--- title: Microsoft's September 2026 Patch Tuesday fixes 974... description: Microsoft's September 2026 Patch Tuesday is the largest single patch release in company history, fixing between 964 and 974 CVEs, surpassing July's record of... canonical: https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited zero-days | daily.dev og:description: Microsoft's September 2026 Patch Tuesday is the largest single patch release in company history, fixing between 964 and 974 CVEs, surpassing July's record of... og:url: https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7 og:image: https://api.daily.dev/og/posts/b8aoT91D7.png og:image:alt: Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited zero-days og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited zero-days **[Collections](https://daily.dev/sources/collections)** · 4 min read · 1 upvotes · 0 comments ## Summary Microsoft's September 2026 Patch Tuesday is the largest single patch release in company history, fixing between 964 and 974 CVEs, surpassing July's record of 570. Two zero-days are under active exploitation: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (Windows ALPC EoP), both privilege escalation bugs suggesting attackers already have footholds. Other critical flaws include a CVSS 9.8 Windows DNS Server RCE, a CVSS 9.8 Windows Shell RCE, a CVSS 9.8 Remote Desktop Services RCE, an 8.8 Kerberos RCE, and an Exchange Server elevation of privilege bug. Elevation of privilege made up nearly 45% of patches and RCE about 27%. Researchers point to AI-assisted vulnerability discovery as a driver behind rising patch volumes across Microsoft, Adobe, Cisco, Google, Mozilla, and Oracle, with Google moving to biweekly security updates in response. Tenable recommends prioritizing the two zero-days plus the CVSS 9.8 RCE flaws, especially those touching DNS, RDS, and Exchange. ## Content Microsoft's September 2026 Patch Tuesday is the largest single patch release in the company's history. Depending on how you count, the total sits somewhere between 964 and 999 CVEs — the spread comes down to whether you include the 25 third-party vulnerabilities Microsoft bundled in alongside its own 974. Either way, it blows past July's previous record of 570 and August's 620, and brings Microsoft's 2026 running total to roughly 2,760 patched vulnerabilities — more than double last year's full-year count. ## The two zero-days being actively exploited Two privilege escalation flaws are confirmed as exploited in the wild: **CVE-2026-85880** — A heap overflow in Windows ALPC (Advanced Local Procedure Call) that enables sandbox escape. CVSS 7.8. Notably, it doesn't affect Windows Server 2025 or Windows 11, which researchers attribute to Rust rewrites of certain kernel components — a small but interesting data point about where memory-safe rewrites are actually paying off. **CVE-2026-81963** — A Windows Update Stack elevation-of-privilege flaw affecting all supported Windows versions. Also CVSS 7.8. Both are local privilege escalation bugs, meaning an attacker needs existing access to a machine before they can use them. That limits the blast radius somewhat, but they're the kind of flaws that get chained with other exploits, so patching promptly matters. ## Other high-severity flaws worth flagging **CVE-2026-69730** — A Windows DNS Server remote code execution flaw with a CVSS of 9.8. Researchers are comparing it to SigRed, the 2020 wormable DNS bug. It requires no authentication and could spread automatically across networks. This one should be near the top of any patching queue. **CVE-2026-69829** — A Windows Shell RCE, also CVSS 9.8. **CVE-2026-69525** — Remote Desktop Services RCE, CVSS 9.8. **CVE-2026-69676** — Windows Kerberos RCE, CVSS 8.8. **CVE-2026-69380** — Exchange Server elevation of privilege. Additionally, researchers flagged wormable candidates in Windows Deployment Services TFTP and RRAS. Of the 974 Microsoft CVEs, 104–113 are rated critical (the range varies by source) and elevation-of-privilege bugs make up roughly 45% of the total, with remote code execution at around 27%. ## One Edge oddity Microsoft Edge patched an actively exploited Chromium V8 zero-day (CVE-2026-85046) a full day before Chrome did — which is unusual. What's stranger is that nearly a week later, Microsoft still hadn't published a security advisory for it, leaving the status of 11 other Chrome-patched CVEs in Edge unclear. ## Why the numbers keep climbing Zero Day Initiative researcher Dustin Childs has called this the "new normal." The leading explanation is AI-assisted vulnerability discovery: automated tools can now find bugs at a scale and speed that human researchers can't match. Microsoft has said it's using AI internally for this purpose, and other vendors are seeing the same trend — Adobe, Cisco, Google, Mozilla, and Oracle have all had unusually large patch releases recently. Google has moved to biweekly security updates to keep pace. Two weeks before this Patch Tuesday, OpenAI, Anthropic, AWS, Google, Microsoft, and over 100 other organizations signed an open letter warning that the window to patch before AI-enabled attacks begin exploiting flaws at scale is narrowing. The practical problem for IT teams is that bigger patch batches mean more testing overhead, even if the proportion of truly dangerous flaws stays roughly constant. As one researcher put it: more hay in the haystack, not necessarily more needles. ## Elsewhere in September patching **Adobe** patched an actively exploited zero-day in Commerce and Magento, tracked as StyleSmuggler. **Fortinet** confirmed exploitation of older FortiOS authentication bypass vulnerabilities. **SAP** patched two critical, unauthenticated, network-reachable vulnerabilities: one in ABAP's Extended Passport Processing (dubbed OVERPASS) and one in NetWeaver Message Server (S4GET), both affecting all modern SAP kernels. **Cisco** and **Red Hat** also fixed critical flaws this cycle. ## Upcoming lifecycle deadlines October 14, 2026 brings several end-of-life milestones worth noting: - Windows 11 24H2 Home and Pro reach end of servicing - Windows Server 2022 moves to extended support - Windows Server 2012/2012 R2 lose Extended Security Update eligibility - Office 2021 reaches end of support - Exchange Server 2016/2019 lose ESU eligibility If any of those are still running in your environment, the clock is ticking. ## Questions this post answers ### What are the two actively exploited zero-days in Microsoft's September 2026 Patch Tuesday? CVE-2026-81963, a Windows Update Stack elevation of privilege bug, and CVE-2026-85880, a Windows ALPC elevation of privilege bug, both rated CVSS 7.8. Both are privilege escalation flaws, meaning attackers likely already have a foothold on a system and are using these vulnerabilities to escalate to SYSTEM-level access. _Security teams tracking active exploits can follow zero-day disclosures like these on daily.dev._ ### How many vulnerabilities did Microsoft fix in September 2026 Patch Tuesday compared to previous records? Microsoft fixed between 964 and 974 CVEs depending on counting method, making it the largest single patch release in company history and surpassing the previous record of 570 set in July 2026. Roughly 104 to 113 of the fixes are rated critical, with elevation of privilege bugs making up nearly 45% of patches and remote code execution about 27%. _Teams triaging huge patch batches each month can track Patch Tuesday trends on daily.dev._ ### Which Windows vulnerabilities from September 2026 Patch Tuesday should be prioritized first? Tenable recommends prioritizing the two actively exploited zero-days plus the CVSS 9.8 remote code execution flaws: CVE-2026-69730 (Windows DNS Server RCE), CVE-2026-69829 (Windows Shell RCE), and CVE-2026-69525 (Remote Desktop Services RCE), along with the CVSS 8.8 Kerberos RCE (CVE-2026-69676) and an Exchange Server elevation of privilege bug (CVE-2026-69380). _Admins prioritizing patch rollouts can find critical CVE breakdowns like these on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#windows](https://daily.dev/tags/windows), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited zero-days","url":"https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7"},"datePublished":"2026-09-08T21:47:47.042Z","dateModified":"2026-09-09T03:53:01.275Z","description":"Microsoft's September 2026 Patch Tuesday is the largest single patch release in company history, fixing between 964 and 974 CVEs, surpassing July's record of...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccf336b82b59c78ffb1066a273b4c530?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccf336b82b59c78ffb1066a273b4c530?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft,windows,zero-day","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited zero-days"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/microsoft-s-september-2026-patch-tuesday-fixes-974-vulnerabilities-including-two-actively-exploited-b8aot91d7#faq","mainEntity":[{"@type":"Question","name":"What are the two actively exploited zero-days in Microsoft's September 2026 Patch Tuesday?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-81963, a Windows Update Stack elevation of privilege bug, and CVE-2026-85880, a Windows ALPC elevation of privilege bug, both rated CVSS 7.8. Both are privilege escalation flaws, meaning attackers likely already have a foothold on a system and are using these vulnerabilities to escalate to SYSTEM-level access. Security teams tracking active exploits can follow zero-day disclosures like these on daily.dev."}},{"@type":"Question","name":"How many vulnerabilities did Microsoft fix in September 2026 Patch Tuesday compared to previous records?","acceptedAnswer":{"@type":"Answer","text":"Microsoft fixed between 964 and 974 CVEs depending on counting method, making it the largest single patch release in company history and surpassing the previous record of 570 set in July 2026. Roughly 104 to 113 of the fixes are rated critical, with elevation of privilege bugs making up nearly 45% of patches and remote code execution about 27%. Teams triaging huge patch batches each month can track Patch Tuesday trends on daily.dev."}},{"@type":"Question","name":"Which Windows vulnerabilities from September 2026 Patch Tuesday should be prioritized first?","acceptedAnswer":{"@type":"Answer","text":"Tenable recommends prioritizing the two actively exploited zero-days plus the CVSS 9.8 remote code execution flaws: CVE-2026-69730 (Windows DNS Server RCE), CVE-2026-69829 (Windows Shell RCE), and CVE-2026-69525 (Remote Desktop Services RCE), along with the CVSS 8.8 Kerberos RCE (CVE-2026-69676) and an Exchange Server elevation of privilege bug (CVE-2026-69380). Admins prioritizing patch rollouts can find critical CVE breakdowns like these on daily.dev."}}]} ```