobial molecules10 Sep
22 more
- Now everyone can put data to work10 Sep
- Expanding AI access and cyber defense for federal, state, local, and tribal governments10 Sep
- Introducing ChatGPT for Financial Services10 Sep
- Build more natural voice experiences with GPT‑Live‑1 in the API10 Sep
- GPT-Live 1 is now generally available in the API.10 Sep
- Introducing the Agents API10 Sep
- Released the Agents API in public beta.10 Sep
- You can now set expiration dates when creating project API keys.10 Sep
- Paul Christiano joins OpenAI Foundation Board9 Sep
- The AI policy window is open. We need to act.9 Sep
- GPT-6 Astra: The next generation in intelligence for work9 Sep
- How GPT-5.6 Sol helps run quantum computing experiments8 Sep
- The Work Now Within Reach8 Sep
- Introducing ChatGPT Images 2.58 Sep
- OpenAI expands initiatives to support journalism from classrooms to newsrooms8 Sep
- On the Navier–Stokes Millennium Prize Problem8 Sep
- Funding grants for new research into AI and teen development8 Sep
- 1Password increases engineering productivity 21% with Codex8 Sep
- GPT-Rosalind (gpt-rosalind-research) is now generally available through the trusted-access program for approved internal life sciences research.8 Sep
- Prompt Cache Diagnostics is now generally available in the Responses API for GPT-5.6 and later supported models.8 Sep
- Released GPT Image 2.5 Sunburst and GPT Image 2.5 Flare for image generation and editing through the Image API and the Responses API image generation tool.8 Sep
- Supporting independent journalism in Ukraine7 Sep
- Use C# unions and closed hierarchies in ASP.NET Core10 Sep
- Announcing .NET 11 Release Candidate 18 Sep
- .NET Conf 2026 Community Days Call for Presenters Is Open8 Sep
20 more
- September 8, 2026-KB5126043 Cumulative Update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server 20198 Sep
- September 8, 2026-KB5126046 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10 Version 21H2 and Windows 10 Version 22H28 Sep
- September 8, 2026-KB5126047 Cumulative Update for .NET Framework 4.8 for Windows 10, version 1607 and Windows Server 20168 Sep
- September 8, 2026-KB5126048 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, version 1809 and Windows Server 20198 Sep
- September 8, 2026-KB5126050 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows Server 20228 Sep
- September 8, 2026-KB5126052 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 24H2, Windows 11, version 25H2 and Microsoft server operating system 24H28 Sep
- September 8, 2026-KB5126053 Cumulative Update for .NET Framework 4.8.1 for Windows 11, version 26H18 Sep
- September 8, 2026-KB5126144 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10, version 1809 and Windows Server 20198 Sep
- September 8, 2026-KB5126145 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 21H28 Sep
- September 8, 2026-KB5126146 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 22H28 Sep
- September 8, 2026-KB5126149 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows Server 20228 Sep
- September 8, 2026-KB5126421 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 10 Version 21H2 and Windows 10 Version 22H28 Sep
- September 8, 2026-KB5126422 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows Server 20228 Sep
- September 8, 2026-KB5126424 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 23H28 Sep
- September 8, 2026-Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012 (KB5120716)8 Sep
- September 8, 2026-Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012 R2 (KB5120695)8 Sep
- September 8, 2026-Security and Quality Rollup for .NET Framework 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows Server 2012 (KB5126044)8 Sep
- September 8, 2026-Security and Quality Rollup for .NET Framework 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows Server 2012 R2 (KB5126045)8 Sep
- September 8, 2026-Security and Quality Rollup for .NET Framework 4.8 for Windows Server 2012 (KB5126049)8 Sep
- September 8, 2026-Security and Quality Rollup for .NET Framework 4.8 for Windows Server 2012 R2 (KB5126051)8 Sep
- JAMF Pro - Standard: 11.32 Upgrade for us-west-212 Sep
- JAMF Pro - Standard: 11.32 Upgrade for us-east-212 Sep
- JAMF Pro - Standard: 11.32 Upgrade for eu-central-112 Sep
16 more
- JAMF Pro - HCC: 11.32 Upgrade for us-east-212 Sep
- JAMF Pro - StateRAMP: 11.32 Upgrade for us-east-112 Sep
- JAMF Pro - Azure: 11.32 Upgrade for central-us12 Sep
- JAMF Pro - Standard: 11.32 Upgrade for eu-west-212 Sep
- JAMF Pro - Standard: 11.32 Upgrade for germany-westcentral12 Sep
- JAMF Pro - Standard: 11.32 Upgrade for ap-northeast-111 Sep
- JAMF Pro - Standard: 11.32 Upgrade for ap-southeast-211 Sep
- Continued Maintenance for Jamf Account and Jamf ID11 Sep
- Scheduled Maintenance for Jamf Account and Jamf ID11 Sep
- Jamf Security Cloud - Delay in Data Policy Change Propagation11 Sep
- Jamf Security Cloud (ZTNA): IPSec infrastructure upgrade for us-west-211 Sep
- The IT guide to supporting K-12 numeracy10 Sep
- Content Filtering Not Working10 Sep
- Manage your Apple fleet as code with Jamf and Terraform9 Sep
- Failure in a shared authentication component caused configuration profile delivery and MDM device communication to return errors for managed Apple devices in the US and EU9 Sep
- Jamf recognized in Endpoint Management Tools Voice of the Customer: Gartner Peer Insights™ Customers’ Choice 20268 Sep
- Security (beta): Added the privacyDataMatch member to the classificationMethod enumeration for the sensitiveType resource to support privacy data matching b… (+2 more)11 Sep
- Backup and recovery (beta): Added support for $filter on the protectionUnit/policyId property to the list restorePoints method.11 Sep
- Backup and recovery (beta): Added the policyId property to the restoreSessionBase resource. (+1 more)11 Sep
12 more
- Files (beta): Added the userObjectId parameter to the getByUser method on the fileStorageContainer resource.10 Sep
- Calendar (beta): Added the stringDictionary resource. (+3 more)10 Sep
- Reports (beta): Added the aggregatedUsage relationship to the billing resource. (+4 more)10 Sep
- Change notifications (v1.0): Added the unknownFutureValue member to the changeType enumeration in v1.0, previously available in beta, used by the changeNotification and…9 Sep
- Security (beta): Added the chunkOffsets complex type. (+1 more)9 Sep
- Security (beta): Added the incidentConfiguration property to the detectionAction resource. (+1 more)9 Sep
- Security (beta): Added the slaPolicies property to the case resource to expose a read-only collection of caseSlaPolicyEntry objects reporting the status and… (+2 more)9 Sep
- People and workplace intelligence (beta): Added the sensitivityLabel property to the searchHit resource.9 Sep
- Identity and access (v1.0): Added the accessReviewInstanceDecisionItemPermission complex type to represent the permission that grants a principal access to the resourc… (+5 more)9 Sep
- Device and app management (beta): Added the deviceCloudLicensing resource type. (+7 more)8 Sep
- Security (beta): Added the contentFiltering member to the userActivityTypes enumeration.8 Sep
- Identity and access (beta): Added the anonymousCalendarSharingFreeBusyDetail resource. (+2 more)8 Sep
- Microsoft JDBC Driver 13.6 for SQL Server is now available11 Sep
- mssql-python 1.15.0: Faster, More Reliable, and Built for Your Applications11 Sep
- Microsoft ODBC Driver 18.7.1: smaller vectors, easier configuration, and better cloud routing10 Sep
10 more
- Security Update for SQL Server 2025 RTM CU89 Sep
- Security Update for SQL Server 2025 RTM9 Sep
- Security Update for SQL Server 2022 RTM CU269 Sep
- Security Update for SQL Server 2022 RTM9 Sep
- Security Update for SQL Server 2019 RTM CU329 Sep
- Security Update for SQL Server 2019 RTM9 Sep
- Security Update for SQL Server 2017 RTM CU319 Sep
- Security Update for SQL Server 2017 RTM9 Sep
- Linked server queries that use MSDASQL fail with error 74168 Sep
- Linked server queries that use MSDASQL fail with error 74168 Sep
- Released: August 2026 Exchange Server Security Updates8 Sep
- Exchange Server AD FS Modern Authentication: Expanded Outlook client support8 Sep
- Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only8 Sep
2 more
- Admin Insights for Windows 365 is generally available7 Sep
- Cloud PC recovery is now available for Windows 365 Government7 Sep
- Display Protection for Windows 365 (Public Preview)7 Sep
- Claude Managed Agents permission policies now include auto: the server evaluates each agent or MCP tool call and runs it, denies it, or pauses for your approval.10 Sep
- Version 1.32.0 of the ant CLI adds ant beta:sessions connect, which attaches your terminal to a Claude Managed Agents session.10 Sep
- For cache diagnostics, the API now stores a request's fingerprint only when the request includes the diagnostics object.9 Sep
- New incentives for Microsoft Copilot Cowork adoption10 Sep
- Join Partnering for Success Together9 Sep
- ASPX updates to uncover opportunities8 Sep
- v7.4.20 Release of PowerShell8 Sep
- v7.6.6 Release of PowerShell8 Sep
- v7.5.11 Release of PowerShell8 Sep
- UniFi Network Application 10.6.10610 Sep
- UniFi OS - Dream Machines 5.1.339 Sep
- UniFi Network Application 9.0.1208 Sep
- Workload Orchestration in the Azure portal is now available: Deploy in minutes, scale with ease10 Sep
- Announcing the public preview of Azure Local workload management in Azure Arc Site Manager10 Sep
- Defender for Endpoint Android 1.0.9309.010211 Sep
- Defender for Endpoint iOS 1.1.80270104 (release notes mention Global Secure Access)7 Sep
- Accelerate your move to agentic business applications with Dynamics 365 Activate9 Sep
- Dynamics 365 Activate now in limited public preview9 Sep
- The Gemini app is now available for Windows10 Sep
- 4 ways Gemini makes administrative chores quick and easy9 Sep
- Lineage-aware AI with the Fabric item relations API (Preview)10 Sep
- Accelerate JSON workloads with the Native Execution Engine in Microsoft Fabric10 Sep
- Enhanced Data Model Migration Utility Now Generally Available, with Dynamics 365 Portal Templates Support7 Sep
- Enhanced Data Model Migration Utility Now Generally Available, with Dynamics 365 Portal Templates Support7 Sep
- PSWriteOffice 3.0.712 Sep
- PSWriteOffice 3.0.69 Sep
- Linux: ProcDump, Procmon, Sysmon; PipeList, ProcExp, ProcMon, PsTools, Sigcheck, Sysmon, and ZoomIt10 Sep
- CSP price list republish: Windows 10 Enterprise LTSC 2021 Extended Security Updates8 Sep
- Release 2026-09-049 Sep
- Mailozaurr 3.0.19 Sep
- Pester 6.2.09 Sep
Azure updates8
- Retirement: Azure Linux with OS Guard in Azure Kubernetes Service11 Sep
- [In preview] Public Preview: Agentless migration of on-premises SMB file shares to Azure Files (SMB)11 Sep
- [Launched] Generally Available: TLS/SSL certificate and end-to-end TLS encryption support for Azure Functions Flex Consumption10 Sep
- [Launched] Generally Available: Azure Copilot Troubleshooting Agent10 Sep
- [Launched] Generally Available: User-bound user delegation SAS for Azure Storage9 Sep
From the community16
- Using Patch My PC Win32 Apps with Autopilot12 Sep
- BGP.Exchange Website Compromised (Sept. 12, 2026)12 Sep
- Defender is On. Intune Says Noncompliant12 Sep
- Windows: Remote Desktop Services (RDS) Issues caused by September 2026 Updates Confirmed12 Sep
- PSA: Exchange Online stops honoring Sharing policies11 Sep
11 more
- Intune Newsletter – 11th September 202611 Sep
- Why Some DLP Policies Need Days to Start Working11 Sep
- Workplace Ninjas Summit 2026 Recap10 Sep
- Calculating in PowerShell10 Sep
- Microsoft Office: September 8, 2026 Update causes (Excel) copy & paste issue10 Sep
- Microsoft Bumps Auto-Expanding Archive Limit Past 1.5 TB10 Sep
- Microsoft Defender XDR Attack Disruption: Automatic Device Isolation Explained9 Sep
- Why Microsoft Graph Does Not Support Group Mailboxes9 Sep
- Entra ID Continuous Access Evaluation and Microsoft 3658 Sep
- Using multiple managed accounts with app protection policies7 Sep
- Outlook Classic Stamps Its Style on the New Outlook7 Sep
Microsoft 365 roadmap38
- Microsoft Copilot (Microsoft 365): Insights: Copilot Analytics - Cowork adoption and impact11 Sep
- OneNote: Suggested Artifact Creation in Copilot Notebooks11 Sep
- Word: Copilot edit mode is available to users in Office 365 GCC11 Sep
5 more
- Microsoft Copilot (Microsoft 365): New Rich Answer Cards10 Sep
- Planner: Planner Agent chat in Basic Plans9 Sep
- Microsoft Copilot (Microsoft 365): Enhanced personalization with memory in Copilot9 Sep
- Microsoft Clipchamp: Upgraded music selection for Copilot AI Videos8 Sep
- Microsoft Copilot (Microsoft 365): AI Generated video drafts include text animations and new layout options8 Sep
- Microsoft Teams: Coordinated meetings support on Teams Rooms on Android11 Sep
- Microsoft Teams: Teams events attendance and engagement report policy11 Sep
- Microsoft Teams: Clearer text highlighting in dark mode and high contrast mode10 Sep
4 more
- Microsoft Purview: Endpoint Data Loss Prevention-Archive File Classification Behavior Change for Windows Endpoints10 Sep
- Data Loss Prevention- DLP Policy Change Insights with Security Copilot9 Sep
- Microsoft Purview compliance portal: Data Lifecycle Management - Apply a retention policy to Microsoft Planner content9 Sep
2 more
- Outlook: Co-Authoring Highlight and Rewrite11 Sep
- Outlook: Inline chat for email drafting9 Sep
- Outlook: Categorize Emails by Dragging Them onto a Favorite Category8 Sep
9 more products · 15 changes
- Planner: My Tasks redesign9 Sep
- Planner: Add times to task start, finish, and due dates8 Sep
- Planner: Task History8 Sep
- Microsoft Viva: Copilot Enhanced Topic Assignment10 Sep
- Microsoft Viva: Viva Glint - Topic Assignments Included in Comment Report Export9 Sep
- Microsoft Viva: Copilot Analytics - Export metrics in the Copilot Dashboard at Day Level8 Sep
- Microsoft 365: [Education] Control access to Learning Activities and Teach11 Sep
- Microsoft 365: Teams Channel Backup8 Sep
- OneDrive: Document library views now available in OneDrive11 Sep
- OneDrive: Refreshed Libraries View in OneDrive Web11 Sep
Every line opens its detail page or the original Microsoft source. This briefing uses public sources only and says nothing about your tenant or devices.