60
60
Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs
Microsoft's record September 2026 Patch Tuesday fixes 974 CVEs, including two exploited Windows privilege-escalation zero-days and 20 wormable bugs.
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited zero-days: CVE-2026-85880, an ALPC heap buffer overflow, and CVE-2026-81963 in the Windows Update Stack, both CVSS 7.8 local privilege escalations. It also addresses an unauthenticated Exchange RCE (CVE-2026-55007) triggered by Visio attachment content indexing under memory pressure, an RDP use-after-free (CVE-2026-69525, CVSS 9.8), and 20 wormable flaws in DNS, DHCP, SMB, Active Directory, and other components. ZDI attributed the rising volume partly to AI-assisted vulnerability discovery, noting no corresponding spike in active exploits yet.
88
July 2020 Patch Tuesday: Microsoft plugs wormable Windows DNS Server RCE flaw
60
60
60
4 New BlueKeep-like 'Wormable' Windows Remote Desktop Flaws Discovered
60
60
Microsoft plugs wormable RDP flaw, new speculative execution side channel vulnerabilities
60
55
Cisco re-patches wormable Jabber RCE flaw
60
60
60
60
Microsoft fixes critical wormable Windows flaw (CVE-2025-47981)
60
60
60
60
60
‘Wormable’ Flaw Leads January 2022 Patch Tuesday
60
60
60
55
60
60
60
60
60
60
60
60
60
Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
60
60
60
60
October 2020 Patch Tuesday: Microsoft fixes potentially wormable Windows TCP/IP RCE flaw
60
60
60
60