Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.
Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.
- Record 974 CVEs, nearly double the prior 570 record from July
- CVE-2026-85880: exploited ALPC heap overflow enabling privilege escalation
- CVE-2026-81963: exploited Update Stack link resolution local EoP flaw
- Surge linked to agentic AI-based vulnerability discovery at Microsoft
- Priority RCEs in Windows DNS, DHCP Server and Deployment Services
- CVEs
- CVE-2026-85880CVE-2026-81963CVE-2026-62878CVE-2026-62823CVE-2026-62893CVE-2026-65789CVE-2026-58231
- Organizations
- Action1
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58231 | Unauthenticated Code Injection RCE in SAP Commerce Cloud | 10.0 | <1% | PoC | |
CVE-2026-62893+3 related CVEs | Pre-auth use-after-free RCE in Microsoft Windows Deployment Services (WDS) | 9.8 group max | 3% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
2 min read at infosecurity-magazine.comThe update contained 119 critical flaws and two zero days, with security teams needing to prioritize updates
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.