60
60
Microsoft patches actively exploited MSHTML zero-day RCE (CVE-2021-40444)
60
60
Microsoft Fixes Nine Zero
60
Microsoft Fixes 63 Security Flaws, Including a Windows Kernel Zero
60
60
Microsoft plugs actively exploited zero-day hole (CVE-2023-21674)
60
Microsoft Fixes Two Zero
60
60
Microsoft fixes actively exploited zero-day reported by the NSA (CVE-2022-24521)
60
Microsoft Fixes Five Zero
60
Microsoft patches two actively exploited zero-days (CVE-2024-29988, CVE-2024-26234)
60
Microsoft Fixes Four Zero
60
Microsoft patches four exploited zero-days, but lags with fixes for a fifth (CVE-2023-36884)
60
Three Zero
60
Microsoft fixes exploited WordPad, Skype for Business zero-days (CVE-2023-36563, CVE-2023-41763)
60
Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two Windows zero-days exploited in the wild for privilege escalation.
Microsoft patched 974 vulnerabilities, its largest Patch Tuesday ever, including CVE-2026-85880, a heap buffer overflow in Windows ALPC allowing AppContainer sandbox escape to System, and CVE-2026-81963, a link-following flaw in the Windows Update Stack enabling local privilege escalation. Both were exploited as zero-days before the patch. ZDI's Dustin Childs says 20 of the fixed flaws are wormable, enabling unauthenticated remote code execution. The release also covers 723 Windows flaws and 222 Office bugs, plus fixes in Exchange, SharePoint, SQL Server, Azure and Exchange Server RCE (CVE-2026-55007).
85
60
Week in review: Palo Alto Networks firewalls under attack, Microsoft patches two exploited zero-days
60
Microsoft fixes record 964 flaws, including 2 exploited zero-days
Microsoft's September Patch Tuesday fixes a record 964 CVEs, including two actively exploited Windows privilege-escalation zero-days, CVE-2026-81963 and CVE-2026-85880.
Microsoft's September 2026 Patch Tuesday addresses 964 customer-patchable CVEs (104 Critical, 860 Important), the largest release on record, out of 974 total listed. Two actively exploited zero-days are fixed: CVE-2026-81963, a link-following elevation-of-privilege flaw in the Windows Update Stack, and CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape, both with CVSS 7.8. Both zero-days were exploited before a patch was available and grant SYSTEM-level access after an initial foothold. The release also includes high-severity RCE fixes for Windows DNS Server, Remote Desktop Services, Exchange Server, SharePoint, and SQL Server.
86
Largest Patch Tuesday since July includes two exploited in the wild, three critical vulnerabilities
60
60
60
60
US CISA adds MS Exchange bug CVE-2022-41080 to its Known Exploited Vulnerabilities Catalog
60
Microsoft Fixes 90 New Flaws, Including Actively Exploited NTLM and Task Scheduler Bugs
60
60
Microsoft fixes exploited zero-day (CVE-2024-49138)
60
Microsoft plugs 56 vulns, including Office flaw exploited in attacks
60
Microsoft patches actively exploited Windows zero-day (CVE-2021-40449)
60
Week in review: Windows kernel flaw patched, suspected Fortinet FortiWeb zero-day exploited
60
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
Microsoft's September Patch Tuesday fixed a record 974 flaws, including two Windows privilege-escalation zero-days actively exploited and added to CISA's KEV catalog.
Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities (999 including 25 non-Microsoft CVEs), with over 110 rated critical; 723 affect Windows and 111 affect Office. Two Windows privilege-escalation zero-days are actively exploited: CVE-2026-85880, an ALPC heap-based buffer overflow, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack, both allowing attackers to gain SYSTEM privileges. CISA added both flaws to its KEV catalog, giving federal civilian agencies until September 22, 2026 to apply fixes. Volexity, Proofpoint, MSTIC, and independent researchers were credited with the reports; notable additional fixes include network-reachable RCEs in Exchange, SharePoint, SQL Server, Remote Desktop Services, DNS, and DHCP.
85
60
60
60
Microsoft patches two zero-days exploited in the wild (CVE-2024-43573, CVE-2024-43572)
60
Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053)
60
Week in review: AnyDesk phishing campaign targets employees, Microsoft fixes exploited zero-days
60
60