Microsoft's biggest Patch Tuesday ever: 974 fixes, two live zero-days
Microsoft’s biggest Patch Tuesday ever: 974 fixes, two live zero-days
Section titled “Microsoft’s biggest Patch Tuesday ever: 974 fixes, two live zero-days”Microsoft shipped its largest security update ever on September 8, 2026(The Hacker News). The September batch covers 974 vulnerabilities across Windows, Office, SQL Server, and developer tools(The Hacker News). Vendors report different totals because they count different scopes. Malwarebytes counts 964 customer-patchable flaws, with 104 rated critical and 860 rated important(Malwarebytes). Two of those flaws are already exploited in the wild. This is not a “patch everything today” story. It is a triage story.
Patch these two first: the zero-days
Section titled “Patch these two first: the zero-days”Both exploited flaws are local privilege-escalation bugs. Each lets an attacker who already has a foothold climb to SYSTEM(Malwarebytes). SYSTEM access turns one compromised account into full machine control. Neither flaw gives remote access by itself, but both remove the last barrier between a beachhead and domain-wide movement(Malwarebytes).
CVE-2026-85880 — Windows ALPC. This is a heap-based buffer overflow in Windows Advanced Local Procedure Call (CVSS 7.8(The Hacker News). Microsoft says an attacker who can run code in a low-privilege AppContainer can exploit the flaw locally, escape the sandbox, and elevate privileges on the affected system(The Hacker News). No additional user interaction is required(The Hacker News). Volexity and Proofpoint reported the bug(The Hacker News).
CVE-2026-81963 — Windows Update Stack. This is an improper link resolution (“link following”) flaw, CVSS 7.8(The Hacker News). The stack can follow a malicious link and overwrite a system component with an attacker-controlled impostor(The Hacker News). Per Tenable, this is the first Windows Update Stack privilege-escalation flaw exploited as a zero-day since 2022(The Hacker News). All supported Windows versions receive a patch(The Hacker News). An Airbus Helicopters researcher and Microsoft Threat Intelligence Center reported the flaw(The Hacker News).
CISA has already moved. Both CVEs sit on CISA’s Known Exploited Vulnerabilities catalog(The Hacker News). US federal civilian agencies must apply the fixes by September 22, 2026(The Hacker News). Private-sector teams should treat that date as a floor, not a ceiling.
The server-side fixes that deserve the next slot
Section titled “The server-side fixes that deserve the next slot”Microsoft patched nine Exchange Server vulnerabilities this month(Petri). One of them, CVE-2026-55007 is a double-free flaw that lets an unauthenticated attacker run code over a network(The Hacker News). An email with a malicious Visio attachment can trigger it(Petri). That is an email-delivered unauthenticated RCE against a mail server. Patch Exchange before anything else in the messaging path.
SQL Server carries a 9.6-CVSS injection flaw, CVE-2026-65669(Petri). An unauthorized attacker can elevate privileges over a network when a user submits instructions through SQL Copilot(Petri). The AI assistant becomes an attack path. Remote Desktop Services carries a 9.8-CVSS RCE bug, CVE-2026-69525(Petri). SharePoint carries an 8.8 authorization flaw that attackers can use to execute code over an enterprise network(Petri).
Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, said many of the disclosed flaws have “wormable” properties( They need zero user interaction and can jump across network-connected hardware(Times of India).
Why the list exploded
Section titled “Why the list exploded”The September count tops every previous Patch Tuesday(Malwarebytes). More than 110 of the flaws carry critical severity ratings(The Hacker News). Microsoft counted 161 fixed flaws in May, 220 in June, 663 in July, and 457 in August(The Hacker News).
Dustin Childs says AI-assisted discovery is a big part of the trend: “AI-assisted vulnerability discovery shows no signs of slowing down” (CyberScoop). He adds a caveat:“However, we have not seen a correlating spike in active exploits —yet” (CyberScoop).
Jack Bicer, director of vulnerability research at Action1, said:“At this scale, the challenge is not simply getting through the patch list but knowing what needs attention first” (The Hacker News).
The triage order for your team
Section titled “The triage order for your team”1.Patch the KEV zero-days first. Apply Windows updates that cover CVE-2026-85880 and CVE-2026-81963 on every endpoint. The September 22 deadline binds federal agencies, but adopt it as the industry tempo(The Hacker News).
2.Inventory exposure before you schedule. Find every Exchange Server, SQL Server, Remote Desktop host, and SharePoint farm. An unauthenticated RCE in any of them is emergency-class(Petri).
3.Batch Exchange and SQL Server fixes into planned windows. CVE-2026-55007 rides in via an email, so one malicious message can reach an unpatched server(Petri). Schedule with rollback plans and test paths for both services(Petri).
4.Watch exploitation chatter, not just patch status. The fix volume is rising faster than observed exploitation(CyberScoop). Track CISA’s KEV catalog plus your EDR telemetry for post-patch attempts(The Hacker News).
5.Gate your AI assistants’ data-store access. SQL Copilot is a new instruction path into SQL Server(Petri). Audit which AI tools can reach production data stores, and apply least privilege to their actions(Petri).
Bottom line
Section titled “Bottom line”September’s Patch Tuesday is the largest on record(Malwarebytes). Two zero-days are live now,and server-side RCEs crowd the queue(The Hacker News). Teams that win this month triage by exposure, not by list length. Patch the two exploited privilege bugs first. Then close Exchange, SQL Server, RDS, and SharePoint. Then watch for the next wave(CyberScoop).