Microsoft fixes record 964 flaws, including 2 exploited zero-days
Microsoft's September Patch Tuesday fixes a record 964 CVEs, including two actively exploited Windows privilege-escalation zero-days, CVE-2026-81963 and CVE-2026-85880.
Microsoft's September 2026 Patch Tuesday addresses 964 customer-patchable CVEs (104 Critical, 860 Important), the largest release on record, out of 974 total listed. Two actively exploited zero-days are fixed: CVE-2026-81963, a link-following elevation-of-privilege flaw in the Windows Update Stack, and CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape, both with CVSS 7.8. Both zero-days were exploited before a patch was available and grant SYSTEM-level access after an initial foothold. The release also includes high-severity RCE fixes for Windows DNS Server, Remote Desktop Services, Exchange Server, SharePoint, and SQL Server.
- Record 964 customer-patchable CVEs: 104 Critical, 860 Important; 974 total including cloud-only fixes.
- CVE-2026-81963: link-following elevation-of-privilege in Windows Update Stack, actively exploited, CVSS 7.8.
- CVE-2026-85880: Windows ALPC heap overflow lets AppContainer code escape sandbox to SYSTEM, actively exploited.
- High-severity RCE fixes cover Windows DNS Server, RDS, Exchange, SharePoint, SQL Server, and Office.
- Neither zero-day provides remote access alone; both aid post-compromise privilege escalation.
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
3 min read at malwarebytes.com
Microsoft’s September 2026 Patch Tuesday fixes a record 964 vulnerabilities, including two actively exploited zero-days.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.