Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
Microsoft's September Patch Tuesday fixed a record 974 flaws, including two Windows privilege-escalation zero-days actively exploited and added to CISA's KEV catalog.
Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities (999 including 25 non-Microsoft CVEs), with over 110 rated critical; 723 affect Windows and 111 affect Office. Two Windows privilege-escalation zero-days are actively exploited: CVE-2026-85880, an ALPC heap-based buffer overflow, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack, both allowing attackers to gain SYSTEM privileges. CISA added both flaws to its KEV catalog, giving federal civilian agencies until September 22, 2026 to apply fixes. Volexity, Proofpoint, MSTIC, and independent researchers were credited with the reports; notable additional fixes include network-reachable RCEs in Exchange, SharePoint, SQL Server, Remote Desktop Services, DNS, and DHCP.
- Record 974 Microsoft CVEs patched, over 110 rated critical
- CVE-2026-85880: ALPC heap buffer overflow zero-day granting SYSTEM privileges
- CVE-2026-81963: Windows Update Stack link-resolution flaw, first exploited zero-day there
- CISA KEV patch deadline for federal agencies: September 22, 2026
- Critical RCE flaws patched in Exchange, SharePoint, SQL Server, RDS, DNS, DHCP
- CVEs
- CVE-2026-85880CVE-2026-81963CVE-2026-55007CVE-2026-80097CVE-2026-69465CVE-2026-65669CVE-2026-69525CVE-2026-69595CVE-2026-69730CVE-2026-69829CVE-2026-72979CVE-2023-21674
- Organizations
- MicrosoftCISATenableRapid7Zero Day Initiative
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-21674 | Use-After-Free Privilege Escalation in Microsoft Windows ALPC | 8.8 | 34% | KEV | KEV |
| CVE-2026-55007 | Double Free Enables Unauthenticated RCE in Microsoft Exchange Server | 8.1 | <1% | ||
| CVE-2026-65669 | Injection Flaw in Microsoft SQL Server Enables Network Privilege Escalation | 9.6 | <1% | ||
| CVE-2026-69465 | Missing Authorization Allows Authenticated RCE in Microsoft SharePoint Server | 8.8 | <1% | ||
CVE-2026-69525+3 related CVEs | Use-After-Free RCE in Windows Remote Desktop Services | 9.8 | 1% | ||
| CVE-2026-69595 | Use-After-Free RCE in Windows Services for NFS ONCRPC XDR Driver | 9.8 | 1% | ||
| CVE-2026-80097 | Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation | 8.6 | <1% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
5 min read at thehackernews.com
Microsoft on Tuesday broke Patch Tuesday records by addressing an earth-shattering 974 vulnerabilities spanning its software portfolio, including two flaws that it said have been actively exploited in the wild. These include 723 flaws in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools. Of these, over 110 shortcomings have been assigned a critical severity rating.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.