cyber.hendryadrian.com
Security News · krebsonsecurity.com

Microsoft Releases Patches for 974 Security Flaws, Including Two Actively Exploited Zero-Days

· Original article ↗

Summary

Microsoft patched at least 974 security flaws, including two actively exploited Windows zero-days. Experts warn that the growing volume of fixes, partly linked to AI-assisted discovery, is straining organizations’ testing and prioritization efforts.

Key points

  • Microsoft says the September 8 release fixes at least 974 flaws across Windows and other software, exceeding its previous single-release record.
  • Two patched Windows privilege-escalation flaws, CVE-2026-81963 and CVE-2026-85880, are being actively exploited.
  • The release includes 113 flaws rated critical by Microsoft.
  • CVE-2026-69730 affects Windows Server 2012 onward and Windows 10; Microsoft says an unauthenticated attacker could exploit it by sending a specially crafted packet.
  • CVE-2026-69829 is a critical Windows Shell remote-code-execution flaw with a CVSS score of 9.8.
  • Experts say organizations should assess which flaws apply to them and prioritize fixes by reachability and exploitability, while testing updates for compatibility.

Article Details

Event Type
Microsoft Patch Tuesday security update release
Impact
Microsoft issued updates for at least 974 security vulnerabilities, including two actively exploited zero-days that allow privilege escalation on Windows systems. The article also identifies critical flaws that could enable system compromise, while noting that organizations face substantial testing and deployment workload.

CVE

CVE-2026-69730Among the more serious critical flaws this month is CVE-2026-69730, a DNS weakness present in Windows Server 2012 onward and on Windows 10.CVE-2026-69829Also scary is CVE-2026-69829, a critical, remote code execution flaw in the Windows Shell.CVE-2026-81963There are two “zero-day” flaws fixed this month that are being actively exploited: both CVE-2026-81963 and CVE-2026-85880 allow an attacker to elevate their privileges on Windows system.CVE-2026-85880There are two “zero-day” flaws fixed this month that are being actively exploited: both CVE-2026-81963 and CVE-2026-85880 allow an attacker to elevate their privileges on Windows system.

People

Satnam NarangSenior staff research engineer at Tenable; commented on prioritizing vulnerabilities based on organizational risk.Tyler RegulyAssociate director of security research and development at Fortra; commented on the challenges of testing and deploying Windows updates.

Vendors

MicrosoftMicrosoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever.

Products

Microsoft Windowstoday issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever.Windows ServerAmong the more serious critical flaws this month is CVE-2026-69730, a DNS weakness present in Windows Server 2012 onward and on Windows 10.

Related Articles