Microsoft's September 2026 Patch Tuesday: A Record 974 Flaws, Two Exploited Zero-Days

Microsoft's biggest security update yet touches nearly every corner of Windows — but only two of the 974 fixes are confirmed under active attack.

What happened

Microsoft's September 2026 Patch Tuesday broke its own record. The company addressed 974 vulnerabilities across its product line, and two of them are already being used in real attacks.[1]

That's not a typo. Nearly a thousand fixes in one month. To put it in context: 723 of those flaws are in Windows itself, with another 111 in Office, 62 in SQL Server, and 22 in developer tools.[1] Add 25 non-Microsoft CVEs Microsoft also patched as part of the release, and the combined total for the month reaches 999.[1]

Three vulnerability types — privilege escalation, remote code execution, and information disclosure — account for nearly 90% of everything patched this round.[1] More than 110 of the flaws carry a critical severity rating.[1]

The two zero-days under active exploitation

Out of that huge batch, Microsoft says exactly two vulnerabilities have been observed being exploited in the wild before a patch was available — meaning both meet the bar for a genuine zero-day.

• CVE-2026-85880 (CVSS 7.8) — a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) that lets an already-authorized local attacker elevate privileges and gain SYSTEM access.[1]
• CVE-2026-81963 (CVSS 7.8) — an improper link resolution flaw in the Windows Update Stack, also allowing local privilege escalation to SYSTEM.[1]

Neither is remotely exploitable on its own. Both require an attacker to already have some form of code execution on the target machine — these are the kind of bugs that turn a foothold into full control, not the kind that get you in the door in the first place. Microsoft's own advisory language for CVE-2026-85880 is specific about the mechanism: an attacker running code in a low-privilege AppContainer could exploit the flaw locally to escape the sandbox, with no additional user interaction needed.[1]

For CVE-2026-81963, Rapid7's Adam Barnett offered a plausible read on what the fix actually does: it tightens controls to stop the Windows Update Stack from following a malicious link and overwriting a system component with something attacker-controlled.[1] That's a reasonable technical inference from someone who reviewed the patch, not a confirmed root-cause statement from Microsoft itself — worth keeping that distinction in mind.

Credit for finding these goes to Volexity and Proofpoint for CVE-2026-85880, and to independent researcher Romain Deperne along with Microsoft's own Threat Intelligence Center for CVE-2026-81963.[1] Microsoft has confirmed it detected exploitation attempts against both flaws but hasn't disclosed who's behind them, how widespread the activity is, or whether any attacks actually succeeded.[1] That's an important gap — "exploitation detected" is not the same claim as "attacker successfully compromised a system," and the available reporting doesn't establish the latter.

Severity in context

Here's something that might surprise people skimming headlines: the two exploited bugs are not the most severe vulnerabilities in this batch. Both sit at 7.8 on the CVSS v3.1 scale — "high," not the top "critical" band. Several of the unexploited flaws patched this month score considerably higher, including a 9.8-rated use-after-free in Windows Remote Desktop Services and a 9.8-rated flaw in the Windows DNS server, both remotely exploitable without authentication.[1]

That gap between "highest score" and "actually being exploited" is exactly why security teams shouldn't triage purely by CVSS number. A 9.8 with no known exploitation might reasonably wait a few days; a 7.8 already under attack shouldn't. Some of the other notable fixes this month, none of which are reported as exploited, include:

• CVE-2026-55007 (8.1) — a double-free in Microsoft Exchange Server allowing unauthorized remote code execution[1]
• CVE-2026-80097 (8.6) — improper authentication in Microsoft Authenticator[1]
• CVE-2026-69465 (8.8) — missing authorization in SharePoint allowing remote code execution[1]
• CVE-2026-65669 (9.6) — an injection flaw in SQL Server[1]
• CVE-2026-69525, CVE-2026-69595, CVE-2026-69730, CVE-2026-69829, CVE-2026-72979 (all 9.8) — use-after-free and buffer-overflow RCE flaws spanning RDS, NFS, DNS, Shell, and DHCP Server[1]

CISA KEV status

According to Hacker News's reporting, CISA added both exploited CVEs to its Known Exploited Vulnerabilities catalog, with a remediation deadline of September 22, 2026, for federal civilian agencies.[1] I want to be transparent about a limit in this research: I was not able to independently open the CISA KEV alert page during this write-up, so this detail is reported as Hacker News's account of CISA's action rather than something I confirmed firsthand against CISA's own catalog. If you're making a compliance decision based on KEV status, check CISA's KEV catalog directly rather than relying on this article alone.

Why this keeps happening

This isn't a one-month blip. Microsoft patched 457 vulnerabilities in August, 663 in July, 220 in June, and 161 in May — the trend line has been climbing all year.[1] Tenable's Satnam Narang noted the September total represents roughly a 70% jump over the previous monthly record of 569 flaws set in July, pushing 2026's cumulative total past 2,600 — already more than double 2020's previous record-setting year of 1,245.[1]

Part of the explanation, according to the Zero Day Initiative, is that AI-assisted vulnerability discovery is accelerating faster than anyone patches.[1] More researchers, and increasingly more automated tooling, are finding bugs that would have gone unnoticed a few years ago. Tyler Reguly of Fortra offered a useful reframe: large CVE counts aren't necessarily a sign vendors are getting worse — they can mean the opposite, that long-standing bugs are finally getting found and fixed before attackers stumble onto them first.[1] It's a fair point, though it's also fair to note that "we're finding more bugs" and "the number of newly exploited zero-days is falling" aren't the same claim, and this month's data doesn't establish the second one either way.

What defenders should actually do

With nearly a thousand CVEs in one release, treating every line item as equally urgent isn't realistic. Tenable's Narang put it plainly: understand which vulnerabilities actually apply to your environment, whether they're reachable from the internet, and prioritize from there.[1] Action1's Jack Bicer made a similar point — the challenge at this scale isn't getting through the list, it's knowing what needs attention first.[1]

In practice, that means: patch CVE-2026-85880 and CVE-2026-81963 first, since they're confirmed exploited and on federal agencies' KEV deadline. Prioritize the unauthenticated, remotely exploitable RCE flaws next — the DNS server, RDS, and NFS driver bugs are the kind that matter most on internet-facing or high-value internal systems. Everything else can follow your normal patch cycle unless a specific system's exposure says otherwise.

Security takeaway

The headline number is dramatic, but the actual near-term risk picture is narrower than "974 flaws" makes it sound. Two confirmed exploited bugs, both requiring local access rather than a remote foothold, is a meaningfully different threat than a wave of remote zero-days would be. That doesn't mean the other 972 fixes don't matter — several of them are more severe on paper — it means the exploitation evidence, not the raw count, should drive what gets patched this week versus this quarter.

Sources & References

1. [1] The Hacker News — "Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days" — Sep 09, 2026 — View source

Note: This article relies on a single directly-opened primary report (The Hacker News, which itself links to and quotes Microsoft's MSRC advisories, CISA's KEV catalog, and named researchers at Rapid7, Tenable, Action1, and Fortra). I was unable to independently open the underlying MSRC and CISA pages in this session. Readers making patching or compliance decisions should verify CVE and KEV details directly against Microsoft's Security Update Guide and CISA's KEV catalog.