Microsoft breaks Patch Tuesday record with 974-CVE deluge
Microsoft's record 974-CVE Patch Tuesday ships two exploited Windows zero-days, while Adobe's StyleSmuggler zero-day (CVE-2026-75650) gives unauthenticated RCE in Magento.
Microsoft's September Patch Tuesday addresses 974 CVEs, including two zero-days already under exploitation: CVE-2026-85880, a Windows ALPC privilege escalation leading to SYSTEM via sandbox escape, and CVE-2026-81963, a Windows Update Stack privilege escalation. Adobe patched 172 CVEs, including the max-severity StyleSmuggler zero-day CVE-2026-75650 in Magento and Adobe Commerce, which Sansec reports is being exploited since September 4 to inject PHP into templates and install a C2-connected backdoor. CISA added CVE-2026-85880, CVE-2026-81963, and CVE-2026-75650 to its Known Exploited Vulnerabilities Catalog with patch deadlines of September 22 and September 11. The piece also notes Google-patched Chrome V8 zero-day CVE-2026-85046 lacks a Microsoft advisory for Edge, and flags nine Exchange Server flaws including remote unauthenticated RCE CVE-2026-55007.
- Microsoft issued a record 974 patches, with CVE-2026-85880 (ALPC) and CVE-2026-81963 (Update Stack) exploited as zero-days
- StyleSmuggler (CVE-2026-75650) affects Magento/Adobe Commerce 2.4.4-2.4.9; attacks began September 4, backdoor not yet weaponized
- CISA added the zero-days to KEV with federal deadlines of September 11 (Adobe) and September 22 (Microsoft)
- CVE-2026-55007 enables unauthenticated remote RCE on Exchange via malicious Visio attachment during content indexing
- Chrome zero-day CVE-2026-85046 (V8) lacks a Microsoft advisory, leaving Edge patch status unclear
- ATT&CK
- T1068 Exploitation for Privilege EscalationT1190 Exploit Public-Facing ApplicationT1059.004 Command and Scripting Interpreter: PHPT1071.001 Application Layer Protocol: Web Protocols
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-55007 | Double Free Enables Unauthenticated RCE in Microsoft Exchange Server | 8.1 | <1% | ||
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 4% | KEVPoC ×2 | KEV |
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
| CVE-2026-85045 | Race condition in Google Chrome V8 allows sandboxed code execution via crafted web page | 7.5 | <1% | PoC | |
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
From the original article
4 min read at theregister.comAdobe also brought goodies to the patch party and they deserve immediate attention
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.