Hamza

Posted on Sep 18 Originally published at tekmag.thsite.top

Microsoft Patch Tuesday September 2026: Record 974 Vulnerabilities, Two Exploited Zero-Days

#security #microsoft #cve

Originally published at https://tekmag.thsite.top/microsoft-patch-tuesday-september-2026-record-974-vulnerabilities-two-exploited-zero-days/

Microsoft's September 2026 Patch Tuesday fixed a record 974 vulnerabilities, the largest release in the roughly two decades the program has run, including two Windows zero-days already being exploited in the wild. 113 of the flaws are rated critical, and CISA has flagged both exploited bugs for patching before September 22, 2026.

Microsoft's monthly security update landed on September 8, 2026. It is not just the biggest Patch Tuesday yet. It is a clear step change from the two releases that had held the record before it: about 570 flaws fixed in July and roughly 398 in August. The jump to 974 fixed CVEs reflects how much faster vulnerabilities are being found in 2026, and it landed at a moment when two of those flaws were already in attacker hands.

For the two exploited zero-days, the guidance is unambiguous: patch now. For the other 972, the message from the security teams tracking the release is that the raw count matters far less than which handful actually reach your environment.

I verified the totals directly against Qualys's September Patch Tuesday review and cross-referenced them with Tenable's analysis of the release.

The numbers hold up: 974 CVEs in Microsoft's September 2026 release notes, broken down as 113 critical and 860 important.

Two of the flaws — CVE-2026-85880 and CVE-2026-81963 — were already confirmed in the wild and flagged by CISA before the patch shipped.

Key Takeaways

Microsoft fixed a record 974 vulnerabilities on September 8, 2026, up from about 570 in July and 398 in August.
113 are rated critical and 860 important. Elevation of privilege made up 44.7% of the flaws, remote code execution 26.8%.
Two zero-days are actively exploited: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), each scored CVSS 7.8. CISA wants both patched before September 22, 2026.
The Windows DNS Server RCE (CVE-2026-69730, CVSS 9.8, no authentication required) should be treated as top priority on any Active Directory domain controller.
Windows absorbed 723 of the fixes, Office 222, and SQL Server 62. Microsoft shipped no Microsoft Edge fixes this round.

Why this Patch Tuesday is a record

974 is not a typo and not an outlier that one bad month produced. It sits well ahead of the last two monthly releases, which had already pushed the program past its previous highs. We covered the August Patch Tuesday, which fixed 398 flaws, and the jump from that count to 974 is the clearest sign of how fast the release size is now moving. Tenable and Qualys both frame the jump as a symptom of AI-assisted vulnerability discovery, which in 2026 is flooding vendor backlogs with long-dormant flaws that static review missed.

974 mostly measures how many bugs got found, not how many will hit you. Satnam Narang of Tenable put it plainly: while the number of patched vulnerabilities keeps rising, "the number of vulnerabilities that can and will affect most organizations remains quite low." He described AI-assisted discovery as "creating larger haystacks, but it isn't finding more needles."

Fortra's Tyler Reguly drew the same line. He framed the surge as evidence that vendors are proactively shrinking their attack surface, and expected that as the long-standing, hard-to-find flaws get cleaned out, "Patch Tuesday will return to its typical cadence." The interim advice from both is the same: prioritize by risk context, not by headline count.

The two zero-days being exploited

Only two flaws in the release are confirmed exploited in the wild, and both are local privilege-escalation bugs in core Windows components.

CVE-2026-85880: Windows ALPC heap overflow

This is a heap buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem. An attacker who can run code inside a low-privilege AppContainer can use it to escape the sandbox and escalate to SYSTEM, and Microsoft notes no additional user interaction is required. It is the second ALPC zero-day in nearly four years, after CVE-2023-21674 in January 2023, and Microsoft has not patched the component since April 2023.

CVE-2026-81963: Windows Update Stack link following

This is an improper link-resolution flaw in the Windows Update Stack, the set of components that install updates. An authenticated local attacker can exploit it to elevate to SYSTEM privileges. It is the first Windows Update Stack flaw flagged as a zero-day out of the seven resolved in that component over the past five years.

Both carry a CVSS score of 7.8. CISA added each to its Known Exploited Vulnerabilities catalog and is urging federal agencies, and by extension everyone else, to patch before September 22, 2026. This is the most direct action item in the entire release.

The criticals to watch

The exploited zero-days are the urgent ones, but the critical remote-code-execution bugs deserve attention right behind them. The standout is the Windows DNS Server flaw.

CVE-2026-69730 is an unauthenticated, no-user-interaction RCE in Windows DNS Server, scored CVSS 9.8. An attacker can send a specially crafted packet to the DNS service and execute code on the target. In most Active Directory environments DNS runs on the domain controllers themselves, so in that default layout this is code execution on the box that answers name lookups and issues authentication tickets. Microsoft lists Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 as affected; Windows 11 is not in the list.

Two Windows DHCP Server RCEs carry the same 9.8 rating (CVE-2026-69845 and CVE-2026-72979), and a critical Remote Desktop Services RCE (CVE-2026-69525) is marked by Microsoft as "Exploitation More Likely." A critical Kerberos RCE, CVE-2026-69676, is rated the same. ZDI's review also flagged an Exchange Server RCE, a SharePoint RCE, and a SQL Server privilege-escalation bug as notable, and counted roughly 20 vulnerabilities in the release as effectively wormable, meaning they enable code execution without authentication or user interaction.

What got patched across products

Windows took the bulk of the work, with 723 of the 974 fixes. Office followed with 222 (111 of them in Office 2016), then SQL Server with 62, Developer Tools with 22, SharePoint Server with 16, Azure with 12, Skype for Business with 10, and Exchange Server with 9. Microsoft did not address any Chromium-based Edge bugs this round. The Office count sits a month out from the actively exploited Office zero-day Microsoft patched in August, so if Office is in scope, this is the second consecutive release worth treating as high-priority.

The release also included fresh Servicing Stack Updates, classified as critical, for Windows Server 2012, Windows Server 2012 R2, and Windows 10 version 1607 / Server 2016.

What to patch first

If you manage Windows infrastructure, work in this order:

First, the two exploited zero-days. Deploy the CVE-2026-85880 and CVE-2026-81963 fixes immediately, ahead of the September 22 CISA deadline. These are confirmed in the wild.
Next, your domain controllers and DNS/DHCP servers. The critical 9.8 DNS and DHCP RCEs are the most likely path to an authenticated foothold becoming a fully compromised identity fabric. The Kerberos RCE lands on the same systems.
Then, the "Exploitation More Likely" RCEs. Remote Desktop Services and anything internet-facing should be patched on the same cycle.

Do not let the 974 number push you into a full-stop, every-system, every-flaw rollout. Patch by reachability and exploitability, and confirm which of the Criticals actually apply to your stack before touching the long tail of Important items. The SharePoint flaw ransomware groups put to work this month is a reminder that a server role you assume is low-value can still become the entry point.

The bigger picture

The record count is a story about discovery tooling as much as about Microsoft's product surface. When vendors can find more dormant flaws with automated and AI-assisted analysis, monthly releases swell even while the number of bugs an attacker can realistically reach stays small. If the trend holds, expect Patch Tuesday's headline numbers to stay elevated until those backlogs drain, and expect the genuinely dangerous subset to remain a manageable slice of each release.

Conclusion

My read: this release is a measurement of how fast vulnerabilities are now being found, not a 974-fold increase in real risk. The decision that actually matters sits in a handful of items: patch the two exploited zero-days before September 22, treat the 9.8 DNS Server flaw on your domain controllers as urgent, and clear the "Exploitation More Likely" RCEs in the same window. The rest is noise relative to those.

If you run Windows infrastructure, check that your domain controllers and DHCP servers are patched by the CISA deadline, and tell me your patching order for this release in the comments.

{
"@context": "https://schema.org",
"@type": "FAQPage",
"mainEntity": [
{
"@type": "Question",
"name": "How many vulnerabilities did Microsoft fix in September 2026 Patch Tuesday?",
"acceptedAnswer": { "@type": "Answer", "text": "Microsoft fixed a record 974 vulnerabilities on September 8, 2026, including 113 critical and 860 important severity flaws. This is the largest Patch Tuesday release in the program's history." }
},
{
"@type": "Question",
"name": "Which zero-days are being actively exploited in the September 2026 release?",
"acceptedAnswer": { "@type": "Answer", "text": "Two: CVE-2026-85880, a heap overflow in Windows ALPC, and CVE-2026-81963, a link-following flaw in the Windows Update Stack. Both are local privilege-escalation bugs rated CVSS 7.8 and both have been added to CISA's Known Exploited Vulnerabilities catalog." }
},
{
"@type": "Question",
"name": "What is CVE-2026-69730 and why does it matter?",
"acceptedAnswer": { "@type": "Answer", "text": "CVE-2026-69730 is a critical remote code execution flaw in Windows DNS Server with a CVSS score of 9.8. An unauthenticated attacker can send a crafted packet to trigger it, and because DNS usually runs on Active Directory domain controllers, exploitation can mean code execution on a core identity system." }
},
{
"@type": "Question",
"name": "How soon do I need to patch the exploited flaws?",
"acceptedAnswer": { "@type": "Answer", "text": "CISA has set a deadline of September 22, 2026 for the two exploited zero-days. Patch them first, before any of the other vulnerabilities in the release." }
},
{
"@type": "Question",
"name": "Did Microsoft patch any bugs in Microsoft Edge this month?",
"acceptedAnswer": { "@type": "Answer", "text": "No. Microsoft did not address any vulnerabilities in the Chromium-based Microsoft Edge browser in the September 2026 release." }
}
]
}

Frequently asked questions

How many vulnerabilities did Microsoft fix in September 2026 Patch Tuesday?

Microsoft fixed a record 974 vulnerabilities on September 8, 2026, including 113 critical and 860 important severity flaws. This is the largest Patch Tuesday release in the program's history.

Which zero-days are being actively exploited in the September 2026 release?

Two: CVE-2026-85880, a heap overflow in Windows ALPC, and CVE-2026-81963, a link-following flaw in the Windows Update Stack. Both are local privilege-escalation bugs rated CVSS 7.8 and both have been added to CISA's Known Exploited Vulnerabilities catalog.

What is CVE-2026-69730 and why does it matter?

CVE-2026-69730 is a critical remote code execution flaw in Windows DNS Server with a CVSS score of 9.8. An unauthenticated attacker can send a crafted packet to trigger it, and because DNS usually runs on Active Directory domain controllers, exploitation can mean code execution on a core identity system.

How soon do I need to patch the exploited flaws?

CISA has set a deadline of September 22, 2026 for the two exploited zero-days. Patch them first, before any of the other vulnerabilities in the release.

Did Microsoft patch any bugs in Microsoft Edge this month?

No. Microsoft did not address any vulnerabilities in the Chromium-based Microsoft Edge browser in the September 2026 release.

DEV Community