Microsoft's September 2026 Patch Tuesday: A Record Patch Load and Two Exploited Zero-Days

Marcus Chen Staff Engineer (Backend & Cloud), YuSMP Group · Hardens enterprise and cloud stacks for US and EU teams

The short version

What Microsoft shipped on September 8

Microsoft's monthly security release on September 8, 2026 set a new record for a single Patch Tuesday. The exact figure depends on who is counting — SecurityWeek and CyberScoop tallied 974 CVEs, while BleepingComputer put it at 966, the difference coming down to how bundled Edge, Azure and Linux-based Mariner advisories are folded in. Whichever number you use, it is the biggest monthly batch Microsoft has ever shipped, and more than 100 of the flaws are rated Critical, the large majority of them remote code execution.

Two of the vulnerabilities stand apart because they are already being exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in the Windows Advanced Local Procedure Call (ALPC) subsystem. Both are elevation-of-privilege bugs rated CVSS 7.8, and both let an attacker who is already running code on a machine escalate to full SYSTEM control. That distinction — exploited, but local — is the single most important thing to understand before you plan your rollout, because it is not where the internet-facing danger lives.

For organizations that run Windows as the backbone of their enterprise software estate, the practical challenge is no longer “is there a scary bug this month.” There always is. It is separating the handful of vulnerabilities that demand action tonight from the hundreds that can wait for the normal deployment train — and this month that sorting job is harder than usual precisely because the record volume buries the few that matter.

The two exploited zero-days, in context

CVE-2026-81963 is an improper link-resolution flaw — a “link following” bug — in the Windows Update Stack. By planting a crafted symbolic link before a file operation, a local attacker can redirect a privileged action and gain SYSTEM rights. CVE-2026-85880 is a heap buffer overflow in ALPC, the internal messaging channel Windows components use to talk to each other; overflowing it lets a local attacker corrupt memory and, again, land at SYSTEM. Both carry a CVSS base score of 7.8, and both are confirmed exploited in the wild.

Here is why that 7.8 is not a 9-something: neither bug can be triggered remotely, and neither works without valid access to the machine first. In an attack chain they are the second move, not the first — the privilege-escalation link an intruder reaches for after phishing a laptop, landing through a different exploit, or abusing stolen credentials. That does not make them safe to ignore. Local EoP zero-days are the workhorses of real intrusions, turning a foothold on one endpoint into domain-wide leverage. It means your priority for them is broad endpoint coverage, not a firewall scramble.

The nuance matters because coverage headlines that lead with “two exploited zero-days” can steer teams into hardening the wrong perimeter. The zero-days are an argument for getting the September cumulative update onto every workstation and server quickly and completely. The perimeter argument is a different set of CVEs entirely.

The bugs that actually need an emergency window

Dustin Childs of Trend Micro's Zero Day Initiative flagged around 20 vulnerabilities in this release that could enable wormable remote code execution — exploitable over the network, without authentication, in a way that could let malware spread machine to machine on its own. None of those are confirmed exploited yet, but they are the profile attackers reverse-engineer from the patch within days, and “wormable” is the word that turns a single compromise into an outbreak.

The names on that list are exactly the ones that keep security teams up at night because they so often sit at the edge: remote code execution in Microsoft Exchange Server (CVE-2026-55007), in SharePoint (CVE-2026-69465), and in Remote Desktop Services (CVE-2026-69525). On-premises Exchange and SharePoint have been among the most reliably attacked enterprise systems of the last several years, and exposed RDP remains a top ransomware entry point. A SQL Server elevation-of-privilege bug (CVE-2026-65669) rounds out the set of components that deserve early attention.

So the honest priority order inverts the headline. Patch the unauthenticated, network-reachable RCEs on any internet-facing Exchange, SharePoint or Remote Desktop first — those are the ones that can be weaponized into self-propagating attacks. The two exploited local zero-days come next, across the fleet. Everything else follows on the standard cadence. If you cannot immediately say which of your Windows servers terminate untrusted traffic, that inventory gap is now the most urgent item on the list.

Why the numbers keep breaking records

Record Patch Tuesdays are becoming routine, and the reason researchers keep pointing to is AI-assisted vulnerability discovery. Fuzzing and code analysis augmented by large models surface far more candidate bugs than manual review ever did, and that flood is showing up directly in Microsoft's monthly totals. The question for defenders is whether more reported bugs means proportionally more danger.

The researchers who track this closely say no. “AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but isn't finding more needles,” Tenable's Satnam Narang noted — more CVEs, but not a matching rise in the ones attackers actually turn into working exploits. Childs made a similar point from the ZDI side: the discovery pace shows no sign of slowing, yet there has not been a correlating spike in active exploitation. As Action1's Jack Bicer framed the operational reality, with hundreds of updates landing at once, teams have to quickly separate the vulnerabilities that demand immediate action from those that can follow the normal deployment cycle.

That is the strategic shift hiding inside a big number. When the monthly total was 60 or 80, reading every advisory was feasible. At ~970, a “patch everything, read everything” posture doesn't scale, and teams that try either burn out or fall behind. The winning move is a repeatable triage process that ranks by exploitability and exposure, not by CVSS alone — and that is a process question as much as a security one.

What it means for US & EU teams

First, treat record volume as a prioritization test, not a workload. The value your team adds this week is not applying 974 fixes on day one; it is correctly identifying the ten or twenty that cannot wait. That means maintaining a live map of which Windows systems are internet-facing, which run Exchange, SharePoint or RDP, and which hold your most sensitive data — then patching those first. Organizations that lack that map spend the emergency arguing about scope instead of shipping fixes.

Second, mind the gap between “exploited” and “urgent for you.” The two zero-days are exploited, but if your endpoint patching is disciplined they fold into your normal cumulative-update rollout. The wormable RCEs are not yet exploited, but for a company running an on-prem Exchange server on the public internet, one of them is the more dangerous line item. Reading severity in the context of your own exposure — not the news headline — is the whole skill.

Third, use this cycle to check the unglamorous fundamentals that decide whether patching actually protects you: an accurate asset inventory with real-time patch levels, confirmation that an update is installed and not merely downloaded, and the smallest possible internet-facing footprint. Many teams close the month's marquee CVE and never notice the forgotten server that made it reachable. For companies that run critical Windows infrastructure but don't keep a dedicated security-engineering bench, a short, focused external review of the attack surface — run by engineers who understand both the Windows stack and the network in front of it — turns a monthly fire drill into a process you can trust.

A triage-and-patch checklist

1. Find the edge first. List every internet-facing Windows system and flag anything running Exchange, SharePoint or Remote Desktop Services.
2. Patch the wormable RCEs now. Prioritize CVE-2026-55007 (Exchange), CVE-2026-69465 (SharePoint) and CVE-2026-69525 (RDS) on exposed hosts — these are the unauthenticated, self-propagating risks.
3. Roll the cumulative update fleet-wide. The two exploited zero-days (CVE-2026-81963, CVE-2026-85880) are local EoP — cover every workstation and server, not just the edge.
4. Verify, don't assume. Confirm the September update is actually applied and active on each system, not just staged for a later window.
5. Shrink RDP exposure. Put Remote Desktop behind a VPN or gateway and remove any direct public exposure you don't strictly need.
6. Queue the rest by exposure. Work the remaining 100+ Critical fixes on the normal cadence, ranked by internet reachability and data sensitivity — not CVSS in isolation.

Frequently asked questions

Sources

SecurityWeek — Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days (September 8, 2026)
CyberScoop — Microsoft discloses two actively exploited zero-days among 974 vulnerabilities (September 8, 2026)
BleepingComputer — Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days (September 8, 2026)
Zero Day Initiative — The September 2026 Security Update Review (September 8, 2026)