Microsoft Patches 974 Vulnerabilities, Including Two Actively Exploited Zero-Days
Summary
Microsoft’s largest-ever Patch Tuesday fixed 974 vulnerabilities, including two actively exploited Windows privilege-escalation zero-days. Experts said AI-assisted discovery is increasing disclosures without a matching surge in exploitation and urged risk-based patching
Key points
- Microsoft patched 974 vulnerabilities across its product suite, its largest-ever Patch Tuesday release.
- Two vulnerabilities were exploited before disclosure: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call.
- Both zero-days were rated CVSS 7.8 and allow privilege escalation.
- More than 10% of the disclosed vulnerabilities were rated critical.
- Experts said AI-assisted vulnerability discovery is driving higher disclosure volumes, but has not yet produced a corresponding increase in active exploitation.
- Researchers advised organizations to prioritize patches based on their exposure and risk rather than the total number of updates.
Article Details
- Event Type
- Microsoft Patch Tuesday security update addressing 974 vulnerabilities, including two actively exploited zero-days.
- Impact
- The two zero-days affected the Windows Update Stack and Windows Advanced Local Procedure Call and enabled privilege escalation. More than 10% of the patched vulnerabilities were rated critical.
CVE
CVE-2026-81963The vulnerabilities actively exploited prior to disclosure — CVE-2026-81963 affecting the Windows Update Stack and CVE-2026-85880 affecting Windows Advanced Local Procedure Call — both have CVSS ratings of 7.8 and allowCVE-2026-85880actively exploited prior to disclosure — CVE-2026-81963 affecting the Windows Update Stack and CVE-2026-85880 affecting Windows Advanced Local Procedure Call — both have CVSS ratings of 7.8 and allow attackers
People
Dustin ChildsHead of threat awareness at Trend Micro’s Zero Day Initiative; commented on AI-assisted vulnerability discovery and exploitation.Jack BicerDirector of vulnerability research at Action1; commented on prioritizing the large volume of patches.Satnam NarangSenior staff research engineer at Tenable; advised prioritizing vulnerabilities based on exposure and risk.
Vendors
Products
Microsoft WindowsMicrosoft patched 974 defects in its largest-ever Patch Tuesday update, including two actively exploited zero-day vulnerabilities in the Windows Update Stack and Windows Advanced Local Procedure Call.OfficeThe update included 723 vulnerabilities in Windows, 111 in Office, 111 in Office 2016, 62 in SQL and 22 spanning various developer tools.Office 2016The update included 723 vulnerabilities in Windows, 111 in Office, 111 in Office 2016, 62 in SQL and 22 spanning various developer tools.SQLThe update included 723 vulnerabilities in Windows, 111 in Office, 111 in Office 2016, 62 in SQL and 22 spanning various developer tools.Windows Advanced Local Procedure CallMicrosoft patched 974 defects in its largest-ever Patch Tuesday update, including two actively exploited zero-day vulnerabilities in the Windows Update Stack and Windows Advanced Local Procedure Call.Windows Update StackMicrosoft patched 974 defects in its largest-ever Patch Tuesday update, including two actively exploited zero-day vulnerabilities in the Windows Update Stack and Windows Advanced Local Procedure Call.