Microsoft patches a record 972 vulnerabilities, 112 of them critical
Microsoft's September Patch Tuesday fixes a record 972 vulnerabilities, 112 rated critical, including two zero-days in Windows components.
Microsoft's September 2026 release patched roughly 972 vulnerabilities (997 including ported Chromium fixes for Edge), a record, with 112 rated critical. Notable flaws include two zero-days: CVE-2026-81963 in the Windows update service and CVE-2026-85880 in the Windows Advanced Local Procedure, with no public information on exploitation breadth. Microsoft has fixed 2,760 vulnerabilities in 2026, more than double last year's total, which ZDI's Dustin Childs attributes to AI-assisted discovery becoming the 'new normal'.
- 112 of the 972 patched vulnerabilities are rated critical; the rest are rated important.
- Two zero-days: CVE-2026-81963 (Windows update service) and CVE-2026-85880 (Windows Advanced Local Procedure).
- No public information yet on who is exploiting the zero-days or how widely.
- 2026 total of 2,760 fixes exceeds last year by more than 2x; record volume called the 'new normal'.
- Products
- WindowsMicrosoft EdgeChromium
- Organizations
- MicrosoftZero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
2 min read at arstechnica.com
Security gnomes are pumping out patches ahead of an expected onslaught of AI-assisted attacks.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.