Record-Breaking Patch Tuesday: Microsoft Fixes 974 CVEs, Two Zero-Days Under Active Attack

Microsoft released its September 2026 Patch Tuesday updates on September 8, fixing a historic number of vulnerabilities. The official Microsoft Security Response Center (MSRC) count reaches 974 CVEs, while BleepingComputer tallies 966 by counting only flaws published on Patch Tuesday itself. Beyond the sheer volume, the operational reality for SOCs is defined by two actively exploited zero-days for local privilege escalation to SYSTEM, both listed in CISA's KEV catalog.

The Two Zero-Days: From AppContainer to SYSTEM Without Interaction

The immediate threat comes from CVE-2026-85880 and CVE-2026-81963, both flagged by Microsoft with "Exploitation Detected" and confirmed in CISA's KEV catalog. No details on in-the-wild attacks have emerged: Microsoft has not disclosed exploit techniques, delivery vectors, or alleged victims. Attribution to specific threat groups is not supported by public evidence.

CVE-2026-85880 is a heap-based buffer overflow in the Windows ALPC (Advanced Local Procedure Call) component. Microsoft's official description, cited by BleepingComputer, reads: "Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally." SecurityWeek adds that an attacker able to execute code in a low-privilege AppContainer can exploit the vulnerability to escape the sandbox and gain SYSTEM privileges without further user interaction. Tenable researcher Satnam Narang noted this is the second zero-day in ALPC in nearly four years, following CVE-2023-21674. Discovery is credited to Volexity and Proofpoint's Mark Kelly, David Galazin, and Jeremy Hedges.

CVE-2026-81963 involves improper link resolution — link following — in the Windows Update Stack. Microsoft describes it as: "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally." CISA specifies it allows a local attacker to escalate privileges to SYSTEM. It is the first zero-day in the Windows Update Stack among seven flaws fixed in five years, per Tenable. Discovered by Romain Deperne and the Microsoft Threat Intelligence Center (MSTIC).

Both CVEs carry a CVSS 3.1 score of 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The metric string confirms local attack vector, but once a low-privilege foothold is obtained, escalation is systematic and requires no user interaction.

"AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn't finding more needles. It's critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context." — Satnam Narang, Tenable (via SecurityWeek)

The Numbers Paradox: More CVEs, Same Concentrated Risk

The discrepancy between the 974 total CVEs per Microsoft MSRC and the 966 counted by BleepingComputer is explained by methodology: the latter excludes 204 vulnerabilities patched before Patch Tuesday in Azure, Edge, and other services. The dossier does not clarify whether 966 + 204 linearly equals 974, nor is it necessary to force that reconciliation. What matters is that both sources agree on an unprecedented order of magnitude.

According to BleepingComputer, the Patch Tuesday includes 105 Critical vulnerabilities: 81 RCE, 20 EoP, 2 information disclosure, and 1 security feature bypass. SecurityWeek provides a product breakdown: 723 flaws in Windows and 222 in Office.

Volume does not translate to uniform exposure. Narang, cited by SecurityWeek, draws a sharp distinction: "While the number of vulnerabilities being patched is rising, the number of vulnerabilities that can and will affect most organizations remains quite low." Emphasis on absolute numbers risks scattering operational resources. The 20 wormable CVEs flagged by ZDI — unauthenticated RCE requiring no user interaction — represent an objectively more dangerous attack surface than the majority of patched flaws.

Immediate Actions

Priority actions derive directly from the documented facts:

• Apply patches for CVE-2026-85880 and CVE-2026-81963 immediately: both are in CISA's KEV catalog, which mandates binding timelines for U.S. federal agencies and urges urgency for the private sector.
• Verify critical Servicing Stack Updates (SSU) for Windows Server 2012, 2012 R2, Windows 10 1607, and Server 2016: Microsoft released these as prerequisites for proper installation of subsequent security patches.
• Revise CVE triage prioritization: with 974 entries, cataloging by CVSS severity alone is insufficient; reachability and in-the-wild exploitability must weigh more than abstract scores.
• Monitor Windows systems for anomalous ALPC and Windows Update Stack activity until patching is complete, given confirmed active exploitation without public indicators of compromise.

Why This Month Signals a Shift in Patching

September 2026 is not a record by accident. Accelerated vulnerability discovery, assisted by automated tools, is changing the arithmetic of response: human triage time remains fixed while the denominator grows. The operational consequence is that security teams must abandon the sequential approach — patching by ascending CVE-ID — and adopt risk criteria based on exploitation evidence and exposure profile.

The two local zero-days are functionally less spectacular than an unauthenticated remote RCE, but more insidious: they require an initial foothold but guarantee total system control without friction. In a context where ransomware and infostealers already operate at low privilege, escalation to SYSTEM is the step that turns a containable infection into total compromise. The 20 wormable flaws, meanwhile, keep the door open to automatic propagation scenarios that need no such foothold.

The lesson of the month isn't how big the haystack is, but how to find the needles before someone else does.

Sources

• https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/
• https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/
• https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html
• https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html
• https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep
• https://msrc.microsoft.com/update-guide/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85046
• https://helpx.adobe.com/security/products/magento/apsb26-146.html