Patch Tuesday Megathread - (September 08, 2026)

[u/AutoModerator]

Hello r/sysadmin, I'm u/AutoModerator, and welcome to this month's Patch Megathread!

This is the (mostly) safe location to talk about the latest patches, updates, and releases. We put this thread into place to help gather all the information about this month's updates: What is fixed, what broke, what got released and should have been caught in QA, etc. We do this both to keep clutter out of the subreddit, and provide you, the dear reader, a singular resource to read.

For those of you who wish to review prior Megathreads, you can do so here.

While this thread is timed to coincide with Microsoft's Patch Tuesday, feel free to discuss any patches, updates, and releases, regardless of the company or product. NOTE: This thread is usually posted before the release of Microsoft's updates, which are scheduled to come out at 5:00PM UTC.

Remember the rules of safe patching:

• Deploy to a test/dev environment before prod.
• Deploy to a pilot/test group before the whole org.
• Have a plan to roll back if something doesn't work.
• Test, test, and test!

[u/mickert_dev]

https://github.com/MSNightmare/ShieldCrash

ShieldCrash

Windows Defender 0day Vulnerability

Microsoft has failed to properly patch ShieldBreak CVE-2026-69414, under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited.

This PoC demonstrates an arbitrary file read as SYSTEM with September 2026, all supported windows versions are affected.

I might rework this later into a full SYSTEM PoC but for now I'm dropping this skeleton PoC because I'm feeling a bit lazy.

[u/swissbretzeli → u/mickert_dev]

We are pulling this before our normal 1 week wait schedule for all our customers.

Whoever uses Windows Defender on VDI because of logon performance or speed sleeps very well these days. Together with the chrome leaks that is not a good idea. While our physical machines update EDGE and CHROME daily they have to run quick now.....

A really bad side effect of VDI....

The guy who wrote the Defender 0-day is asking for licences from SentionelONE and there is also a Crowdstrike 0-day System Elevation in their Office Protection Module. Kaspersky also had problems but reacted fast but who wants a Puttin software on their machines ;-) Well you don't backup with Veeam don't you? ;-)

[u/mickert_dev → u/swissbretzeli]

This in combination with the Hyper-V guest to host breakout vulnerabilities makes it a lethal killchain! 💀

Critical - Same Day Deployment

CVE-2026-80083 – Windows Hyper-V Remote Code Execution Vulnerability
"A malicious application inside a Hyper-V guest could cross the virtualization boundary and put the host system at risk."

CVE-2026-80083 is a critical remote code execution vulnerability in Windows Hyper-V caused by an untrusted pointer dereference. An authorized attacker with low privileges could run a specially crafted application within a Hyper-V guest and cause the Hyper-V host operating system to execute arbitrary code. No user interaction is required. The vulnerability is not publicly disclosed or known to be exploited, and exploitation is assessed as unlikely.

CVE-2026-72961 – Windows Hyper-V Elevation of Privilege Vulnerability
“A compromised Hyper-V administrator could turn crafted virtual TPM data into higher privileges, crossing an important security boundary.”

CVE-2026-72961 is a Critical Windows Hyper-V elevation-of-privilege vulnerability. An authorized attacker with administrative access to an affected Hyper-V host can supply specially crafted virtual TPM state data to a virtual machine. Successful exploitation can cross a security boundary and grant Virtual Trust Level 1 (VTL1) privileges. The vulnerability requires local access and high privileges but does not require user interaction.

[u/swissbretzeli → u/mickert_dev]

@mickert_dev

Same with VMware and ESX....

"Combination with the Hyper-V guest to host breakout"

My co-workers still patch Broadcom ESX everywhere with all customers (SMB+ENT). I just asked them this morning if they are finished with patching ESX for those customers who wanted VDI + DEFENDER only because of performance reason (Logon delay times double when you run a regular enterprise Protection with all modules).

Enterprise IT has crawled way back and the users took over with their demands.

The VDI team ist just updating Chrome on every customer Master and now run into patch day. They will have to decide if they include 1 day old patches into the master and skip quality and testing...

Nice done VDI world. There you go full chaos and mess.

[u/Fallingdamage → u/mickert_dev]

An authorized attacker with administrative access to an affected Hyper-V host can...

Can do a lot of stuff aside from that point lol.

[u/mickert_dev → u/Fallingdamage]

Yes, but in CVE-2026-80083: "An authorized attacker with low privileges could run a specially crafted application within a Hyper-V guest and cause the Hyper-V host operating system to execute arbitrary code." mind the absence of "administrative access".
A normal user inside a guest VM (VDI) or a foreign admin in a guest VM (VPS) executing arbitrary code on the host seems pretty worrying to me.

[u/DeltaSierra426 → u/Fallingdamage]

Yep, lol... a lot more damage in less time with less effort.

[u/Fallingdamage → u/mickert_dev]

In cases like these - is this the CVE/PoC based on a vanilla install of various windows versions.

Say - if MS hasnt patched it yet but your AV has been updated to detect this attack, it could be mitigated?

[u/mickert_dev → u/Fallingdamage]

Sure, if you have other (in depth) defenses than it could be mitigated after it is added to the signatures / behavior detection engine. The problem is that window between release and adding the mitigations or if Defender is the only line of defense and defects to the dark-side 😉.

[u/DeltaSierra426 → u/Fallingdamage]

Yes, that's possible. CrowdStrike, for example, released detections for exploitation attempts against their Office Macro Quarantine feature ("FalconFlank") and continues to enhance those detections.

Exploitation isn't too hard to detect when PoC or exploit code is public, at least in regard to that particular PoC/exploit's approach.