Microsoft's Record 974-Fix Patch Tuesday Includes Two Zero-Days

What happened

Microsoft's September 8, 2026 Patch Tuesday landed as the largest single security release the company has ever issued, addressing 974 of its own CVEs across Windows, Office, SQL Server, Azure, Exchange, SharePoint, developer tools and identity products 1711. Add the 25 non-Microsoft CVEs Microsoft republished, mostly Chromium fixes inherited by Edge, and the combined total climbs to 999 7813. Two of the flaws were already being exploited in the wild before the patches shipped, which is the part of the story that matters most regardless of how the headline number is counted 7913.

The raw scale is staggering by any prior standard. Windows alone accounted for 723 of the fixes, Office took 222 (111 of them in Office 2016), and SQL Server, developer tools, SharePoint, Azure, Skype for Business and Exchange rounded out the rest 7910. Depending on which security firm's tally you read, somewhere between 105 and 119 of the flaws were rated Critical 11121317. Zero Day Initiative's Dustin Childs flagged roughly 20 vulnerabilities as potentially wormable — bugs that allow remote code execution without authentication or user interaction, the kind of flaw that historically enables self-propagating malware 716.

The two zero-days

The two actively exploited bugs both hand a local attacker SYSTEM-level privileges, the highest tier of access on a Windows machine. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call, the internal messaging system Windows processes use to talk to each other. Microsoft says an attacker who can already run code inside a low-privilege AppContainer can use the bug to escape that sandbox with no further user interaction required 7913. Tenable's Satnam Narang noted this is only the second ALPC zero-day Microsoft has had to fix in the past four years, and the first ALPC patch of any kind since April 2023 7917.

The second, CVE-2026-81963, sits in the Windows Update Stack itself — the machinery that installs updates — and stems from improper link resolution that lets an attacker trick the system into overwriting a legitimate component with a malicious substitute 713. Rapid7's Adam Barnett described the patch as an effort to stop the Update Stack from following a booby-trapped link in the first place 813. Tenable counted seven privilege-escalation bugs in that component since 2022, but says this is the first one confirmed as both a zero-day and actively exploited 71317. Both CVEs carry a CVSS score of 7.8, and both have been added to CISA's Known Exploited Vulnerabilities catalog, giving federal civilian agencies until September 22 to patch 1315.

Beyond the zero-days

Security researchers pointed to several other fixes as arguably higher-priority for many organizations than the two local privilege-escalation bugs, precisely because they're remotely reachable. CVE-2026-55007, an 8.1-rated Exchange Server flaw, reportedly can be triggered by an email carrying a rigged Visio attachment, with no need for the recipient to open anything 7916. CVE-2026-69465 brings another remote-code-execution risk to SharePoint Server, a product with a well-documented history of attracting ransomware crews and espionage actors 91317. Remote Desktop Services picked up a 9.8-rated use-after-free bug (CVE-2026-69525), and Windows DNS, DHCP and NFS services collected multiple critical remote-code-execution fixes as well 121317.

Office drew particular attention from CrowdStrike's analysis, which counted 22 Critical Office-related vulnerabilities, 21 of them capable of remote code execution and 12 triggerable simply by previewing a malicious file in Outlook's Preview Pane — no click required 14. An Outlook RCE (CVE-2026-78509) and a Word RCE (CVE-2026-78510) both hit the maximum 9.8 severity score 1317. And in a detail that says something about where security risk is heading, CVE-2026-65669, a 9.6-rated SQL Server privilege-escalation flaw, works by convincing a user to feed malicious instructions to SQL Copilot inside SQL Server Management Studio — a prompt-injection attack with a CVE number attached 131617.

Where the reporting agrees

Every outlet covering the release agrees on the essential shape of the story: 974 Microsoft-authored CVEs, a new all-time record, and two zero-days already under active exploitation in ALPC and the Windows Update Stack 179111213. There's also broad agreement that both zero-days lead to SYSTEM-level privilege escalation, that CISA added them to its KEV catalog with a September 22 deadline, and that the previous record was set just two months earlier in July, at roughly 570 CVEs — meaning September's total represents close to a 70% jump 71213. Multiple outlets independently credit Tenable's Satnam Narang for the historical context on both zero-day components, and several cite Rapid7's Adam Barnett on the Update Stack fix's likely mechanism 7891315. There's also consensus that AI-assisted vulnerability discovery — fuzzing, automated code analysis — is a plausible driver of the surging counts, even as researchers caution that exploitation in the wild has not spiked proportionately 1316.

Where it doesn't

The exact vulnerability count turns out to be surprisingly unsettled. Microsoft's own Security Update Guide lists 974, which most outlets adopted as the headline figure 17911. But The Hacker News, citing Narang directly, quotes Tenable's own count as 964 1315. A more granular breakdown attributes 966 to BleepingComputer and roughly 972 new CVEs to Zero Day Initiative, meaning four different trackers produced four different totals for what is nominally the same release 17. The same divergence shows up in the Critical-severity count: Microsoft's guide reportedly rates 113 of its CVEs Critical, while BleepingComputer counts 105, Tenable 104, ZDI 114, and Petri's reporting separately cites 114 Critical flaws and TechRepublic cites 119 10111217. That's roughly a ten-CVE spread on severity alone, which one detailed account explicitly flags as a discrepancy the industry has stopped trying to fully reconcile 17.

The wormable-bug count also varies by source, generally landing at 20, though it's attributed specifically to Zero Day Initiative's Dustin Childs rather than presented as an official Microsoft classification 71617. Framing differs too: SecurityWeek, The Hacker News and Infosecurity Magazine treat this primarily as a disclosure-and-remediation milestone worth documenting precisely, while TechRepublic and The Next Web lean harder into the operational-burden angle, stressing what nearly 1,000 simultaneous fixes means for already-stretched IT teams 7111316. One outlet also connects the release to an unrelated regulatory deadline — the EU's Cyber Resilience Act, which began requiring vendors to report actively exploited vulnerabilities within 24 hours starting September 11 — a detail no other source in this set mentions 16.

The reading that holds up

The count discrepancies are not really a factual dispute; they're an artifact of different vendors drawing different boundaries around a single, messy release — whether to include republished third-party CVEs, Chromium fixes Edge inherits, or duplicate entries across product lines. Given that, Microsoft's own figure of 974 is the right anchor number, since every other tracker's total sits within roughly one percent of it. What should not get lost in the arithmetic is the substance both the precise trackers and the higher-level accounts converge on: two zero-days already being used against real systems, a cluster of remotely exploitable Critical bugs in Exchange, SharePoint and Office, and an unmistakable trendline — this year's cumulative fix count has already more than doubled 2020's previous full-year record with three months still to go. The record itself is less the story than what it signals about the pace vulnerability discovery is now moving at, on both sides of the fight.