Microsoft's Record 974-CVE Patch Tuesday Ships Two Exploited Windows Zero-Days
🛡️ Security •

Microsoft's Record 974-CVE Patch Tuesday Ships Two Exploited Windows Zero-Days

Microsoft's largest-ever Patch Tuesday fixes roughly 970 CVEs, including two exploited Windows zero-days now in CISA KEV and 20 wormable RCE bugs. Triage by exploitation, not CVSS.

AB
Anthony Bahn IT Director & Cybersecurity Consultant
patch tuesdaymicrosoftzero-daycisa kevprivilege escalation

What Happened

Microsoft shipped its September 2026 Patch TuesdayPatchPatch🛡️A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program. Tuesday🛡️The second Tuesday of each month, when Microsoft releases its scheduled batch of security updates. The predictable cadence lets defenders plan deployment, but AI-assisted vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. discovery has pushed recent releases past 900 CVEs, straining triage. on 8 September, and it is the largest security release the company has ever produced. Depending on how third-party and Chromium-derived entries are counted, the total sits somewhere between 964 and 974 CVEs: Tenable counts 964, BleepingComputer 966, and SecurityWeek 974, while the Zero Day Initiative (ZDI) puts it at 972 new Microsoft CVEs plus 25 externally sourced ones. Whichever figure you prefer, it dwarfs the previous record of roughly 570 set in July and the 398 fixed in August.

Two of those fixes matterMatter🏠A new universal smart home standard backed by Apple, Google, and Amazon for cross-platform compatibility. more than the other nine hundred and change. Both are elevation-of-privilege (EoP) bugs already exploited in the wild before a patch existed, and both landed in the CISA Known Exploited Vulnerabilities (KEV) catalog the same day, with a federal remediation deadline of 22 September. Beyond the zero-days, ZDI's Dustin Childs flagged 20 critical remote code execution bugs in core Windows network services that are wormableWormable🛡️A vulnerability that can be exploited to spread automatically from system to system without user interaction, similar to how biological worms spread.: exploitable by an unauthenticated remote attacker with no user interaction.

The Two Exploited Zero-Days

**CVE-2026-81963, Windows Update Stack.** Microsoft describes this as improper link resolution before file access, the class commonly called link followingLink Following🛡️An attack in which a low-privileged user substitutes a symbolic link, junction or hard link for a path a privileged process is about to use, so the privileged file operation acts on an attacker-chosen target. It is a common route from local code execution to SYSTEM.. An attacker who already has low-privileged code execution on the box abuses a symbolic link or junction so that a privileged Update Stack file operation lands somewhere the attacker chose, ending with SYSTEM privileges. CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), rated Important, and Microsoft's temporal metrics mark exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. maturity as Functional. Credit goes to Romain Deperne and the Microsoft Threat Intelligence Center. Tenable notes that seven Update Stack EoP flaws have been patched since 2022 and this is the first one confirmed exploited as a zero-dayZero-Day🛡️A security vulnerability that is exploited or publicly disclosed before the software vendor can release a patch, giving developers 'zero days' to fix it..

**CVE-2026-85880, Windows Advanced Local Procedure Call (ALPC).** This one is a heap-based buffer overflowBuffer Overflow🛡️A vulnerability where a program writes data beyond the boundaries of allocated memory, potentially overwriting adjacent memory and allowing attackers to execute malicious code. (Microsoft tags it CWE-122 and CWE-908, use of an uninitialised resource) in the kernel's local inter-process messaging subsystem. Same 7.8 score and Important rating, but the FAQ is more specific about the threat model: code running inside a low-privilege AppContainerAppContainer🛡️A Windows sandbox that runs code with a restricted token and limited access to files, network and other resources, used by browser renderers and Office protected view. Attackers chain a local privilege-escalation bug to break out of an AppContainer and reach SYSTEM. can trigger the overflow to escape the sandbox and reach SYSTEM, with no user interaction. Volexity and Proofpoint's Mark Kelly, David Galazin and Jeremy Hedges are credited. Tenable counts 16 ALPC vulnerabilities patched since 2022, but this is the first to appear in a Patch Tuesday in more than three years, and SecurityWeek calls it only the second ALPC zero-day in nearly four.

Neither vulnerability was publicly disclosed before the fix, and Microsoft has not said who is exploiting them or against whom. The AppContainer detail on CVE-2026-85880 is the strongest hint: that is the sandbox used by browser renderers and Office's protected views, so ZDI's read that the bug is most useful when paired with a document or attachment that gives the attacker their initial low-privilege foothold is the sensible working assumption. The Update Stack bug is the more worrying primitive on paper, because the component runs with elevated rights on every machine and its privileged file operations are exactly what a link-following attack needs. Read How Link-Following Bugs Turn Privileged File Operations Into SYSTEM Access for the mechanics.

Who Is Affected

Here the primary source diverges from most of the coverage, and the difference changes your deployment plan. Microsoft's own affected-product data in the Security Update Guide splits the two bugs across complementary halves of the Windows estate:

  • **CVE-2026-81963** lists only Windows 11 (23H2 via KB5122880, 24H2 and 25H2 via KB5124008, 26H1 via KB5124012) and Windows Server 2025 (KB5122871). There are no Windows 10 or Windows Server 2022 entries.
  • **CVE-2026-85880** lists only Windows 10 (1607, 1809, 21H2 and 22H2, the latter two via KB5122878) and Windows Server 2012, 2012 R2, 2016, 2019 and 2022 (KB5123065, KB5123066, KB5123099, KB5122876, KB5122882). There are no Windows 11 entries.

Several outlets, including Ivanti's write-up, describe the ALPC bug as affecting the entire fleet up to Windows 11. We are following the vendor's affected-product list, but the practical conclusion is the same either way: between the two CVEs every supported Windows client and server is carrying at least one exploited zero-day until this month's cumulative update is installed. Don't let anyone argue that a Windows 10 estate is safe because the headline bug is in the Update Stack, or vice versa.

The Server 2012 and 2012 R2 fixes deserve a footnote. Those platforms are on paid Extended Security Updates that end after October's release, so this is one of the last exploited-in-the-wild patches those hosts will ever receive.

The Wormable Twenty

The zero-days are local bugs; the wormable set is the remote exposure. ZDI's list covers DNS Server (six CVEs, led by CVE-2026-69730 at CVSS 9.8, which Childs calls the spiritual successor to 2020's SigRed), DHCPDHCP🌐Protocol that automatically assigns IP addresses to devices on a network. Server (CVE-2026-69510, -69845, -72979), Active Directory (CVE-2026-69524), Message Queuing (CVE-2026-69579, -83997), the RMCAST driver (CVE-2026-69530, -78449, -78450), RRAS (CVE-2026-69590), NFS ONCRPC (CVE-2026-69595), Netlogon (CVE-2026-72982, also 9.8), ICS/SSTP (CVE-2026-72983, -73009) and Failover Clustering (CVE-2026-73010, -78444). Tenable adds that Microsoft rates the DNS bug, Kerberos CVE-2026-69676 (8.8) and Remote Desktop Services CVE-2026-69525 (9.8) as Exploitation More Likely.

That list is a map of domain infrastructure. DNS, DHCP, Netlogon, Kerberos and AD are the services every other Windows system trusts implicitly, and most of them cannot be firewalled off from the clients they serve. CrowdStrike's note that 12 of the 22 critical Office bugs trigger from the Outlook Reading Pane rounds out the picture: no click required on the client side, no authentication required on the server side. Why Wormable Bugs in Core Windows Services Change the Patching Calculus goes into what that means for segmentation and patch order.

Immediate Actions

  1. **Deploy the September cumulative updates to every Windows host, zero-day first.** The KEV due date for federal agencies is 22 September; treat that as an outer bound, not a target. The zero-days need no user interaction and grant SYSTEM, which is the last step before credential dumping and lateral movementLateral Movement🛡️Techniques attackers use to move through a network after initial compromise, seeking additional systems to control and data to steal..
  2. **Order the remainder by exposure, not by CVSS.** Domain controllers and any server running DNS, DHCP, Netlogon-dependent roles, MSMQ, NFS or RRAS go next, because the wormable bugs live there. Then Exchange (SecurityWeek highlights CVE-2026-55007, a critical RCE, and Tenable notes CVE-2026-69380, an 8.1 EoP that exposes other users' mailboxes) and SharePoint (CVE-2026-69465). Then Office endpoints, prioritising Outlook. How to Prioritize a Record-Size Patch Tuesday Without Patching Everything First lays out a repeatable version of this triage.
  3. **Check the AppContainer story on your endpoints.** If EDR telemetry shows sandboxed processes (browser renderers, Office protected view) spawning children or touching ALPC ports abnormally in the days before patching, treat it as a hunt lead rather than noise. Microsoft has published no indicators, so behavioural detection is what you have.
  4. **Confirm the Update Stack patch actually applied.** CVE-2026-81963 lives in the mechanism that installs updates. Verify the post-patch build numbers from the Security Update Guide (for example 10.0.26100.9445 for Windows 11 24H2) rather than trusting the deployment tool's success status alone.
  5. **Use network controls to buy time.** Microsoft's own guidance, cited in Help Net Security's pre-release forecast, is that firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. and segmentation rules are a meaningful layer while patching is in progress. Restrict who can reach DNS, DHCP and RPC-based services on domain controllers to the subnets that legitimately need them.

Long-Term Outlook

The volume is the story behind the story. Every analyst quoted this month attributes the run of record releases to AI-assisted vulnerability discovery inside Microsoft, which BleepingComputer says began in mid-2026. Childs's line that defenders have to "embrace the suck" is blunt but accurate: this is the new baseline, not a spike. The counter-argument, made by Fortra's Tyler Reguly and Action1's Jack Bicer, is that a large CVE count is a good thing because it shrinks attack surfaceAttack Surface🛡️The sum of all points where an unauthorized user could attempt to enter or extract data from a system: exposed services, interfaces, accounts, and integrations. Reducing attack surface means removing reachability, not just patching. before adversaries find the same bugs, and that AI is producing "larger haystacks" without "more needles". Tenable's Satnam Narang makes the same point from the other side: the number of vulnerabilities most organisations actually need to worry about remains small. ZDI notes there has been no corresponding rise in in-the-wild exploitation so far.

Both readings are true and they point at the same operational conclusion. A team that patches by scrolling a list of 970 CVEs sorted by CVSS will drown, and the two that mattered this month were rated 7.8 and Important. The triage signal is exploitation status, KEV membership, network reachability and whether user interaction is required. If your process cannot surface those four attributes within an hour of release, fixing that process is a higher priority than any single patch on this list.

Sources

  • https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-81963
  • https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-85880
  • https://api.msrc.microsoft.com/sug/v2.0/en-US/affectedProduct?$filter=cveNumber%20eq%20%27CVE-2026-81963%27
  • https://api.msrc.microsoft.com/sug/v2.0/en-US/affectedProduct?$filter=cveNumber%20eq%20%27CVE-2026-85880%27
  • https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
  • https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog
  • https://www.zerodayinitiative.com/blog/2026/9/8/the-september-2026-security-update-review
  • https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880
  • https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/
  • https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/
  • https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-september-2026/
  • https://www.ivanti.com/blog/september-2026-patch-tuesday
  • https://www.helpnetsecurity.com/2026/09/04/september-2026-patch-tuesday-forecast/
← Back to All News