Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two Windows zero-days exploited in the wild for privilege escalation.
Microsoft patched 974 vulnerabilities, its largest Patch Tuesday ever, including CVE-2026-85880, a heap buffer overflow in Windows ALPC allowing AppContainer sandbox escape to System, and CVE-2026-81963, a link-following flaw in the Windows Update Stack enabling local privilege escalation. Both were exploited as zero-days before the patch. ZDI's Dustin Childs says 20 of the fixed flaws are wormable, enabling unauthenticated remote code execution. The release also covers 723 Windows flaws and 222 Office bugs, plus fixes in Exchange, SharePoint, SQL Server, Azure and Exchange Server RCE (CVE-2026-55007).
- CVE-2026-85880: ALPC heap buffer overflow lets low-privilege AppContainer code escape the sandbox and gain System
- CVE-2026-81963: first zero-day flagged in the Windows Update Stack, allowing local privilege escalation to System
- ZDI estimates 20 newly fixed flaws are wormable via unauthenticated RCE without user interaction
- 723 Windows and 222 Office flaws patched, plus notable RCEs in Exchange, SharePoint and Remote Desktop Services
- Tenable notes AI-assisted discovery is inflating patch counts without adding more exploitable needles
- CVEs
- CVE-2026-85880CVE-2026-81963CVE-2026-55007CVE-2026-80097CVE-2026-69465CVE-2026-65669CVE-2026-69525CVE-2023-21674
- Vendors
- Microsoft
- Organizations
- TenableZero Day InitiativeFortra
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-21674 | Use-After-Free Privilege Escalation in Microsoft Windows ALPC | 8.8 | 34% | KEV | KEV |
| CVE-2026-55007 | Double Free Enables Unauthenticated RCE in Microsoft Exchange Server | 8.1 | <1% | ||
| CVE-2026-65669 | Injection Flaw in Microsoft SQL Server Enables Network Privilege Escalation | 9.6 | <1% | ||
| CVE-2026-69465 | Missing Authorization Allows Authenticated RCE in Microsoft SharePoint Server | 8.8 | <1% | ||
| CVE-2026-69525 | Use-After-Free RCE in Windows Remote Desktop Services | 9.8 | 1% | ||
| CVE-2026-80097 | Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation | 8.6 | <1% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
2 min read at securityweek.com
The record-breaking September security update fixes two exploited privilege-escalation zero-days and 20 potentially wormable vulnerabilities. The post Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.