Microsoft Patches 974 Flaws and Two Exploited Windows Zero-Days

A record month with two bugs already under attack

On September 8, 2026, Microsoft released the largest Patch Tuesday it had ever shipped up to that point. The update covered 974 vulnerabilities across its software, and the company said two of them had already been exploited in the wild before a fix existed.12 The patches reached Windows, Office, SQL Server and developer tools. More than 110 of the flaws were rated critical, and most fell into three groups: privilege escalation, remote code execution and information disclosure.8

The two zero-days have similar profiles. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the channel Windows components use to talk to each other. CVE-2026-81963 is an improper link resolution flaw, also called "link following," in the Windows Update Stack, the code that installs updates.13 Both are rated 7.8 on the CVSS scale. In both cases, an attacker who already has some access to a machine can raise their privileges to SYSTEM, the highest level of control in Windows.14

Microsoft confirmed that both flaws were being exploited but gave almost no other detail. It did not say who was behind the attacks, how widespread they were, or whether any victims had actually been breached.1 That silence matters for anyone treating this as data breach news. So far there is no public link between these zero-days and a named intrusion or a confirmed theft of data.

How the two zero-days work

Microsoft's advisory gives the most detail on the ALPC flaw. An attacker who can run code inside a low-privilege AppContainer, a sandbox Windows uses to fence off untrusted processes, can use the overflow to escape the sandbox and reach SYSTEM without any further action from the user.610 That makes the bug a natural second stage. An attacker who gets code running through a browser or document exploit could use it to break out of containment.

The Update Stack bug works differently. Adam Barnett of Rapid7 said the patch most likely stops the update component from following a malicious link and overwriting a system file with one the attacker controls.58 Turning the update mechanism against the machine it protects is a hard problem for defenders, because update software normally runs with elevated rights and is trusted.

Tenable's Satnam Narang put both bugs in historical context. Seven privilege escalation flaws have been found in the Windows Update Stack since 2022, and CVE-2026-81963 is the first of them to be exploited as a zero-day.12 Microsoft had not patched any ALPC flaw since April 2023. CVE-2026-85880 is only the second ALPC zero-day, after CVE-2023-21674 in January 2023.210 Taken together, attackers appear to be finding new routes into parts of Windows that have rarely been weaponized.

Where the coverage disagrees

The broad story is consistent across outlets, but several details are not. The first is the total count. SecurityWeek and CyberScoop reported 974 CVEs, while BleepingComputer reported 966. The gap comes from how each outlet counted bundled Edge, Azure and Mariner advisories.3 Some industry tallies reached 995 once non-Microsoft CVEs were added.8 Action1 later called September's record 995.20 Vicarius, writing a month later, gave 964.18 None of this changes the scale of the release, but readers should expect the number to shift depending on the source.

Outlets also differ on who found the bugs. One report credits Volexity and Proofpoint with reporting the ALPC flaw. It says the Update Stack bug was credited jointly to the Microsoft Threat Intelligence Center (MSTIC) and Romain Deperne, a researcher at Airbus Helicopters.5 Another report lists only Proofpoint for ALPC and only MSTIC for the Update Stack. It also splits the affected platforms: Windows 11 and Windows Server 2025 for one flaw, Windows 10 and older Server releases for the other.4 The credits are worth noting because Volexity and Proofpoint both do threat-intelligence work. Their involvement suggests the ALPC exploit was seen during real attack investigations rather than found in a lab, though neither company has published findings tying it to a specific campaign.

The last disagreement is the most important. One vendor analysis describes a full attack chain in which the two zero-days give attackers initial access, followed by lateral movement through cloud environments, data theft and possibly ransomware.7 That account goes beyond what Microsoft has disclosed. Both bugs are local privilege escalations. An attacker must already be on the machine to use them, so they are not an entry point.3 The more defensible view is that they are tools for the middle of an intrusion. They can turn a phishing foothold into control of a whole domain, but only when paired with a separate bug or technique for initial access.4

Triage: exploited is not the same as most dangerous

One analysis argues that the most urgent work in this release is not the two zero-days.3 Trend Micro's Zero Day Initiative identified about 20 potentially wormable bugs, meaning a remote attacker could run code without logging in and without any user interaction.34 The list includes critical-rated flaws in widely exposed services:

• Remote Desktop Services: CVE-2026-69525
• Windows DNS Server: CVE-2026-69730
• Windows Shell: CVE-2026-69829

All three are use-after-free or heap-overflow bugs rated 9.8.1 Exchange Server (CVE-2026-55007) and SharePoint (CVE-2026-69465) also received remote code execution fixes.1 Dustin Childs of ZDI pointed separately to a Kerberos authentication bypass, CVE-2026-69676. In his description, a low-privileged attacker sends one crafted request to a domain controller and gets code execution.4

The two readings of priority differ. One analysis says organizations should patch internet-facing Exchange, SharePoint and RDP first, and then roll out the two exploited local bugs across all devices.3 Another says the confirmed zero-days should go first because attackers are already using them.4 For most organizations, the deciding factor should be what they expose to the internet. A company running on-premises Exchange on the public internet faces more immediate risk from an unexploited wormable bug than from a local privilege escalation that needs a foothold first. For everyone else, confirmed exploitation should come first.

Jack Bicer of Action1 described the problem directly. With hundreds of updates arriving at once, the hard part is not working through the list but deciding what needs attention first.1

The federal clock and a fast-moving bypass

CISA added both zero-days to its Known Exploited Vulnerabilities catalog and told federal civilian agencies to apply the fixes by September 22, 2026.15 One report noted that CISA acted within the same week as Microsoft's disclosure, instead of the slower pace the catalog sometimes shows.4

The same report says a researcher using the name Nightmare Eclipse published a proof-of-concept exploit called ShieldCrash within hours of the release, and that it gets around one of the fixes.4 Other outlets in this coverage did not independently confirm that claim, so it should be treated with caution. If it holds up, defenders may need to revisit at least one of September's patches even after installing it.

AI is driving the volume, and the volume keeps growing

The bigger story is how many bugs are being found. Tenable said the September release pushed Microsoft's 2026 total past 2,600 vulnerabilities, more than double the previous annual record from 2020, with three months still left in the year.5 Childs said AI-assisted bug hunting shows no sign of slowing. He added that the record numbers had not yet brought a matching jump in real-world exploitation, though September's two zero-days were an exception.4

The record did not last. In October, Microsoft patched about 1,413 vulnerabilities, more than its entire 2020 annual record of 1,261.13 Other counts for that release ranged from 1,407 to 1,411.1620 The only actively exploited zero-day in October was CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web, the label Windows puts on downloaded files.1214 Anthropic was among the organizations credited with reporting it.12 Monthly counts show how quickly the numbers rose. Microsoft fixed 54 CVEs in February, 569 in July and 964 in September, then 1,407 in October.18 Microsoft is also testing "risk cohorts" that group fixes to help administrators decide what to deploy first.17

What it means

September was the month the numbers became a planning problem rather than a footnote. October suggests that is now normal. In practice, the CVE count no longer tells defenders much. What matters is whether a bug is being exploited, whether it is exposed to the internet, and whether it can be reached without logging in. The two September zero-days are serious mainly as tools for escalating an intrusion that has already started, not as a sign of a breach. The bigger risk is that, among nearly a thousand fixes each month, organizations miss the few that actually need attention first.