TL;DR
- what: Microsoft's September 2026 Patch Tuesday fixed 974 vulnerabilities, the largest single release ever, including two Windows privilege escalation flaws already exploited in the wild.
Microsoft shipped fixes for 974 vulnerabilities on September 8, 2026, the largest Patch Tuesday on record. Counting 25 non-Microsoft CVEs routed through the same update channel, the total reaches 999. Two of the 974 are already being exploited in the wild, and both are local privilege escalation bugs in Windows that end with the attacker holding SYSTEM. CISA added both to the Known Exploited Vulnerabilities catalog and set a remediation deadline for federal civilian agencies of September 22, 2026. The volume is a problem for your change calendar. The two zero-days are a problem for tonight.
Windows absorbed 723 of the fixes. Office and Office 2016 took 111, SQL Server 62, and developer tools 22. More than 110 carry a critical rating. Privilege escalation, remote code execution, and information disclosure account for close to 90 percent of the month. Counts vary by a few CVEs depending on the source, with Tenable putting the Microsoft total at 964, because vendors draw the boundary of what counts as a Microsoft CVE differently. The rank order of what you patch first does not change.
The two bugs under active attack
CVE-2026-85880 (CVSS 7.8) is a heap-based buffer overflow in Windows Advanced Local Procedure Call. Microsoft's advisory is specific about the abuse path: code running in a low privilege AppContainer can exploit it to escape the sandbox and elevate to SYSTEM, with no additional user interaction required. That is the classic browser-renderer-to-SYSTEM second stage, which means it pairs with whatever remote bug an operator already has. Volexity and Proofpoint were credited with reporting it, a combination that usually indicates it was pulled out of real intrusion or campaign telemetry rather than a lab. It is the first ALPC bug weaponized as a zero-day since CVE-2023-21674 in January 2023.
CVE-2026-81963 (CVSS 7.8) is an improper link resolution flaw in the Windows Update Stack, again ending at SYSTEM. Rapid7's Adam Barnett reads the fix as tightening controls so the Update Stack will no longer follow a malicious link and overwrite a system component with an attacker-controlled imposter. Every supported version of Windows gets a patch. Tenable counts seven privilege escalation flaws in the Windows Update Stack since 2022, and this is the first one to be exploited in the wild. Credit went to Romain Deperne of Airbus Helicopters and the Microsoft Threat Intelligence Center.
Microsoft confirmed exploitation but disclosed nothing about the operators, the campaign scale, or whether any victim was successfully breached. Treat the absence of detail as absence of detail, not as evidence that the activity is small.
⚠️ Both zero-days are local, and that is not a reason to slow down — Neither bug gets an attacker onto the box. Both are what an attacker uses once they are on it. If you are running an EDR that catches initial access most of the time, these are exactly the flaws that turn the 1 in 20 it misses into domain-level compromise. FCEB agencies have until September 22, 2026. Everyone else should treat that date as the outer bound, not the target.
Nine more that deserve same-week attention
None of these are known to be exploited yet, but five are unauthenticated network RCEs at CVSS 9.8 in services that organizations routinely expose internally and sometimes externally.
- CVE-2026-69525 (9.8): use-after-free in Windows Remote Desktop Services, unauthenticated RCE over the network
- CVE-2026-69730 (9.8): use-after-free in Windows DNS Server, unauthenticated RCE, and DNS servers are almost always domain controllers
- CVE-2026-72979 (9.8): use-after-free in Windows DHCP Server, unauthenticated RCE
- CVE-2026-69595 (9.8): use-after-free in the Windows Services for NFS ONCRPC XDR driver, unauthenticated RCE
- CVE-2026-69829 (9.8): heap-based buffer overflow in Windows Shell, unauthenticated RCE over the network
- CVE-2026-65669 (9.6): injection flaw in SQL Server allowing unauthenticated network privilege escalation
- CVE-2026-69465 (8.8): missing authorization in SharePoint, authenticated network RCE, and SharePoint has a track record of rapid exploit development
- CVE-2026-80097 (8.6): improper authentication in Microsoft Authenticator allowing local privilege escalation, an identity control failing open
- CVE-2026-55007 (8.1): double free in Microsoft Exchange Server, unauthenticated network code execution
How the number got this big
The 2026 trend line is steep: 161 in May, 220 in June, 663 in July, 457 in August, then 974 in September. Tenable measures the jump at nearly 70 percent above the previous record and puts the year to date past 2,600, already more than double the full-year record of 1,245 set in 2020, with three months left. ZDI counts 2,760 Microsoft flaws fixed in 2026. Both trackers point at the same cause: AI-assisted vulnerability discovery has changed the input rate to Microsoft's security response process, and nothing suggests it slows down from here.
What has not changed at the same rate is exploitation. There is no correlating spike in active exploits, and the subset of these 974 that actually touch most environments stays small. That is the planning assumption for the rest of 2026: bigger batches, roughly flat exploited counts, so the value of your patch program moves almost entirely into triage quality rather than throughput.
Triage order for a 974 CVE month
- Tonight: CVE-2026-85880 and CVE-2026-81963 on every workstation and server. Both are in the base OS, so there is no role-based scoping to hide behind.
- This week: the five CVSS 9.8 network RCEs, scoped by installed role. Query for the DNS, DHCP, NFS, and RDS roles first rather than patching blind across the fleet.
- This week: Exchange, SharePoint, and SQL Server, in that order. Internet-reachable instances first.
- Normal cycle: the remaining 960 or so. Let your standard ring deployment carry them, and do not let the headline number pressure you into skipping pilot rings.
Record CVE counts are not a record risk month — Jack Bicer of Action1 framed the operational problem correctly: at this scale the challenge is not getting through the list, it is knowing what needs attention first. A team that patches two zero-days plus nine critical CVEs in 72 hours and lets the other 963 ride the normal cycle is in better shape than a team that stalls for three weeks trying to move all 974 at once.
Bottom line
Deploy the September updates to every supported Windows version, prioritizing CVE-2026-85880 and CVE-2026-81963 because they are being used right now. Then scope the 9.8 RCEs to the servers that actually run DNS, DHCP, NFS, and RDS, and get those patched before the KEV deadline on September 22, 2026. Build your process for a world where 900 plus CVE months are normal, because the discovery rate driving this is not reverting.
Originally published on RedEye Threat Intelligence.
Top comments (0)