Microsoft September 2026 Patch Tuesday: Two Zero-Days, 974 Fixes

What happened

Microsoft's September 2026 Patch Tuesday was its largest monthly security release on record. The company shipped fixes for 974 vulnerabilities across its product line, and two of them were already being exploited before patches were available 45. The Cybersecurity and Infrastructure Security Agency (CISA) added both zero-days to its Known Exploited Vulnerabilities (KEV) catalog on September 8, the day of release. Federal agencies must remediate them by September 22 13.

The exact size of the release depends on who is counting. Microsoft's figure is 974. BleepingComputer counted 966, Zero Day Initiative 972, and Tenable 964 4. Zero Hunt, which used the 966 figure, said 105 of the flaws were rated critical 3. Tallies usually differ when researchers decide whether to include third-party components or re-released advisories. Under any of these counts, the release is far beyond anything Microsoft has shipped before.

The two exploited flaws

Neither zero-day is a remote code execution bug. Both are local privilege escalation flaws that turn an attacker's existing low-privilege access into full SYSTEM control. Both carry a CVSS score of 7.8 135.

CVE-2026-81963 affects the Windows Update Stack. It is a link-following weakness (CWE-59): the component resolves links improperly before it accesses files 12. An authenticated attacker with low privileges can exploit it locally. The attack is low complexity and needs no user interaction, and success gives the attacker high impact on confidentiality, integrity and availability 2. Microsoft credited Airbus Helicopters and the Microsoft Threat Intelligence Center, which reported it independently 1. The advisory directs administrators to the September updates for Windows 11 and Windows Server 2025 2.

CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the interprocess messaging mechanism inside Windows. An attacker can use it to break out of a low-privilege AppContainer sandbox and reach SYSTEM, again with no user interaction 3. Volexity and Proofpoint received credit for the discovery 13.

The credits suggest how the flaws were found. When threat-intelligence and email-security firms report a bug, it often means the flaw was spotted during an incident investigation, not through a code audit. Microsoft and CISA have not attributed the attacks publicly.

Why a 7.8 shouldn't wait

Zero Hunt notes that a 7.8 score lands these bugs in Microsoft's "Important" tier. Many patch programs push that tier to the next maintenance window 3. Here, that habit is a mistake. Privilege escalation bugs are the second stage of an attack. They are what an intruder uses after phishing, a malicious download or a compromised browser process provides an initial foothold. A sandbox escape such as CVE-2026-85880 is especially useful for turning a contained browser or app compromise into control of the whole machine.

The CVSS score rates each bug in isolation. Chained with an entry-point exploit, either one can give an attacker complete control of the host. CISA's two-week deadline reflects that risk better than the numerical score does.

The bigger story: AI-driven volume

The zero-days arrive during a sharp rise in patch volume. Microsoft fixed about 400 vulnerabilities in August and 570 in July, which was the previous monthly record 4. September more than doubled August's total. The year-to-date count now exceeds 2,600, well past Microsoft's previous full-year record of 1,245 set in 2020, with three months left in the year 4.

Both Cyberscoop and Gokhshtein's coverage attribute the increase to AI-assisted vulnerability discovery 45. Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative, wrote that the trend "shows no signs of slowing down," but that there has been no matching spike in active exploitation "yet" 5.

The sources agree on the facts but differ in tone. Cyberscoop's framing is mostly reassuring: record disclosure counts have not led to a flood of exploited zero-days, and researchers advise organizations to focus on their own exposure 5. Gokhshtein's coverage stresses the operational load on enterprise security teams that have to test and deploy these record volumes 4.

The takeaway

Both views hold, and they point to the same practice. When a single month brings close to a thousand fixes, teams cannot treat every patch as urgent. They need to triage by evidence of exploitation and by their own exposure, not by severity labels alone. On that basis, this month's priorities are clear. The Windows Update Stack and ALPC fixes should go out ahead of the normal "Important" schedule, especially on Windows 11 and Server 2025 endpoints where users browse or open untrusted content.

Childs's "yet" is the warning to watch. Attackers have access to the same AI tools that are finding these bugs. If exploitation begins to keep pace with discovery, monthly releases of this size will become much harder for security teams to manage.