Microsoft posts nearly 1,000 bugs for Patch Tuesday as CISA warns two being exploited
CISA confirms exploitation of two Windows zero-days among 973 Microsoft patches; 22,000 Exchange servers remain unpatched.
Microsoft's September Patch Tuesday sets a record with 973 vulnerabilities, and CISA confirms CVE-2026-81963 and CVE-2026-85880 are being exploited, giving federal agencies until September 22 to patch. Nightwing estimates over 22,000 corporate Exchange servers are unpatched against weaponized exploit code. Analysts describe CVE-2026-81963 as an early link in ransomware chains where phishing leads to privilege escalation, and note year-to-date Microsoft disclosures exceed 2,600 bugs.
- CISA confirms exploitation of both zero-days; federal patch deadline is September 22
- Nightwing estimates 22,000 corporate Exchange servers unpatched against weaponized exploit code
- CVE-2026-81963 seen as early step in ransomware chains via phishing and privilege escalation
- Year-to-date Microsoft disclosures top 2,600, double the previous record year of 2020
- Products
- WindowsExchangeAdobe Commerce
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
1 min read at therecord.mediaThe new record total for Patch Tuesday is 973 vulnerabilities.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.