- What: Microsoft's September 2026 Patch Tuesday fixed 974 vulnerabilities, the largest single release ever, including two Windows privilege escalation flaws already exploited in the wild.
Microsoft shipped fixes for 974 vulnerabilities on September 8, 2026, the largest Patch Tuesday on record. Counting 25 non-Microsoft CVEs routed through the same update channel, the total reaches 999. Two of the 974 are already being exploited in the wild, and both are local privilege escalation bugs in Windows that end with the attacker holding SYSTEM. CISA added both to the Known Exploited Vulnerabilities catalog and set a remediation deadline for federal civilian agencies of September 22, 2026. The volume is a problem for your change calendar. The two zero-days are a problem for tonight.
Windows absorbed 723 of the fixes. Office and Office 2016 took 111, SQL Server 62, and developer tools 22. More than 110 carry a critical rating. Privilege escalation, remote code execution, and information disclosure account for close to 90 percent of the month. Counts vary by a few CVEs depending on the source, with Tenable putting the Microsoft total at 964, because vendors draw the boundary of what counts as a Microsoft CVE differently. The rank order of what you patch first does not change.
The two bugs under active attack
CVE-2026-85880 (CVSS 7.8) is a heap-based buffer overflow in Windows Advanced Local Procedure Call. Microsoft's advisory is specific about the abuse path: code running in a low privilege AppContainer can exploit it to escape the sandbox and elevate to SYSTEM, with no additional user interaction required. That is the classic browser-renderer-to-SYSTEM second stage, which means it pairs with whatever remote bug an operator already has. Volexity and Proofpoint were credited with reporting it, a combination that usually indicates it was pulled out of real intrusion or campaign telemetry rather than a lab. It is the first ALPC bug weaponized as a zero-day since CVE-2023-21674 in January 2023.
CVE-2026-81963 (CVSS 7.8) is an improper link resolution flaw in the Windows Update Stack, again ending at SYSTEM. Rapid7's Adam Barnett reads the fix as tightening controls so the Update Stack will no longer follow a malicious link and overwrite a system component with an attacker-controlled imposter. Every supported version of Windows gets a patch. Tenable counts seven privilege escalation flaws in the Windows Update Stack since 2022, and this is the first one to be exploited in the wild. Credit went to Romain Deperne of Airbus Helicopters and the Microsoft Threat Intelligence Center.
Microsoft confirmed exploitation but disclosed nothing about the operators, the campaign scale, or whether any victim was successfully breached. Treat the absence of detail as absence of detail, not as evidence that the activity is small.
Neither bug gets an attacker onto the box. Both are what an attacker uses once they are on it. If you are running an EDR that catches initial access most of the time, these are exactly the flaws that turn the 1 in 20 it misses into domain-level compromise. FCEB agencies have until September 22, 2026. Everyone else should treat that date as the outer bound, not the target.
Nine more that deserve same-week attention
None of these are known to be exploited yet, but five are unauthenticated network RCEs at CVSS 9.8 in services that organizations routinely expose internally and sometimes externally.
- CVE-2026-69525 (9.8): use-after-free in Windows Remote Desktop Services, unauthenticated RCE over the network
- CVE-2026-69730 (9.8): use-after-free in Windows DNS Server, unauthenticated RCE, and DNS servers are almost always domain controllers
- CVE-2026-72979 (9.8): use-after-free in Windows DHCP Server, unauthenticated RCE
- CVE-2026-69595 (9.8): use-after-free in the Windows Services for NFS ONCRPC XDR driver, unauthenticated RCE
- CVE-2026-69829 (9.8): heap-based buffer overflow in Windows Shell, unauthenticated RCE over the network
- CVE-2026-65669 (9.6): injection flaw in SQL Server allowing unauthenticated network privilege escalation
- CVE-2026-69465 (8.8): missing authorization in SharePoint, authenticated network RCE, and SharePoint has a track record of rapid exploit development
- CVE-2026-80097 (8.6): improper authentication in Microsoft Authenticator allowing local privilege escalation, an identity control failing open
- CVE-2026-55007 (8.1): double free in Microsoft Exchange Server, unauthenticated network code execution
How the number got this big
The 2026 trend line is steep: 161 in May, 220 in June, 663 in July, 457 in August, then 974 in September. Tenable measures the jump at nearly 70 percent above the previous record and puts the year to date past 2,600, already more than double the full-year record of 1,245 set in 2020, with three months left. ZDI counts 2,760 Microsoft flaws fixed in 2026. Both trackers point at the same cause: AI-assisted vulnerability discovery has changed the input rate to Microsoft's security response process, and nothing suggests it slows down from here.
What has not changed at the same rate is exploitation. There is no correlating spike in active exploits, and the subset of these 974 that actually touch most environments stays small. That is the planning assumption for the rest of 2026: bigger batches, roughly flat exploited counts, so the value of your patch program moves almost entirely into triage quality rather than throughput.
Triage order for a 974 CVE month
- Tonight: CVE-2026-85880 and CVE-2026-81963 on every workstation and server. Both are in the base OS, so there is no role-based scoping to hide behind.
- This week: the five CVSS 9.8 network RCEs, scoped by installed role. Query for the DNS, DHCP, NFS, and RDS roles first rather than patching blind across the fleet.
- This week: Exchange, SharePoint, and SQL Server, in that order. Internet-reachable instances first.
- Normal cycle: the remaining 960 or so. Let your standard ring deployment carry them, and do not let the headline number pressure you into skipping pilot rings.
Jack Bicer of Action1 framed the operational problem correctly: at this scale the challenge is not getting through the list, it is knowing what needs attention first. A team that patches two zero-days plus nine critical CVEs in 72 hours and lets the other 963 ride the normal cycle is in better shape than a team that stalls for three weeks trying to move all 974 at once.
Bottom line
Deploy the September updates to every supported Windows version, prioritizing CVE-2026-85880 and CVE-2026-81963 because they are being used right now. Then scope the 9.8 RCEs to the servers that actually run DNS, DHCP, NFS, and RDS, and get those patched before the KEV deadline on September 22, 2026. Build your process for a world where 900 plus CVE months are normal, because the discovery rate driving this is not reverting.
Fix It Yourself
Everything above is what happened. This is what to run. The check commands change nothing.
Check whether you are exposed
Lists the 10 most recent updates on this Windows host so you can confirm the September 2026 rollup landed
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID,Description,InstalledOnShows the exact OS build and revision to compare against the September 2026 servicing build for your Windows version
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object ProductName,DisplayVersion,CurrentBuild,UBRFlags whether this server runs the roles carrying this month's CVSS 9.8 unauthenticated RCEs (DNS, DHCP, NFS, RDS)
Get-WindowsFeature | Where-Object { $_.Installed -and $_.Name -match 'DNS|DHCP|NFS|Remote-Desktop' } | Select-Object Name,InstallStateClose it
Scans, downloads, and installs pending Windows updates. Microsoft did not publish a single fixed version, the target build differs per Windows release, so this pulls whatever applies to this host
UsoClient ScanInstallWaitContainment only, blocks inbound RDP at the host firewall until CVE-2026-69525 is patched. Reversible with Remove-NetFirewallRule
New-NetFirewallRule -DisplayName "Hold RDP for CVE-2026-69525" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action BlockStops and disables the NFS server service on hosts that do not need it, closing CVE-2026-69595 without removing the role
Stop-Service NfsService -Force; Set-Service NfsService -StartupType DisabledPrompts for the agent you already run
Paste this the morning after Patch Tuesday to find out which of your Windows hosts are still exposed
Paste this when you need a prioritized rollout plan out of a 974 CVE batch
What to alert on
The highest value observable for both zero-days is process integrity transition in process creation logs. In Sysmon Event ID 1 or Windows Security Event ID 4688, alert on any process whose parent has an AppContainer or Low IntegrityLevel (Sysmon field IntegrityLevel of AppContainer or Low) spawning a child at IntegrityLevel System, which is the exact signature CVE-2026-85880 produces when it escapes the sandbox. Chain that with Security Event ID 4672 (special privileges assigned to new logon) where the SubjectUserSid is not a known service account. For CVE-2026-81963, watch Sysmon Event ID 11 (FileCreate) and Event ID 2 (file creation time changed) for writes into C:\Windows\System32 and C:\Windows\WinSxS where the Image field is usoclient.exe, TiWorker.exe, or svchost.exe hosting wuauserv but the event falls outside your approved maintenance window, and specifically for reparse point or symbolic link creation under those paths, since link resolution abuse is the mechanism the patch closes. If you run EDR rather than Sysmon, the equivalent is a process lineage rule on low integrity parent to SYSTEM child plus a file integrity monitoring rule on System32 writes not attributable to a scheduled update job.
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us