Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
Microsoft patched a record 974 vulnerabilities in its September Patch Tuesday, including two actively exploited zero-day flaws in Windows The two zero-days (CVE-2026-85880 and CVE-2026-81963) both enable local privilege escalation to SYSTEM level and have been added to CISA's Known Exploited Vulnerabilities catalog Over 110 flaws received critical severity ratings, with privilege escalation, remote code execution, and information disclosure accounting for nearly 90% of all patched vulnerabilitie
Analysis
TL;DR
- Microsoft patched a record 974 vulnerabilities in its September Patch Tuesday, including two actively exploited zero-day flaws in Windows
- The two zero-days (CVE-2026-85880 and CVE-2026-81963) both enable local privilege escalation to SYSTEM level and have been added to CISA's Known Exploited Vulnerabilities catalog
- Over 110 flaws received critical severity ratings, with privilege escalation, remote code execution, and information disclosure accounting for nearly 90% of all patched vulnerabilities
- Microsoft has patched 2,760 security flaws this year alone, with AI-assisted vulnerability discovery driving an unprecedented surge in disclosed CVEs
- Several high-severity flaws were also addressed, including critical use-after-free and buffer overflow vulnerabilities in Windows Remote Desktop Services, DNS Server, and DHCP Server (all CVSS 9.8)
Why It Matters
This record-breaking patch cycle highlights the accelerating pace of vulnerability discovery in enterprise software, largely driven by AI-assisted security research tools. For AI and security practitioners, it underscores the growing importance of automated vulnerability management and prioritization frameworks to handle the sheer volume of monthly patches. The active exploitation of zero-day flaws in core Windows components also signals that attackers are increasingly targeting privilege escalation paths in widely deployed systems.
Technical Details
- CVE-2026-85880 (CVSS 7.8): Heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC); allows authorized attackers to escape AppContainer sandboxes and escalate to SYSTEM privileges with no user interaction required
- CVE-2026-81963 (CVSS 7.8): Improper link resolution in the Windows Update Stack; enables privilege escalation by following malicious links to overwrite system components with attacker-controlled files
- Notable critical flaws patched: CVE-2026-69525 (RDP use-after-free, CVSS 9.8), CVE-2026-69730 (DNS server use-after-free, CVSS 9.8), CVE-2026-72979 (DHCP Server use-after-free, CVSS 9.8), CVE-2026-65669 (SQL Server injection, CVSS 9.6), and CVE-2026-55007 (Exchange Server double free, CVSS 8.1)
- Patch distribution: 723 Windows flaws, 111 Office/Office 2016 flaws, 62 SQL flaws, 22 Developer Tools flaws, plus 25 non-Microsoft CVEs, totaling 999 resolved vulnerabilities
- Historical context: September's 964 CVEs represent a ~70% increase over the previous record of 569 in July 2026; year-to-date patches (2,760) more than double the previous annual record of 1,245 set in 2020
Industry Insight
- Organizations should prioritize patching the two actively exploited zero-days immediately, especially for Windows systems exposed to untrusted users or low-privilege code execution environments; CISA mandates compliance by September 22, 2026 for federal agencies
- The exponential growth in vulnerability disclosures suggests AI-assisted fuzzing and static analysis tools are becoming mainstream in both offensive and defensive security workflows, and enterprises should invest in AI-driven patch prioritization and exposure management platforms
- The concentration of critical flaws in network-facing services (RDP, DNS, DHCP, Exchange) indicates attackers are focusing on remote code execution paths that require no user interaction, making automated patch deployment and network segmentation essential defense layers
Disclaimer: The above content is generated by AI and is for reference only.