If you manage Windows systems, clear your calendar. Microsoft just dropped its largest Patch Tuesday in history — 974 vulnerabilities, two of which are already being exploited in the wild. This is not a routine update cycle. This is the new reality of patching at scale.
On September 8, 2026, Microsoft released security updates covering a staggering 974 CVEs across its entire product portfolio. That is more than double August’s 457 fixes and nearly six times the 161 CVEs patched in May. Combined with 25 non-Microsoft CVEs also addressed this month, the total hits 999 vulnerabilities resolved in a single cycle.
The breakdown alone tells the story: 723 flaws in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools. Over 110 of these carry a critical severity rating. Three vulnerability types — privilege escalation, remote code execution, and information disclosure — account for nearly 90 percent of the patches.
But the headline is the two actively exploited zero-days.
The Zero-Days You Need to Patch First
CVE-2026-85880 (CVSS 7.8) — A heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component. An attacker who can execute code in a low-privilege AppContainer can exploit this vulnerability locally to escape the sandbox and elevate privileges to SYSTEM. No user interaction required. Microsoft credited Volexity and Proofpoint for reporting this bug.
This is notable because Microsoft has not patched an ALPC zero-day since CVE-2023-21674 in January 2023. It is the first ALPC flaw exploited in the wild in nearly four years.
CVE-2026-81963 (CVSS 7.8) — An improper link resolution vulnerability in the Windows Update Stack. This link-following defect lets an authenticated attacker elevate privileges locally to gain SYSTEM access. Romain Deperne (Airbus Helicopters) and Microsoft Threat Intelligence Center (MSTIC) were credited with the discovery.
This is the first Windows Update Stack zero-day on record — none of the seven previous Update Stack CVEs were exploited before a patch existed.
It Gets Worse: 20 Potentially Wormable Vulnerabilities
Beyond the two exploited zero-days, Dustin Childs of Trend Micro’s ZDI notes that 20 of the patched vulnerabilities are potentially wormable. These are RCE flaws that require no authentication and no user interaction — the kind that spreads automatically across networks. If history is any guide, attackers will be reverse-engineering these patches over the next few weeks looking for exploit chains.
What Is Driving These Numbers?
Microsoft has patched 2,760 CVEs so far in 2026, and AI-assisted vulnerability discovery is accelerating the pace. Jack Bicer of Action1 put it well: “At this scale, the challenge is not simply getting through the patch list but knowing what needs attention first.”
IT and security teams need to separate the vulnerabilities that demand immediate action from those that can follow the normal deployment cycle. The two exploited zero-days, plus the 20 wormable RCEs, belong firmly in the first category.
What You Should Do Right Now
1. Patch the zero-days immediately. If you use Windows, prioritize CVE-2026-85880 and CVE-2026-81963. Both are EoP flaws that let attackers go from low-privilege code to full SYSTEM access. There is no mitigation — the fix is the patch.
2. Review the 20 wormable RCEs. These are the vulnerabilities most likely to be weaponized next. Pay special attention to CVE-2026-55007 (Exchange Server RCE), CVE-2026-69525 (Remote Desktop Services RCE), and CVE-2026-69465 (SharePoint RCE).
3. Extend your patch window. With nearly 1,000 CVEs in a single month, a Tuesday-to-Tuesday patching cadence may no longer be realistic. Consider rolling deployments with critical-priority windows opening within 24 hours.
4. Enable attack surface reduction rules. If you use Microsoft Defender for Endpoint, enforce ASR rules that block Office child process creation and credential theft from the Windows LSASS subsystem.
5. CISA KEV deadline: September 22. Both zero-days are in CISA’s Known Exploited Vulnerabilities catalog. Federal agencies must patch by September 22, 2026. Private sector should treat that as a hard deadline too.
6. Audit your AppContainers. CVE-2026-85880 is exploited from within a low-privilege AppContainer. Review which applications are running with AppContainer capabilities and restrict where possible.
September 2026 Patch Tuesday is a watershed moment. Microsoft is patching more vulnerabilities than ever, and attackers are exploiting them before the patch cycle even completes. The takeaway is blunt: if you do not have an automated, prioritized patching process, you are already falling behind.