Microsoft September 2026 Patch Tuesday Fixes 966 Flaws, Including Two Exploited Zero-Days
Summary
Microsoft's September 2026 Patch Tuesday fixes 966 vulnerabilities, including 105 rated Critical and two actively exploited Windows privilege-escalation zero-days affecting the Update Stack and ALPC.
Key points
- Microsoft released fixes for a reported record 966 vulnerabilities; the total excludes 204 flaws addressed earlier in the month.
- The release includes 105 vulnerabilities rated Critical, with 81 identified as remote code execution flaws.
- CVE-2026-81963 is an actively exploited Windows Update Stack link-resolution flaw that allows an authorized local attacker to gain SYSTEM privileges.
- CVE-2026-85880 is an actively exploited heap-based buffer overflow in Windows ALPC that allows an authorized local attacker to gain SYSTEM privileges.
- Microsoft has not disclosed details of the attacks exploiting either zero-day.
- Updates cover Windows, Office, SQL Server, Exchange Server, Entra ID, and Azure services.
- The article links the increase in vulnerability discoveries to Microsoft's use of an AI-powered discovery system.
Article Details
- Event Type
- Security patch release addressing actively exploited zero-days
- Impact
- The article reports that Microsoft's September 2026 Patch Tuesday fixes 966 vulnerabilities, including 105 rated Critical and two actively exploited local privilege-escalation zero-days that allow authorized attackers to gain SYSTEM privileges. CVE-2026-81963 involves improper link resolution in Windows Update Stack, while CVE-2026-85880 involves a heap-based buffer overflow in Windows ALPC. Microsoft has not disclosed how either vulnerability was exploited.
MITRE ATT&CK
CVE
CVE-2026-81963Microsoft’s September 2026 Patch Tuesday is its largest ever, fixing 966 flaws and two actively exploited zero-days, CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC.CVE-2026-85880Microsoft’s September 2026 Patch Tuesday is its largest ever, fixing 966 flaws and two actively exploited zero-days, CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC.
People
David GalazinNamed among the Proofpoint researchers credited with discovering the Windows ALPC vulnerability CVE-2026-85880.Jeremy HedgesNamed among the Proofpoint researchers credited with discovering the Windows ALPC vulnerability CVE-2026-85880.Mark KellyNamed among the Proofpoint researchers credited with discovering the Windows ALPC vulnerability CVE-2026-85880.Romain DeperneCredited alongside Microsoft Threat Intelligence Centre (MSTIC) for the Windows Update Stack vulnerability CVE-2026-81963.
Vendors
Products
Entra IDThe update spans major products including Windows, Office, SQL Server, Exchange Server, Entra ID, Azure services, and Microsoft Edge, with 105 Critical vulnerabilities addressed overall.Microsoft EdgeThe update spans major products including Windows, Office, SQL Server, Exchange Server, Entra ID, Azure services, and Microsoft Edge, with 105 Critical vulnerabilities addressed overall.Microsoft Exchange ServerThe update spans major products including Windows, Office, SQL Server, Exchange Server, Entra ID, Azure services, and Microsoft Edge, with 105 Critical vulnerabilities addressed overall.Microsoft WindowsMicrosoft’s September 2026 Patch Tuesday is its largest ever, fixing 966 flaws and two actively exploited zero-days, CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC.OfficeThe update spans major products including Windows, Office, SQL Server, Exchange Server, Entra ID, Azure services, and Microsoft Edge, with 105 Critical vulnerabilities addressed overall.SQL ServerThe update spans major products including Windows, Office, SQL Server, Exchange Server, Entra ID, Azure services, and Microsoft Edge, with 105 Critical vulnerabilities addressed overall.