Microsoft Releases Record September Patch Tuesday Fixing 900+ Flaws Including Two Exploited Zero-Days

Microsoft has released its largest Patch Tuesday security update to date, addressing over 900 vulnerabilities across Windows and other products, including two privilege-escalation flaws that attackers were already exploiting before fixes became available.

The unprecedented September 2026 release contains 105 vulnerabilities classified as Critical, including dozens of weaknesses capable of enabling remote code execution. Hundreds of additional flaws could allow attackers to elevate privileges, disclose sensitive information, bypass security protections, impersonate trusted entities or disrupt affected systems.

The two actively exploited zero-days, tracked as CVE-2026-81963 and CVE-2026-85880, affect fundamental Windows components and could allow attackers who already have some access to a device to obtain SYSTEM-level privileges. SYSTEM is one of the most powerful security contexts in Windows and can give an attacker extensive control over the operating system.

Microsoft has not disclosed the identities of the threat actors exploiting the vulnerabilities, the scale of the attacks or the malware associated with the campaigns. The absence of those details means organizations should not assume that exploitation has been limited to narrowly targeted operations.

The September update surpasses Microsoft’s previous record-breaking Patch Tuesday releases in June, July and August, highlighting how the rapid adoption of artificial intelligence-assisted vulnerability research is changing both software security and enterprise patch management.

Two Windows zero-days exploited before patches were available

The most urgent vulnerabilities in the September release are two local privilege-escalation flaws that Microsoft has confirmed were exploited in real-world attacks.

The first, CVE-2026-81963, affects the Windows Update Stack—the collection of components responsible for installing, servicing and maintaining Windows updates.

Microsoft attributed the vulnerability to improper link resolution before file access, a weakness commonly described as “link following.” These vulnerabilities can arise when a privileged process accesses a file path without adequately verifying whether the path has been redirected through a symbolic link, junction or another filesystem mechanism.

An authorized local attacker could exploit the flaw to manipulate file operations performed by the Windows Update Stack and elevate their privileges to SYSTEM.

The vulnerability does not appear to provide an unauthenticated route into a Windows device. Instead, it would most likely be used after an attacker had obtained an initial foothold through phishing, stolen credentials, malicious documents, another software vulnerability or an existing malware infection.

That limitation does not make the flaw insignificant. Privilege-escalation vulnerabilities frequently serve as the second stage of a broader attack chain. Malware initially executing with the rights of an ordinary user may face restrictions imposed by Windows access controls, security software and application sandboxes. Obtaining SYSTEM privileges can allow it to disable protections, access other users’ data, alter protected files, install persistent services and interfere with security monitoring.

Microsoft credited Romain Deperne and the Microsoft Threat Intelligence Center with discovering or reporting CVE-2026-81963. The company has not explained how the vulnerability was being exploited or identified the organizations targeted in the attacks.

The second exploited zero-day, CVE-2026-85880, is a heap-based buffer overflow in Windows Advanced Local Procedure Call, commonly known as ALPC.

ALPC is an internal Windows communication mechanism used by processes and operating-system components to exchange information. Because these communications often cross boundaries between applications, services and security contexts, vulnerabilities in ALPC can become valuable tools for attackers seeking to escape a restricted process or elevate privileges.

According to Microsoft, an authorized attacker who successfully exploits CVE-2026-85880 can gain SYSTEM privileges locally. Heap-based buffer overflows occur when a program writes more data into an allocated memory region than the region can safely contain, potentially corrupting adjacent memory and altering the program’s execution.

Volexity and researchers Mark Kelly, David Galazin and Jeremy Hedges of Proofpoint were credited with discovering the ALPC vulnerability. Microsoft has not released technical details about the observed attacks, and the researchers had not published a detailed account of the exploitation at the time of the update.

The involvement of incident-response and threat-intelligence organizations suggests the vulnerability may have been identified during the investigation of active compromises, although that remains an inference rather than a confirmed description of the discovery.

September release contains more than 100 Critical vulnerabilities

Of the vulnerabilities included in the September Patch Tuesday release, Microsoft classified 105 as Critical.

The Critical group is dominated by remote-code-execution vulnerabilities, with 81 flaws placed in that category. The release also includes 20 Critical elevation-of-privilege vulnerabilities, two Critical information-disclosure weaknesses and at least one Critical security-feature bypass.

Across all severity levels, the update reportedly addresses approximately 438 elevation-of-privilege vulnerabilities, 258 remote-code-execution flaws, 173 information-disclosure weaknesses, 56 denial-of-service vulnerabilities, 19 security-feature bypasses and 16 spoofing issues.

Category totals should be treated as approximate because different security companies use different counting methodologies. Some count individual CVE identifiers, while others count affected products, separate operating-system versions, advisory records or vulnerabilities fixed in cloud services earlier in the month. A single vulnerability can also affect multiple products or fall into more than one operational risk category.

Remote-code-execution flaws demand careful prioritization

Although the two actively exploited zero-days deserve immediate attention, organizations should not overlook the large number of remote-code-execution vulnerabilities included in the release.

Remote-code-execution flaws can allow an attacker to run commands or malicious code on a vulnerable system. The exact risk depends on the affected component, whether authentication or user interaction is required, the privileges obtained after exploitation and whether the vulnerable service is exposed to the internet.

Some remote-code-execution vulnerabilities may require a user to open a malicious file, follow a link or interact with attacker-controlled content. Others may be reachable through network services or enterprise servers and could potentially be exploited without direct user involvement.

Security teams should therefore avoid prioritizing vulnerabilities solely by severity labels or CVSS scores. A Critical flaw in a component that is disabled or isolated may pose less immediate danger to a particular organization than an Important-rated weakness that is being actively exploited on thousands of exposed endpoints.

The September release creates a significant triage challenge because very few organizations can test and deploy nearly 1,000 fixes simultaneously across every affected system. Defenders will need to combine Microsoft’s exploitability assessments with asset inventories, exposure data, threat intelligence and information about the business importance of affected systems.

Internet-facing servers, domain-connected Windows systems, administrator workstations, remote-access infrastructure and devices used by high-value personnel should generally receive early attention. Systems lacking endpoint monitoring or operating outside standard management platforms may also warrant accelerated treatment.

A summer of record-breaking Microsoft security releases

The scale of the September update follows a series of unusually large security releases.

In June, Microsoft addressed approximately 200 vulnerabilities. The total rose sharply in July, when different counting methodologies produced figures ranging from around 570 to more than 620 vulnerabilities.

August brought another extensive release. Microsoft published 421 vulnerabilities during August Patch Tuesday, including 236 Windows vulnerabilities and one flaw known to have been exploited in the wild.

September has now exceeded those releases by a considerable margin.

Microsoft’s Windows and security engineering teams have been contending with an accelerating flow of vulnerability discoveries produced partly by advanced AI security models. The publication reported that AI systems developed by Anthropic and OpenAI contributed to the unusually high number of weaknesses identified across Microsoft products.

AI-assisted security research can analyse large codebases, trace complex data flows, identify suspicious memory-management patterns and generate potential test cases far faster than many traditional manual processes. Advanced models can also help researchers compare patched and unpatched software versions, reason about potential attack paths and, in some cases, develop working demonstrations of newly disclosed vulnerabilities.

This does not necessarily mean that Microsoft’s software suddenly became less secure. A sharp rise in reported vulnerabilities can also mean that previously hidden defects are being discovered and repaired more efficiently.

However, the acceleration creates new pressure on both software vendors and customers. Microsoft must reproduce findings, assess severity, develop fixes, test them across supported platforms and coordinate release schedules. Customers must then determine which patches apply to their environments, test them against critical applications and deploy them before attackers reverse-engineer the updates.

Uncover full campaigns from one IOC in seconds. Speed up triage, hunting, and response with TI Lookup 👇🏻

AI is narrowing the window between disclosure and exploitation

Patch Tuesday updates have always created a race between defenders and attackers. Once a security update is published, researchers and threat actors can compare the patched software with the previous version to determine what changed.

This process, known as patch diffing, can reveal the code responsible for a vulnerability even when a vendor releases only limited technical information. Attackers can then use those findings to develop exploits targeting organizations that have not yet deployed the update.

AI may shorten that process considerably. Models capable of analysing binaries, source code, crash data and update packages could help identify vulnerable functions and develop potential exploit paths in hours rather than days or weeks.

The result is a shrinking “patch gap”—the period between a vendor releasing a fix and an organization successfully deploying it.

Enterprises cannot always install updates immediately. Security teams may need to test patches against bespoke applications, industrial systems, authentication platforms and business-critical services. Large organizations may also have to coordinate maintenance windows across thousands of endpoints in multiple countries.

Yet extended testing periods can leave vulnerable systems exposed precisely when public awareness of the flaws is at its highest. The risk is particularly acute for internet-facing products, remote-access systems and vulnerabilities that require little or no user interaction.

The two September zero-days demonstrate that attackers do not always wait for public disclosure. Both were already being exploited before Microsoft released patches, making immediate remediation and retrospective threat hunting necessary.

Patching alone may not remove an existing compromise

Installing Microsoft’s September updates closes the vulnerabilities but does not determine whether attackers previously exploited them.

Organizations should review endpoint, authentication and security telemetry for signs of suspicious activity preceding the September 8 release. Systems that show unexplained privilege escalation, newly created services, altered update-related files, unusual child processes or security-control tampering may require deeper investigation.

Because both zero-days provide local privilege escalation rather than initial remote access, defenders should look for evidence of an earlier entry point. Relevant indicators may include phishing activity, malicious Office documents, browser exploitation, stolen session tokens, unauthorized remote-management tools or malware running initially under a standard user account.

Security teams should also monitor for processes unexpectedly obtaining SYSTEM privileges and examine whether endpoint-protection agents, event logging or Windows security services were disabled. Privileged account use following an unusual process launch should receive additional scrutiny.

Where evidence of exploitation is discovered, applying the patch should be considered only one part of the response. Organizations may need to isolate the endpoint, collect forensic evidence, reset credentials, invalidate active sessions, examine lateral movement and rebuild systems where their integrity can no longer be trusted.

Enterprises face a major patch-management test

Microsoft’s September release is likely to test the limits of enterprise vulnerability-management programmes.

Organizations should begin by confirming that asset inventories accurately identify supported Windows versions and other affected Microsoft products. Security teams can then correlate the vulnerabilities with actual deployment data instead of attempting to treat every advisory as equally relevant.

The two exploited zero-days should receive the highest priority on affected Windows systems. Critical remote-code-execution vulnerabilities should then be assessed according to network exposure, authentication requirements, exploit complexity and the importance of the affected assets.

Pilot deployments can help detect compatibility problems before updates are distributed broadly, but testing should be time-limited and based on risk. Organizations should establish clear escalation procedures for actively exploited vulnerabilities so that emergency updates are not delayed by approval processes designed for routine maintenance.

Unsupported and end-of-life products present a separate concern. Devices that cannot receive current security updates should be upgraded, isolated, protected through compensating controls or removed from service. Allowing legacy systems to remain broadly accessible increases the chance that attackers can use them as an entry point into the wider network.

Administrators should obtain updates through Windows Update, Windows Server Update Services, Microsoft Intune, the Microsoft Update Catalog or other approved enterprise-management platforms. Updates should be verified in accordance with the organization’s existing change-control and software-integrity procedures.

Record patch volume marks a change in the security landscape

The September 2026 Patch Tuesday release is significant not only because of its size, but because it may signal a permanent change in how vulnerabilities are discovered and remediated.

AI-assisted research is allowing vendors and security researchers to examine software at a scale that would have been difficult to achieve manually. That could ultimately improve security by identifying more vulnerabilities before criminal groups or state-backed attackers find them.

At the same time, the same capabilities can help adversaries analyse patches, locate vulnerable systems and accelerate exploit development. Organizations may therefore face larger update releases and less time to test and deploy them safely.

For Microsoft customers, the immediate priority is clear: identify systems affected by CVE-2026-81963 and CVE-2026-85880, deploy the relevant September updates and investigate for evidence that attackers may already have used the flaws.

The broader lesson is more challenging. Monthly patching cycles built around dozens of vulnerabilities may no longer be sufficient when vendors are disclosing hundreds at a time. Enterprises will increasingly need automated asset discovery, continuous exposure monitoring, risk-based prioritization and faster emergency-patching procedures to keep pace with an AI-accelerated vulnerability landscape.