Microsoft Discloses 973 Vulnerabilities as CISA Flags Two Actively Exploited Flaws
Summary
Microsoft disclosed 973 vulnerabilities in its latest Patch Tuesday release. CISA confirmed active exploitation of CVE-2026-81963 and CVE-2026-85880; researchers also warned that more than 22,000 Exchange servers remain unpatched against weaponized exploit code.
Key points
- Microsoft disclosed 973 vulnerabilities in its latest Patch Tuesday release, setting a record, according to the article.
- CISA confirmed that CVE-2026-81963 and CVE-2026-85880 are being actively exploited.
- Federal agencies have until September 22 to patch the two exploited vulnerabilities.
- According to a Nightwing expert, more than 22,000 corporate Exchange servers remain unpatched against weaponized exploit code.
- Researchers warned that attackers could chain vulnerabilities into privilege escalation and ransomware-style attacks.
Article Details
- Event Type
- Microsoft Patch Tuesday vulnerability disclosure with confirmed active exploitation
- Impact
- Microsoft disclosed 973 vulnerabilities. CISA confirmed that CVE-2026-81963 and CVE-2026-85880 are being actively exploited. More than 22,000 corporate Exchange servers were reported unpatched against weaponized exploit code, and researchers warned the flaws could contribute to privilege-escalation and ransomware attack chains.
MITRE ATT&CK
CVE
CVE-2026-81963Microsoft’s latest Patch Tuesday set a new record with 973 disclosed bugs, including two actively exploited vulnerabilities tracked as CVE-2026-81963 and CVE-2026-85880.CVE-2026-85880Microsoft’s latest Patch Tuesday set a new record with 973 disclosed bugs, including two actively exploited vulnerabilities tracked as CVE-2026-81963 and CVE-2026-85880.
People
Diksha OjhaQualys cybersecurity expert who commented on the scale of disclosed vulnerabilities.Nick CarrollNightwing cybersecurity expert who said more than 22,000 corporate Exchange servers were unpatched against weaponized exploit code.Satnam NarangTenable researcher who described the affected Windows components.Serena DiPentiAutomox engineer who warned that compromise of the Windows update stack could undermine remediation.
Vendors
AdobeQualys cybersecurity expert Diksha Ojha added that another vulnerability announced by Adobe this month was a critical-severity bug in Adobe Commerce.MicrosoftMicrosoft’s latest Patch Tuesday set a new record with 973 disclosed bugs, including two actively exploited vulnerabilities tracked as CVE-2026-81963 and CVE-2026-85880.
Products
Adobe CommerceQualys cybersecurity expert Diksha Ojha added that another vulnerability announced by Adobe this month was a critical-severity bug in Adobe Commerce.Microsoft Exchange ServerResearchers warned that thousands of unpatched Exchange servers and weaknesses in the Windows update stack could help attackers chain exploits into ransomware-style intrusions.Microsoft WindowsResearchers warned that thousands of unpatched Exchange servers and weaknesses in the Windows update stack could help attackers chain exploits into ransomware-style intrusions.